Feeds

Cisco dismisses VoIP snooping concerns

Safe as houses, us

  • alert
  • submit to reddit

Remote control for virtualized desktops

Cisco has hit back at allegations that some of its IP telephony equipment is vulnerable to communications interception or denial of service attacks.

Last month, penetration outfit SecureTest went public with test results which showed Cisco 7900 VoIP phones are susceptible to both DoS attacks and communications interception vulnerabilities. Cisco 1760 VoIP routers can be crashed with malicious traffic, SecureTest further alleged.

SecureTest said the results went beyond those covered in a posting to BugTraq last August which suggested that the issue could be resolved by upgrading to Cisco Call Manager Release 3.3(3). Call Manager is Cisco's call setup (soft PBX) software.

According to SecureTest, attackers could be able to tap any call on the network or crash the entire phone system of any organisation using vulnerable Cisco kit.

Cisco strongly disputes this: follows its implementation guidelines and you will build a robust and secure IP telephony network, it says.

Implementation weaknesses and not vulnerabilities are to blame for any exploits that SecureTest might demonstrate, Cisco argues.

It is yet to confirm the validity of SecureTest's attack scenarios. None would be possible if IP telephones and PCs are kept on separate VLANs (Virtual Lans), according to Paul King, a Cisco consultant.

"I don't buy that it's a massive new security revelation that VLANs need to be kept separate and secure. If you keep VLANs separate then it would be very difficult to listen in to calls or attack phones."

He would be "very surprised" if any Cisco resellers put in a IP Telephony system without following its guidelines.

Look deeper

Cisco VoIP phones are vulnerable to ARP spoofing, enabling man-in-the-middle attacks and including data interception and packet injection, according to SecureTest. Attacks could be carried out remotely once a Trojan had been placed onto the VoIP network, it says

Not so, Cisco replies. Even if a PC is compromised with a Trojan it would be unable to affect a VoIP system. Also security features in its IP Telephony products defend against SecureTest attack scenarios.

Cisco CallManager 3.3(3) introduces a new feature on the Cisco 79XX IP Phone family called "Gratuitous ARP: Enabled/Disabled". By setting this to disabled, the IP Phones will ignore Gratuitous ARP messages, thereby thwarting man-in-the-middle attacks.

However, it might still be possible for an attacker to fool the router into thinking that his machine is a phone and thereby listen into half a conversation (the stream from the router to the phone, but not from the phone to the router).

To resolve this, Cisco has introduced a feature called Dynamic ARP Inspection (DAI) on several of its Catalyst Ethernet switch products. This feature is capable of recognising and dropping spoofed packets at the switch, thereby thwarting attacks.

DoS attacks against VoIP networks can be thwarted by protection at the firewall and router level.

As the "icing on the cake", Cisco has added a number of security enhancements to the latest version of its soft PBX software, CallManager 4.0. Digital certificates confirm the identity of network devices to protect against entry of rogue system users and encryption has been introduced to CallManager 4.0 to ensure privacy. Cisco has also added its Cisco Security Agent (intrusion prevention) technology to Cisco CallManager 4.0.

We put these points to SecureTest's Wil Allsopp, who says the company stands by its original findings. The authentication/encryption features that come with CallManager 4.0 deliver significant security improvements, but the "switch based traffic segregation" that comes with CallManager 3.3(3) can be attacked, he says. ®

Related Stories

Cisco VoIP kit open to 'snooping attacks'
Cisco gets into video conferencing

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
Turnbull should spare us all airline-magazine-grade cloud hype
Box-hugger is not a dirty word, Minister. Box-huggers make the cloud WORK
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.