George Wahome discusses how VoIP security is often neglected, leaving systems vulnerable to attack. He provides examples of companies that have experienced losses of millions of dollars due to VoIP hacks that went undetected for weeks or months. Following a "rule of thumb" that anything connected to the internet can be hacked if security is not prioritized, he explains common motivations and types of attacks, such as toll fraud, traffic generation to premium numbers, and eavesdropping. Wahome then demonstrates vulnerabilities like credentials cracking and call manipulation on a sample VoIP system. He concludes by recommending the use of TLS, SRTP, server hardening, perimeter security, and unique user pins for login IDs and voic
2. Who am I?
Information & Network Security Consultant
BSc. Computer Science & Technology
C|EH, CISA, CCNA Security, etc..
Projects: 15+ across over 9+ countries and
sites in Africa.LinkedIn can list the rest
3. Security and Privacy of our Voice Communication is Neglected !!!
Borderless, Connected and Communicating through VoIP
5. How it is..
Using IP for voice calls is awesome, cheap and
easy to deploy
As long as it is not broken, dont fix it!!
VoIP Servers are deployed with misconfigurations
Users put weak passwords for their extensions
Ex. FreePBX has 1M systems and 20,000 monthly
installs
6. Impact Examples of companies
LOSS : 2M
DETECT: 1 Month
LOSS : 4M
DETECT: Upon Billing
LOSS : 8M
DETECT: 2 Months (Billing)
LOSS : 12M in 48 hours
DETECT: 1 Week
LOSS : 8M in 4 Days
DETECT: Alert from
Service Provider
1
2
3 4
5
7. Rule of the Thumb
Rule: Anything connected to the
internet can get hacked
If you dont pay attention to
security you will get what you
deserve!!
Motivation: Money is to be made and/or get a free
service across international boundaries with virtually
no repercussions for the culprits
9. What can be done?
Disruption of operations
Harassment of individuals
Spoof - Steal minutes/ access so as to resell it and make money
(toll fraud)
Generate traffic to a premium number to make money
Social engineer systems or agents; Make calls & trick users into
calling back and giving personal information
Merchandize services e.g. SPAM over Internet Telephony (SPIT)
Listen to and record key conversations & video sessions
(Eavesdropping)
Modify/ manipulate conversations to embarrass, annoy, trick
users etc.
13. Mitigations
Use of TLS + SRTP
Hardening of VoIP Server
Implement Perimeter Security + ACL
Users to put non-default PIN for Login ID and
Voicemail access