Himanshu Dwivedi - Hacking VoIP: Protocols, Attacks, and Countermeasures

For an attack on VoIP to be possible, only one side of the conversation needs to be using VoIP. The other side can be any landline, mobile phone, or another VoIP line .

The solutions discuss the need for stronger authentication, encryption solutions, and new technology to protect VoIP soft clients. Finally, , "Auditing VoIP for Security Best Practices," introduces an audit program for VoIP. VoIP Security Audit Program (VSAP) provides a long list of topics, questions, and satisfactory/unsatisfactory scores for the end user. The program's goal is to allow VoIP administrators and security experts to evaluate VoIP deployments in terms of security.

In addition to in-depth discussions about VoIP security issues, the book also covers many free security tools currently available on the Internet. These tools can help supplement the learning process by allowing readers to test their own VoIP networks and identify any security holes and/or weaknesses.

And in addition to the security testing tools, step-by-step testing procedures have been supplied after every major section in each chapter. For example, in order to fully understand a security threat, practical application of the issue is often very important. This book provides step-by-step procedures and links to the most current information. This approach should ensure that readers have everything they need to understand what is being presented and why.

Each chapter has a common structure, which is to introduce a VoIP topic, discuss the security aspects of the topic, discuss the tools that can be used with the topic and any step-by-step procedures to fully explain or demonstrate the topic/tool, and then explain the mitigation procedures to protect the VoIP network.

Additionally, various character styles throughout the book have significance for the reader. Filenames and filepaths will appear in italics , and elements from the user interface that the reader is instructed to click or choose will appear in bold . Excerpts from code will appear in a monospace font, and input that the reader is instructed to type into the user interface will appear in bold monospace. Placeholders and variables in code will appear in monospace italic, and placeholders that the reader needs to fill in will appear in monospace bold italic.

Security vulnerabilities often get lost in discussions, white papers, or books without practical examples. The ability to read about a security issue and then perform a quick example significantly adds to the education process. Thus, this book provides step-by-step testing procedures and demonstrations for many of the security issues covered. In order to perform adequate VoIP testing described in the chapters, a non-production lab environment should be created. This section discusses the specific lab environment that was used for most of the attacks discussed in this book, as well as configuration files to set up the devices and software. It should be noted that readers are not expected to license expensive software from Cisco and Avaya; thus, only free or evaluation software has been used in all labs. However, all attacks shown in the book apply to both open source and commercial software/devices (Cisco/Avaya) depending on the VoIP protocols that are supported. For example, the security vulnerabilities and attacks against SIP will apply consistently to any device, commercial or free, that supports it.