Feeds

Cisco dismisses VoIP snooping concerns

Safe as houses, us

  • alert
  • submit to reddit

High performance access to file storage

Cisco has hit back at allegations that some of its IP telephony equipment is vulnerable to communications interception or denial of service attacks.

Last month, penetration outfit SecureTest went public with test results which showed Cisco 7900 VoIP phones are susceptible to both DoS attacks and communications interception vulnerabilities. Cisco 1760 VoIP routers can be crashed with malicious traffic, SecureTest further alleged.

SecureTest said the results went beyond those covered in a posting to BugTraq last August which suggested that the issue could be resolved by upgrading to Cisco Call Manager Release 3.3(3). Call Manager is Cisco's call setup (soft PBX) software.

According to SecureTest, attackers could be able to tap any call on the network or crash the entire phone system of any organisation using vulnerable Cisco kit.

Cisco strongly disputes this: follows its implementation guidelines and you will build a robust and secure IP telephony network, it says.

Implementation weaknesses and not vulnerabilities are to blame for any exploits that SecureTest might demonstrate, Cisco argues.

It is yet to confirm the validity of SecureTest's attack scenarios. None would be possible if IP telephones and PCs are kept on separate VLANs (Virtual Lans), according to Paul King, a Cisco consultant.

"I don't buy that it's a massive new security revelation that VLANs need to be kept separate and secure. If you keep VLANs separate then it would be very difficult to listen in to calls or attack phones."

He would be "very surprised" if any Cisco resellers put in a IP Telephony system without following its guidelines.

Look deeper

Cisco VoIP phones are vulnerable to ARP spoofing, enabling man-in-the-middle attacks and including data interception and packet injection, according to SecureTest. Attacks could be carried out remotely once a Trojan had been placed onto the VoIP network, it says

Not so, Cisco replies. Even if a PC is compromised with a Trojan it would be unable to affect a VoIP system. Also security features in its IP Telephony products defend against SecureTest attack scenarios.

Cisco CallManager 3.3(3) introduces a new feature on the Cisco 79XX IP Phone family called "Gratuitous ARP: Enabled/Disabled". By setting this to disabled, the IP Phones will ignore Gratuitous ARP messages, thereby thwarting man-in-the-middle attacks.

However, it might still be possible for an attacker to fool the router into thinking that his machine is a phone and thereby listen into half a conversation (the stream from the router to the phone, but not from the phone to the router).

To resolve this, Cisco has introduced a feature called Dynamic ARP Inspection (DAI) on several of its Catalyst Ethernet switch products. This feature is capable of recognising and dropping spoofed packets at the switch, thereby thwarting attacks.

DoS attacks against VoIP networks can be thwarted by protection at the firewall and router level.

As the "icing on the cake", Cisco has added a number of security enhancements to the latest version of its soft PBX software, CallManager 4.0. Digital certificates confirm the identity of network devices to protect against entry of rogue system users and encryption has been introduced to CallManager 4.0 to ensure privacy. Cisco has also added its Cisco Security Agent (intrusion prevention) technology to Cisco CallManager 4.0.

We put these points to SecureTest's Wil Allsopp, who says the company stands by its original findings. The authentication/encryption features that come with CallManager 4.0 deliver significant security improvements, but the "switch based traffic segregation" that comes with CallManager 3.3(3) can be attacked, he says. ®

Related Stories

Cisco VoIP kit open to 'snooping attacks'
Cisco gets into video conferencing

High performance access to file storage

More from The Register

next story
Seagate brings out 6TB HDD, did not need NO STEENKIN' SHINGLES
Or helium filling either, according to reports
European Court of Justice rips up Data Retention Directive
Rules 'interfering' measure to be 'invalid'
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
Bored with trading oil and gold? Why not flog some CLOUD servers?
Chicago Mercantile Exchange plans cloud spot exchange
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.