Testing For Vulnerabilities Voip Systems For Smes

Published Date: 02 Nov 2017

In the following report is a focus on testing vulnerabilities in VoIP systems in SMEs (small and medium sized enterprises). The focus on testing for vulnerabilities in VoIP and why this helps in general VoIP(mostly asterisk systems) also the impact of these vulnerabilities on SMEs. The main reason for testing is to see what is found when doing certain tests and how attackers hide from the tests. The major threats and the points of entry, the attacks can be stopped or minimised enough so the attackers can’t break into the VoIP to cause any damage. With preventing this, it helps the SMEs on a day to day basis on not crashing and stopping there work process or stopping and starting it.

Overall it will show what the common vulnerabilities are in SMEs VoIP systems and how to minimise the threats.

Why to test for Vulnerabilities?

Testing for vulnerabilities are the main way to focus on threats to any network device or anything in general to minimise or get rid of any threats that can attack your network or device. To start the testing first would be to find the threats that target SMEs and VoIP’s in general to cover all places where an 3attack could happen to limit the vulnerabilities to test so the testing doesn’t go on to long and do tests that aren’t necessary to VoIP in SMEs.

First is to test the most common vulnerabilities of VoIP networks to make sure the devices and the standard VoIP network setup is threat resistant against attacks on the most common level of VoIP vulnerabilities so that the easiest to spot vulnerabilities are out the way and SME networks don’t get attacked in the most common areas that should be fixed and resistant to attack at the very first stage of setting up the VoIP System.

One the most common VoIP systems used in SME networks is Asterisk, which is safe VoIP to an extent on private networks but the security is a top priority due to it being an easy target for Users when it is connected to a network that has internet access. So constant testing for these VoIP systems for SME’s is priority over other VoIP systems due to the vulnerabilities.

VoIP isn’t such a big problem as users think it’s just perceived that way, but it is a slight different problem. There are varieties of techniques to find the problems and this is where testing comes into to find them so we can minimise the risk to the VoIP systems to prevent the attacks. When this happens and the VoIP market increases "it is also expected that several new threats exploiting the Internet vulnerabilities will appear", so the on-going testing for VoIP vulnerabilities will continues until they find a near un-attackable system.

Threats to VoIP systems

Here are some of the most common and major threats to VoIP and how to minimise the risk they cause to VoIP Systems.

Eavesdropping

In VoIP systems eavesdropping is looked at and given a lot of attention in VoIP systems due to, in general and most systems are encrypted by default so they make easy targets. There are however plenty of encryption options for users of the VoIP to use but then not all encryptions are compatible with the network and devices on the network for the VoIP and devices to fully function correctly together. So with the nature of VoIP the implementation of encryption is quite difficult to implement. There is also no easy way to ensure end to end encryption but there are a few solutions but they are not easy.

Another issue to the threat of eavesdropping is the number of peers/users in the conversation, due to more users makes the technology more useful and having it mobile, increases this but also at the mobile locations it depends on their ISP and security between the peers.

Denial of service

With the telephone networks that people were using before VoIP was introduce and still now the uptime has been very high and it is fairly impressive, when compared to internet provides, we can generally just pick a phone up and use anytime. This makes the expectations of VoIP high too but factoring in the uptime of ISP and the traffic on the internal network can make the expectations very low. This can be a real big problem as it exposes the VoIP to all denial of service issues with it being connected to the internet. To combat against these can be a difficult and expensive measure to combat against these attacks.

This can be very devastating for SME’s since they are aren’t as big or as nearly as big as some of the larger business and the interruptions can be devastatingly bad they can lose a lot of their income, which is bad for the smaller business, but they can be back up and running quicker than larger business due to the smaller networks.

Caller ID Spoofing

One the oldest things that effects VoIP but has become a fairly easy thing to do, even for attackers with not much technical knowledge as many of the VoIP service providers sell the service. This making the caller ID spoofing more popular than it was since it was present before the VoIP service became popular among business worldwide. This can affect any type or size of business.

Troll Fraud

Troll Fraud one of the most expensive threats since this aims at using the VoIP service to make phone calls from a large business that makes many phone calls using VoIP so it makes it easier for attackers to use the service and not get noticed as easy. This makes attackers not getting noticed a small chance, racking up expensive phone call bills.

"Existing VoIP billing is based on the underlying VoIP signalling and media transport protocols. Hence, vulnerabilities in VoIP signalling and media transports can be exploited to compromise the trustworthiness of the billing of VoIP systems."

This threat can also hit SME’s due to the smaller business may not have the equipment to monitor the attackers or uses due to lack of money but will most only find out when they get a VoIP bill, that is a lo larger than expected.

Delay

Internet can’t really be helped if the other call is not available to be reached on the internal network so the latency can be high causing a delay and this makes the speech take longer or disrupted. This can be more irritating that a threat but there is delay when the VoIP phone is picked up and put down but this can still be enough time, for the call to be intercepted and attacked to steal account details to use the VoIP service.

Where to focus more on VoIP systems?

The current focus for VoIP at the moment is the research in to the security and the protocols and how they are implemented on to the VoIP networks and systems. In order to change the issues with VoIP, the main threats need to be minimise the best possible and the encryption problem isn’t the only security issue that it has to face abut encryption is being given a lot of attention and the other are given distributed attention depending on the risk level the other threats are to VoIP.

More focus is need on software versions and there vulnerabilities so then business both SME and larger can have their devices on more up to date or less dated software on their devices depending on how well and from what aspects of security they want to go for on their network. Also more focus on more tools or a tool than can scan for more common threats in one scan rather than using several of tools to do the searching for risks.

Also the breaking down of the VoIP system to filter out the areas are weak rather than focusing on the whole system in one go to look for vulnerabilities would be better but the process would be longer but more thorough for looking for vulnerability weakness.

Summary

The testing of VoIP for vulnerabilities is always a need even if you think that the network you’re using is safe and secure, due to the mass amount of VoIP’s that are being set, there are becoming to be more and more attackers finding new and different ways to overcome the security of networks and making VoIP networks big or small and making them at risk and racking up huge bills due to unauthorised calls.

Threats listed are still always going to be risk to the networks but hopefully they will be minimised to an extent that they would be really any disruption or costing to businesses.

Then last of all the focus areas on all VoIP features to be looked at will continue to grow due to the ever growing users of VoIP making the every growing population of network attackers trying to attack and make networks at risk.