Voice over Internet Protocol (VoIP) networks have freed users from the tyranny of big telecom, allowing people to make phone calls over the Internet at very low or no cost. But while VoIP is easy and cheap, it's notoriously lacking in security. With minimal effort, hackers can eavesdrop on conversations, disrupt phone calls, change caller IDs, insert unwanted audio into existing phone calls, and access sensitive information.
Hacking VoIP takes a dual approach to VoIP security, explaining its many security holes to hackers and administrators. If you're serious about security, and you either use or administer VoIP, you should know where VoIP's biggest weaknesses lie and how to shore up your security. And if your intellectual curiosity is leading you to explore the boundaries of VoIP, Hacking VoIP is your map and guidebook.
Hacking VoIP will introduce you to every aspect of VoIP security, both in home and enterprise implementations. You'll learn about popular security assessment tools, the inherent vulnerabilities of common hardware and software packages, and how to:
Identify and defend against VoIP security attacks such as eavesdropping, audio injection, caller ID spoofing, and VoIP phishing
Audit VoIP network security
Assess the security of enterprise-level VoIP networks such as Cisco, Avaya, and Asterisk, and home VoIP solutions like Yahoo! and Vonage
Use common VoIP protocols like H.323, SIP, and RTP as well as unique protocols like IAX
Identify the many vulnerabilities in any VoIP network
Whether you're setting up and defending your VoIP network against attacks or just having sick fun testing the limits of VoIP networks, Hacking VoIP is your go-to source for every aspect of VoIP security and defense.
Chapter 1 AN INTRODUCTION TO VOIP SECURITY
Why VoIP
VoIP Basics
VoIP Security Basics
Attack Vectors
Summary
VOIP PROTOCOLS
Chapter 2 SIGNALING: SIP SECURITY
SIP Basics
SIP Messages
Making a VoIP Call with SIP Methods
Enumeration and Registration
SIP Security Attacks
Summary
Chapter 3 SIGNALING: H.323 SECURITY
H.323 Security Basics
H.323 Security Attacks
Summary
Chapter 4 MEDIA: RTP SECURITY
RTP Basics
RTP Security Attacks
Summary
Chapter 5 SIGNALING AND MEDIA: IAX SECURITY
IAX Authentication
IAX Security Attacks
Summary
VOIP SECURITY THREATS
Chapter 6 ATTACKING VOIP INFRASTRUCTURE
Vendor-Specific VoIP Sniffing
Hard Phones
Cisco CallManager and Avaya Call Center
Modular Messaging Voicemail System
Infrastructure Server Impersonation
Summary
Chapter 7 UNCONVENTIONAL VOIP SECURITY THREATS
VoIP Phishing
Making Free Calls
Caller ID Spoofing
Anonymous Eavesdropping and Call Redirection
Spam Over Internet Telephony
Summary
Chapter 8 HOME VOIP SOLUTIONS
Commercial VoIP Solutions
PC-Based VoIP Solutions
SOHO Phone Solutions
Summary
ASSESS AND SECURE VOIP
Chapter 9 SECURING VOIP
SIP over SSL/TLS
Secure RTP
ZRTP and Zfone
Firewalls and Session Border Controllers
Summary
Chapter 10 AUDITING VOIP FOR SECURITY BEST PRACTICES
Himanshu Dwivedi is a leading security expert and researcher. He has published four books, Hacking Exposed: Web 2.0 (McGraw-Hill), Securing Storage (Addison Wesley), Hacker's Challenge 3 (McGraw-Hill), and Implementing SSH (Wiley). A founder of iSEC Partners, Himanshu manages iSEC's product development and engineering, specialized security solutions, and the creation of security testing tools for customers.