This whitepaper examines the issues and complexities of deploying a secure VoIP network, then details SonicWALL’s total VoIP solution.
 

 

Abstract

Companies implementing Voice over IP (VoIP) technologies in an effort to cut communications costs should not overlook the security risks associated with a converged voice and data network. Tempted by the benefits of lower phone bills, centralized management and rapid deployment, the critical areas of VoIP security and network integrity are often neglected.

There are numerous threat targets to consider in a VoIP network—the call servers and their operating systems, the phones and their software, and even the phone calls themselves are vulnerable.

This whitepaper examines the issues and complexities of deploying a secure VoIP network, and then details SonicWALL’s  total  VoIP  solution,  featuring  SonicWALL’s  innovative  stateful  packet  transformation technology.

 Issues with VoIP and Network Security

The traditional role of the firewall* in a VoIP network is undergoing a radical evolution.   In the past, the primary role of the firewall was simply to behave well in the VoIP environment.   Where VoIP relies on predictable, static availability of IP-based resources across the Internet, the firewall’s network address translation (NAT) functionality inherently breaks the VoIP network.    Through ‘pin-holing’ and other techniques, security vendors have found ways to largely interoperate with VoIP infrastructures.

As network-based threats have become more sophisticated, however, the role of the firewall has evolved from ‘behaving nicely’ in a VoIP environment to fully enabling and protecting the complete infrastructure. From end-user devices such as IP-based phones, soft-phones and wireless communications devices, to infrastructure equipment such as H.323 Gatekeepers and SIP Proxy Servers, there is a tremendous amount of exposure in an organization-wide VoIP deployment.  From simple denial of service (DoS) attacks aimed at limiting availability to the IP-based voice infrastructure, to full-blown application-layer attacks targeting the VoIP protocols themselves, the threats are very real…and growing.

For any successful VoIP implementation, three key factors must be considered:

VoIP security

VoIP network interoperability and protocol support
VoIP vendor interoperability

 The following describe these areas.  

*For this paper, we use the word “firewall” to describe any security device that provides a perimeter security function for VoIP.   In reality, modern security devices have transcended the stateful inspection firewall, and now feature deep packet inspection technologies that significantly enhance their capabilities.

 

VoIP security

VoIP security encompasses many areas, but the major factors that must be considered in any deployment are Access, Availability and Implementation.

Access

VoIP calls are vulnerable to threats such as session hijacking and ‘man-in-the-middle’ attacks.   Without proper safeguards, an attacker could intercept a VoIP call and modify the call parameters/addresses.   This would open the call up for spoofing, identity theft, call redirection and other attacks.

Even without modifying VoIP packets, attackers may be able to eavesdrop on telephone conversations being carried over a VoIP network.  If VoIP packets are traveling unprotected over the Internet, they provide attackers the opportunity to access the information they carry.

With a standard public switched telephone network (PSTN) connection, intercepting conversations requires physical access to telephone lines or access to the private branch exchange (PBX). Voice/data networks, which typically use the public Internet and the TCP/IP protocol stack, do not provide the same ‘physical wire’ security as telephone lines.   By gaining access and monitoring network traffic at certain parts on a network infrastructure (such as to/from a VoIP gateway), an attacker could capture and reassemble VoIP packets. Publicly available tools such as Vomit (http://vomit.xtdnet.nl/) can be used to convert these packets into a .wav  file,   allowing   an   attacker   to   eavesdrop,   or   even   record   and   replay   conversations.  

Availability

The availability of a VoIP network is also a major concern.   PSTN availability has reached 99.999%— attackers would need physical access to telephone exchanges or cut phone lines to create any impact. However, a simple DoS attack aimed at key points of an unprotected VoIP network would disrupt, or worse cripple, voice and data communications.

VoIP networks are especially susceptible to DoS attacks such as:

Malformed request DoS

Carefully crafted protocol requests can be used to exploit a known vulnerability resulting in a partial or complete loss of service.  These may be used not only to crash the target but also to gain control over it.

 DoS on media

VoIP media is carried within Real-Time Protocol (RTP) packets, and is vulnerable to any attack that
congests the network or slows the ability of an end device (phone or gateway) to process the packets in
real time.

An attacker who has access to the portion of the network where media is present simply needs to inject large numbers of media packets or high Quality of Service (QoS) packets, which will contend with the legitimate media packets.

..........this publication continues

Click Here to Access the Full Document