Feeds

Cisco dismisses VoIP snooping concerns

Safe as houses, us

  • alert
  • submit to reddit

Security for virtualized datacentres

Cisco has hit back at allegations that some of its IP telephony equipment is vulnerable to communications interception or denial of service attacks.

Last month, penetration outfit SecureTest went public with test results which showed Cisco 7900 VoIP phones are susceptible to both DoS attacks and communications interception vulnerabilities. Cisco 1760 VoIP routers can be crashed with malicious traffic, SecureTest further alleged.

SecureTest said the results went beyond those covered in a posting to BugTraq last August which suggested that the issue could be resolved by upgrading to Cisco Call Manager Release 3.3(3). Call Manager is Cisco's call setup (soft PBX) software.

According to SecureTest, attackers could be able to tap any call on the network or crash the entire phone system of any organisation using vulnerable Cisco kit.

Cisco strongly disputes this: follows its implementation guidelines and you will build a robust and secure IP telephony network, it says.

Implementation weaknesses and not vulnerabilities are to blame for any exploits that SecureTest might demonstrate, Cisco argues.

It is yet to confirm the validity of SecureTest's attack scenarios. None would be possible if IP telephones and PCs are kept on separate VLANs (Virtual Lans), according to Paul King, a Cisco consultant.

"I don't buy that it's a massive new security revelation that VLANs need to be kept separate and secure. If you keep VLANs separate then it would be very difficult to listen in to calls or attack phones."

He would be "very surprised" if any Cisco resellers put in a IP Telephony system without following its guidelines.

Look deeper

Cisco VoIP phones are vulnerable to ARP spoofing, enabling man-in-the-middle attacks and including data interception and packet injection, according to SecureTest. Attacks could be carried out remotely once a Trojan had been placed onto the VoIP network, it says

Not so, Cisco replies. Even if a PC is compromised with a Trojan it would be unable to affect a VoIP system. Also security features in its IP Telephony products defend against SecureTest attack scenarios.

Cisco CallManager 3.3(3) introduces a new feature on the Cisco 79XX IP Phone family called "Gratuitous ARP: Enabled/Disabled". By setting this to disabled, the IP Phones will ignore Gratuitous ARP messages, thereby thwarting man-in-the-middle attacks.

However, it might still be possible for an attacker to fool the router into thinking that his machine is a phone and thereby listen into half a conversation (the stream from the router to the phone, but not from the phone to the router).

To resolve this, Cisco has introduced a feature called Dynamic ARP Inspection (DAI) on several of its Catalyst Ethernet switch products. This feature is capable of recognising and dropping spoofed packets at the switch, thereby thwarting attacks.

DoS attacks against VoIP networks can be thwarted by protection at the firewall and router level.

As the "icing on the cake", Cisco has added a number of security enhancements to the latest version of its soft PBX software, CallManager 4.0. Digital certificates confirm the identity of network devices to protect against entry of rogue system users and encryption has been introduced to CallManager 4.0 to ensure privacy. Cisco has also added its Cisco Security Agent (intrusion prevention) technology to Cisco CallManager 4.0.

We put these points to SecureTest's Wil Allsopp, who says the company stands by its original findings. The authentication/encryption features that come with CallManager 4.0 deliver significant security improvements, but the "switch based traffic segregation" that comes with CallManager 3.3(3) can be attacked, he says. ®

Related Stories

Cisco VoIP kit open to 'snooping attacks'
Cisco gets into video conferencing

Security for virtualized datacentres

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Cray-cray Met Office spaffs £97m on VERY AVERAGE HPC box
Only 250th most powerful in the world? Bring back Michael Fish
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.