Feeds

Cisco dismisses VoIP snooping concerns

Safe as houses, us

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Cisco has hit back at allegations that some of its IP telephony equipment is vulnerable to communications interception or denial of service attacks.

Last month, penetration outfit SecureTest went public with test results which showed Cisco 7900 VoIP phones are susceptible to both DoS attacks and communications interception vulnerabilities. Cisco 1760 VoIP routers can be crashed with malicious traffic, SecureTest further alleged.

SecureTest said the results went beyond those covered in a posting to BugTraq last August which suggested that the issue could be resolved by upgrading to Cisco Call Manager Release 3.3(3). Call Manager is Cisco's call setup (soft PBX) software.

According to SecureTest, attackers could be able to tap any call on the network or crash the entire phone system of any organisation using vulnerable Cisco kit.

Cisco strongly disputes this: follows its implementation guidelines and you will build a robust and secure IP telephony network, it says.

Implementation weaknesses and not vulnerabilities are to blame for any exploits that SecureTest might demonstrate, Cisco argues.

It is yet to confirm the validity of SecureTest's attack scenarios. None would be possible if IP telephones and PCs are kept on separate VLANs (Virtual Lans), according to Paul King, a Cisco consultant.

"I don't buy that it's a massive new security revelation that VLANs need to be kept separate and secure. If you keep VLANs separate then it would be very difficult to listen in to calls or attack phones."

He would be "very surprised" if any Cisco resellers put in a IP Telephony system without following its guidelines.

Look deeper

Cisco VoIP phones are vulnerable to ARP spoofing, enabling man-in-the-middle attacks and including data interception and packet injection, according to SecureTest. Attacks could be carried out remotely once a Trojan had been placed onto the VoIP network, it says

Not so, Cisco replies. Even if a PC is compromised with a Trojan it would be unable to affect a VoIP system. Also security features in its IP Telephony products defend against SecureTest attack scenarios.

Cisco CallManager 3.3(3) introduces a new feature on the Cisco 79XX IP Phone family called "Gratuitous ARP: Enabled/Disabled". By setting this to disabled, the IP Phones will ignore Gratuitous ARP messages, thereby thwarting man-in-the-middle attacks.

However, it might still be possible for an attacker to fool the router into thinking that his machine is a phone and thereby listen into half a conversation (the stream from the router to the phone, but not from the phone to the router).

To resolve this, Cisco has introduced a feature called Dynamic ARP Inspection (DAI) on several of its Catalyst Ethernet switch products. This feature is capable of recognising and dropping spoofed packets at the switch, thereby thwarting attacks.

DoS attacks against VoIP networks can be thwarted by protection at the firewall and router level.

As the "icing on the cake", Cisco has added a number of security enhancements to the latest version of its soft PBX software, CallManager 4.0. Digital certificates confirm the identity of network devices to protect against entry of rogue system users and encryption has been introduced to CallManager 4.0 to ensure privacy. Cisco has also added its Cisco Security Agent (intrusion prevention) technology to Cisco CallManager 4.0.

We put these points to SecureTest's Wil Allsopp, who says the company stands by its original findings. The authentication/encryption features that come with CallManager 4.0 deliver significant security improvements, but the "switch based traffic segregation" that comes with CallManager 3.3(3) can be attacked, he says. ®

Related Stories

Cisco VoIP kit open to 'snooping attacks'
Cisco gets into video conferencing

The essential guide to IT transformation

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
Object storage bods Exablox: RAID is dead, baby. RAID is dead
Bring your own disks to its object appliances
Oracle reveals 32-core, 10 BEEELLION-transistor SPARC M7
New chip scales to 1024 cores, 8192 threads 64 TB RAM, at speeds over 3.6GHz
VMware vaporises vCHS hybrid cloud service
AnD yEt mOre cRazy cAps to dEal wIth
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?