At O'Reilly's 2007 Emerging Telephony conference in March 2007 in San Francisco, Dan York, Jonathan Zar and Shawn Merdinger presented a 90-minute workshop in which they discussed the threats to VoIP security, the tools out there to test/defend your network and the best practices for securing VoIP systems. A podcast audio recording of the workshop is available at http://www.blueboxpodcast.com/2007/03/blue_box_se_16_.html

1. The Black Bag Security Briefing Dan York, Jonathan Zar, Shawn Merdinger

6. Agenda The Challenge of VoIP Security Understanding VoIP Security Threats VoIP Security Best Practices Tools, Contacts, Help Summary VoIP Security Tools VoIP Security Best Practices Resources Questions / Answers

7. The Challenge of VoIP Security

8. The Implications are Clear Privacy Compliance Cost Avoidance Availability Business Continuity Confidence Mobility

9. The Noise is Deafening

10. The Problem is Complex Databases Directories E-mail Systems Web Servers Operating Systems Firewalls Desktop PCs Voice over IP Network Switches Wireless Devices PDAs PSTN Gateways Instant Messaging Standards Internet

12. Technology Underneath Mobile and Wireless Source: Pingalo

13. Into The Core Network Source: 3G Americas, Pingalo

19. What is the Industry Doing to Help? Security Vendors “ The Sky Is Falling!” (Buy our products!) VoIP Vendors “ Don’t Worry, Trust Us!” (Buy our products!)

21. VoIP Security & Privacy

22. Security concerns in telephony are not new… Image courtesy of the Computer History Museum

23. Nor are our attempts to protect against threats… Image courtesy of Mike Sandman – http://www.sandman.com/

24. 12 Years of Automated Attacks

26. Security Aspects of IP Telephony Media / Voice PSTN Call Control TCP/IP Network Manage ment Policy

33. VoIP Security Tools

35. VoIP Sniffing Tools pcapsipdump Oreka NetDude

36. VoIP Endpoint Scanning/Enumeration Tools SIP Forum Test Framework (SFTF) SIP-Scan SIPScan enumIAX

37. VoIP DoS/Flooding Tools kphone-ddos INVITE Flooder IAX Flooder RTP Flooder BYE Teardown SIP-Kill SIP-Proxy-Kill CheckSync Phone Rebooter

38. VoIP Fuzzing/Protocol Manipulation Tools BYE Teardown ohrwurm RedirectPoison Registration Hijacker Registration Eraser

39. Other... Um... “interesting” tools Spitter RTP InsertSound SIP-Send-Fun RTP MixSound and........

40. Best Practices to Secure VoIP Systems

41. First objective is to employ best practices and plug the obvious holes…

50. Resources

52. Q&A www.voipsa.org