Did you know that they can spam VOIP just like they spam e-mails? Whoever “they” may be, the threat may very well be quite real and has actually been given a name. “Spit” stands for spam attacks against internet telephony connections. Alright, I do not know who coined this term and whether I think it is clever or just plain silly. Still, that is beside the point – it might exist and might pose a problem in the future.

According to the Heise Online News, the Internet Engineering Task Force is going to be working on this issue over the next 6 to 12 months. Yet is there really a threat? According to Jon Petersen, “there was no evidence at the present time that a “spit” problem existed. In his opinion it was still, at best, theoretical. A representative of the NEC Lab in Heidelberg, on the other hand, said that work on possible solutions to “spit” had already been going on there for three years. At present, he said, the “spit” figures were still small, but “spit” was expected to become a serious problem as internet telephony became more widespread.”

However, if spit does become a serious threat, some people are concerned about the consequences:

“The costs incurred if we do nothing are very high,” warns SIP developer Henning Schulzrinne of Columbia University . It had taken a long time before anyone reacted to the now-familiar email spam, he pointed out, and now the implementation of countermeasures was struggling along behind the problem. Schulzrinne is one of the authors of an internet draft that contains preliminary recommendations. “Do we really want to wait until we have a VoIP botnet problem?”, Schulzrinne asked.
As with email spam, the developers who are already working on possible defences have no magic recipe against “Spit”. Among the possible options mooted are solutions involving the identification and authentication of callers, statistical solutions – meaning the blocking of mass calls emanating from one account – or defence through the cost of making a contact (something that was considered for email, but was swiftly rejected).

I tend to lean towards the side of caution here. I would rather have people working on this as early as now and ready to face the threat when it does arise. How about you? What do you think about all this ruckus?

Everyone knows this – IP voice calls can be prone to eavesdroppers. Yup, even the virtual walls have ears. Whether you are using VOIP for business or for personal purposes, I am quite sure that you would rather have your conversations private, right? Though VOIP has tons of positive points on its side, it is a sad fact that it could be more prone to eavesdropping than wired telephones. How so? It is because of a simple thing – VOIP has no wired connection that would require an eavesdropper to tap into the wires, something that might not be that easy to do without being detected. With VOIP, however, all one needs to listen in on another person’s conversation is to intercept the data that is being transmitted over the network. With the proper tools, anyone can capture and analyze the data – in effect, listen to your conversations.

How do you ensure that no one is listening in on your voice calls? It is simple – by using some sort of encryption method. Encrypting your voice calls is a simple matter and will make it almost impossible for other people to snoop on your conversations.

One popular method of encrypting VOIP calls is Zfone. This software is developed by Phil Zimmerman and is free to download. It is perfect for VOIP users who do not have much know how, technologically speaking. All you need to do is to download the program, install it and you’re good to go. One drawback of the Zfone is that in order for your call to be secure, the party you are calling has to have it installed as well.

Another method of encryption is what is dubbed as built-in encryption. It is basically what VOIP clients do. Skype, for example, has built-in encryption – the user does not have to do anything in this regard.

For businesses, Transport Layer Security (TLS) and IP Security (IPSec) seem to be the best bet. These two methods are quite robust and prevent external unauthorized tampering. The level of security they offer makes them very attractive for business owners. To date, TLS seems to be gaining more ground in terms of popularity simply due to the fact that it is more efficient and does not take up as much bandwidth as IPSec does.

There are other ways of keeping your voice calls confidential. So what’s keeping you? Take that step and rest assured that no one is eavesdropping on you.

VOIP is definitely a cost effective way to manage communications, both for business and personal use alike. As with many other things in life, though, VOIP does have some downsides to it. Jim Higdon writes a very information article on the top security threats for VOIP this year. Here is his list – complete with explanations as to why they have predicted these items as part of the top VOIP security threats for 2008:

1. DoS (denial of service) Attacks on VoIP Networks: This has been a concern for the IEEE (Institute of Electrical and Electronics Engineers) since 2006, and VoIP watchers have been concerned about DoS attacks for the past year. DoS attacks can overwhelm your company’s phone lines, creating long-term busy signals, forced call disconnects and an exhausted work force.

2. VoIP Eavesdropping: In June 2007, it was learned that a hacker with a packet sniffer and VOMIT could tap directly into VoIP calls. Then it was learned that those vulnerabilities could also lead to DoS attacks. “Anyone on your network,” stated an article found at EnterpriseVoIPPlanet, “anyone on other networks that you contact — and all points in between, including service providers — all have the opportunity to do an awful lot of juicy snooping.” Not to mention, of course, that the FBI and other security agencies can do all the VoIP snooping that they want. How do you prevent unwanted listeners on your VoIP calls? Place all VoIP phones on separate, secured vLANs to protect against rogue devices, then protect that vLAN against the introduction of unauthorized devices. Once you’ve isolated your VoIP devices, limit their inbound and outbound traffic so that they can only communicate with their call manager, encrypt the calls that travel over public networks, and watch the news and get ready to react, according to SearchSecurity.com.

Let’s cut this short for now – I’ll post the other points in the next entry.

Recently, we wrote about PGP for VoIP, and how developers are integrating such security systems into Asterisk. But here’s one fundamental question: how secure is your VoIP system? are you aware of any vulnerabilities you might face through the course of your setup, use, and maintenance of your system?

Remember that your VoIP network is only as secure as the rest of your network. It’s not like plain old telephone systems, where people would need to physically access the circuit (whether from within your office, the interconnection to your local exchange carrier, or within the phone company itself). There are various risks involved, and these usually come in the form of fraud and theft (such as theft of information due to eavesdropping), and spam via VoIP. After all, valuable information is usually exchanged through voice communications (including financial information, medical advice, stock trading, and so forth), and these can be easily intercepted by third parties without adequate security.

Enterprise-oriented solutions are usually more secure than end-user solutions. This means that commercial-grade systems usually come built-in with encryption and risk-detection mechanisms. Still, it pays to double-check with your service or hardware provider just to be sure.

For instance, here are five fundamental things that IT managers should look out for.

• First is protecting the actual voice stream from eavesdropping.
• Second, is ensuring that the message gets from point A to point B without being modified en route.
• Third, you should make sure that Web interfaces and APIs that monitor traffic are secure and authenticated.
• Fourth, you should monitor the interconnection with the regular telephone lines (POTS), to make sure these are free of toll fraud.
• Fifth, you should secure the underlying TCP/IP network against attacks itself. One good way to be easily detect attacks on the VoIP network itself is to have separate LANs for voice and data. If your network is being attacked or is experiencing severely heavy loads (such as from DDOS attacks), then voice quality severely degrades.