Joseph W. Shaw II
Jamey B. Tubbs, CISSP, ENCE, SCERS, CEH
Copyright
Acquiring Editor:Chris Katsaropoulos
Development Editor:Benjamin Rearick
Project Manager:Malathi Samayan
Designer:Greg Harris
Syngress is an imprint of Elsevier
225 Wyman Street, Waltham, MA 02451, USA
2014 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publishers permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Grant, Nicholas, 1978
Unified communications forensics : anatomy of common UC attacks / Nicholas Grant, Joseph Shaw II.
pages cm
Includes bibliographical references and index.
ISBN 978-1-59749-992-7 (pbk.)
1. Internet telephony. 2. Computer network protocols. 3. Forensic sciences. I. Shaw, Joseph, II, 1976- II. Title.
TK5105.8865.G73 2013
658.478--dc23
2013023565
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
For information on all Syngress publications, visit our website at store.elsevier.com/Syngress
ISBN: 978-1-59749-992-7
Printed in the United States of America
14 15 16 12 11 10 9 8 7 6 5 4 3 2 1
List of Figures
SIP header format.
Tpcdump.
Wireshark interface.
Downloading Security Onion ISO.
Downloading VMware Player.
Installing VMware Player.
Installing Security Onion.
Virtual machine hardware configuration.
Security Onion VM installation screen.
About the Authors
Nicholas Grant is an information security professional with over ten years of experience within the industry. He holds a CISSP and has a Masters of Science in Management of Information Systems Security from Colorado Technical Institute. He works as a Vulnerability Manager for a large financial institution. Also, Nicholas is a professor, teaching Bachelor and Associate level courses for a nationally accredited university. His experience includes IT Governance, Security Policy Development, Information Assurance Engineering, Voice Over IP Implementation and Penetration Testing, Training, and Teaching.
Joseph W Shaw II has been working in Information Security for over 18 years, with experience in various industry verticals including telecommunications, energy, luxury retail, legal and healthcare. He is now a consultant for a large worldwide professional services company, where he provides expertise in Digital Forensics with an emphasis on Incident Response, Malware Analysis and Reverse Engineering, Vulnerability Assessment, Penetration Testing and, Security Event and Incident Management (SEIM) for clients in multiple industries. Mr. Shaws current duties also include teaching Mastering Macintosh Forensics, Cellebrite UFED Physical and Logical Analyzer, and Incident Response classes to civilians as well as local, state, and federal law enforcement agencies. In addition, he also teaches digital forensics to foreign law enforcement agencies across the globe through the US Department of States Antiterrorism Assistance program. Mr. Shaw is a SANS Lethal Forensicator and holds the following certifications: Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), EnCase Certified Examiner (EnCE), GIAC Auditing Wireless Networks (GAWN), and is a licensed Private Investigator Qualified Manager in the State of Texas. When not on the road or speaking at Information Security conventions, Mr. Shaw lives in the suburbs of Dallas, TX with his beautiful wife Melissa, their eight awesome children, two cats and a great dane.
Contributing Author
Nick Hensley , CISSP
Nick Hensley, having held his CISSP since 2002, is a seasoned information security professional with 12 years in the industry. He currently manages a team of penetration testers and performs penetration and application security testing alongside his team, supporting roughly 150 different clients. His background covers a broad range of managerial and technical positions. Nicks expertise lies in Penetration Testing, Computer Forensics, Electronic Discovery, Intrusion Detection and Prevention Systems, and Security Architecture Design and Implementation.
Dedications
Joseph W Shaw II Personal:
First, Id like to thank my Lord and Savior, Jesus Christ, for His grace and blessings. You have led, and I have followed. I was lost, but now am found.
Id like to dedicate this book to my family, whose sacrifices during its production cannot be overstated. To my wife, Melissa, who has always believed in me and kept me sane, even in the face of deadlines and immense pressures. I know were both Type-A personalities, but youve been the best goat ever, and Id be nothing without you. And to my children, Haley, Joseph, Jeffery, Thomas, Jubilee, Judah, David and Daniel, for understanding when daddy needed to sequester himself away in his office and write/edit instead of spending time with the family. Your graciousness and understanding made this book possible, and I promise to make it worth it!
To Syngress, Dave and Brian:
The authors would first like to thank everyone at Syngress for working with us to get this book produced and published. Its been a long road from the initial book proposal we submitted to a published book, and we greatly appreciate all the hard work that went into making it happen.