DISCLAIMER: Logging other people's keystrokes or breaking
into other people's computer without their permission can
be considered illegal by the courts of many countries.
The monitoring software reviewed here is ONLY for authorized
system administrators and/or owners of computers.
We assume no liability and are not responsible for any misuse
or damage caused by the keylogging software. The end user of
this software is obliged to obey all applicable local, state,
federal and other laws in his country of residence.
December 19th, 2007
VoIP vulnerabilities increasing, but not exploits
The threats against voice over IP (VoIP) are numerous and seem to be growing, but the technology probably won't suffer crippling attacks in 2008.
The potential danger is very real. VoIP is susceptible to the many exploits that networks generally are heir to - denial of service, buffer overflows and more. VoIP PBXs are servers on corporate networks and are only as secure as the networks themselves.
In addition, there are many voice-specific attacks and threats. These have been chronicled by researchers and vendors intending to alert users and suggest ways to guard against them.
For instance, two protocols widely used in VoIP - H.323 and Inter Asterisk eXchange - have been shown to be vulnerable to sniffing during authentication, which can reveal passwords that later can be used to compromise the voice network. Implementations of Session Initiation Protocol (SIP), an alternative VoIP protocol, can leave VoIP networks open to unauthorized transport of data.
In addition, tools that can help find vulnerable deployments have been published online by a VoIPSA, an industry group dedicated to securing VoIP. The VoIPSA tools are intended to help businesses test and secure their networks, but these and other online tools can be used to probe for weaknesses as well.
Still, there have been few exploits so far and none that have been widespread or crippling to businesses. ‘We are not hearing about attacks. We don't think they are happening,’ said Lawrence Orans, an analyst at Gartner Inc.
Part of the reason may be that the largest VoIP vendors use proprietary protocols, such as Cisco Systems Inc.'s Skinny, Nortel Networks' Unistim and Avaya Inc.'s variant of H.323, Orans said. That makes them difficult to obtain and study for potential security cracks. ‘These systems are not readily available to the bad guys,’ he said.
SIP, which is gaining popularity, is a mixed bag, Orans said, because it is readily available to those who might want to exploit it. ‘I would say that SIP is a good-news, bad-news story. It's easy to get your hands on, and that includes the bad guys. The good news is there are more options to protect SIP,’ he said. These options include firewalls and intrusion-prevention systems that support SIP (compare products).
Another reason for the lack of broad exploits is that there isn't enough ROI for attackers' development time. Attackers' motivation may improve, however, as VoIP increases in popularity, something it is doing relentlessly.
Hybrid PBX systems - which handle both VoIP and TDM voice - account for 64% of all PBX lines sold, according to a December 2007 Infonetics report. Pure IP systems (compare products) account for another 18%.
Meanwhile, not everybody agrees with the assessment that VoIP will not suffer a major hit in 2008. ‘VoIP is, in essence, a time bomb, poised for a massive exploit,’ said Paul Simmonds, a member of the management board of the Jericho Forum, a user group promoting new principles for secure networking.
Source: COMPUTERWORLD
All news for December, 2008
All news for 2008 year
All news for 2007 year
All news for 2006 year
All news for 2005 year
All news for 2004 year
DONATION: Keylogger.org is an independent research
project supported by a team of enthusiasts. If you find this
project useful or would like to help foster its continued
development please consider making a donation using PayPal`s
online secure payment service. A PayPal account is not required.
All major credit cards are accepted (MasterCard/Eurocard,
Visa/Delta/Electron, American Express, Switch/Maestro, Solo).
Simply click the button below.
Any amount would be useful and appreciated!
Thanks in advance for your support!
|
