Light Reading

Five WiFi VOIP Security Issues

Dan Jones
LR Mobile News Analysis
Dan Jones, Mobile Editor

As enterprise deployments of WiFi VOIP systems reach the staging point, security will be a key concern for enterprise users.

Shawn Merdinger, an independent security consultant based in Austin, Texas, has worked with Cisco Systems Inc. (Nasdaq: CSCO) and 3Com Corp. (Nasdaq: COMS)/Tipping Point. He's tested around a dozen WiFi VOIP handsets and deskphones and says that security problems range from potential denial-of-service attacks to more serious issues that allow "deep access" to the device that lets a remote attacker read sensitive information on the phone.

You can see his postings on many of the devices tested, along with some workarounds here. In the wake of Merdinger's findings, Cisco Systems Inc. (Nasdaq: CSCO), Hitachi Ltd. (NYSE: HIT; Paris: PHA), and UTStarcom Inc. (Nasdaq: UTSI) have issued firmware upgrades for the devices in question. (See WiFi VOIP: How Safe?.)

Such threats are inevitable. So it's up to vendors to forestall them, according to analyst Paul Stamp, of Forrester Research Inc. "It's security 101. If we see practices like this continue as these devices get more popular then the manufacturers will only have themselves to blame when there's a widespread attack," he notes.

Still there are steps users can take to protect themselves. Here's a Top 5 list of enterprise WiFi VOIP security issues, and some ways to guard against them:

Widespread deployment equals a security headache:
Because of the "ubiquity of deployment" in many enterprises, attacks can spread quickly and be targeted to take down multiple devices at once. IT managers should stay up to the minute with phone upgrades, and consider running phones over a separate physical or virtual LAN as a defense against these attacks.

Many points of attack:
As the phones get more sophisicated, so could the points of entry for malicious attacks increase. Bluetooth, email, client Web browsers, SMS, WiFi, media players, and image viewers could open back doors for hackers. Though users can use open-source and commercial tools to continually test their phones and networks, they'll ultimately have to rely on vendors to do proactive testing on these devices. "Some vendors may engage in this testing while the majority will not," warns Merdinger.

Targeting phones in public environments:
For example, a Bluetooth scanner could be hidden at the entrance to a major airport or train station and be used to grab user data. It may be best to keep Bluetooth and other wireless features swicthed off when not needed.

Rogue again:
Meanwhile, at the office and on the road, users and IT departments will have to keep their guard up and scan for rogue access points. Hackers will set up access points to specifically target WiFi phones in the corporate space as well as at hotels, conferences, and other places business people like to congregate. Good device authentication and encryption can help provide protection here.

Targeted attacks:
Targeted attacks on specific voice-over-wireless networks could also be an issue, albeit one that the victims may try to downplay. "There will be targeted attacks on VoIP networks [from hackers or competitors] that will be kept quiet if there is no legal requirement for disclosure or obvious public knowledge," Merdinger says.

Users, however, shouldn't get in a snit about VOIP calls that are often unencrypted and therefore easier to listen in on. Unless attackers are targeting a specific user, it is much simpler to find useful information sent by the user or held on the phone than to listen in on calls, even if you're the NSA.

"Most attackers are going to go after text information -- much easier to parse for the juicy information," says Merdinger.

— Dan Jones, Site Editor, Unstrung

(0)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Educational Resources
sponsor supplied content
Educational Resources Archive
From The Founder
Steve Saunders provides an overview of white box networking and introduces a new "slim line" version of the OSI 7-layer model.
Flash Poll
Live Streaming Video
CLOUD / MANAGED SERVICES: Prepping Ethernet for the Cloud
Moderator: Ray LeMaistre Panelists: Jeremy Bye, Leonard Sheahan
Wagner’s Ring
The Business Case for Open Source

11|30|15   |     |   (1) comment

Open source helps companies enhance infrastructure, undermine competitors' advantage and teach collaboration. But there are problems.
Between the CEOs
Centec on Ethernet Switching

11|26|15   |   09:58   |   (0) comments

Centec CEO James Sun talks to Steve Saunders about Ethernet switching and the white box revolution.
LRTV Custom TV
Delivering Service Agility in the Virtualization Era

11|25|15   |   5.41   |   (0) comments

Interview with Massimo Fatato, WW OSS Business Lead, Hewlett Packard Enterprise.
Wagner’s Ring
How Might Open Source Fail?

11|24|15   |     |   (10) comments

Open source, SDN, and NFV are looking inevitable – but performance, standards proliferation and regulatory capture could derail the movement.
LRTV Custom TV
NFV Lifecycle Orchestration – a Fresh Vision for Telco

11|23|15   |   6.40   |   (0) comments

Simon Osborne, CTO Comptel, and Heavy Reading's Caroline Chappell reveal the business impacts of new SDN and NFV, and what the term service orchestration actually means. Together they define Lifecycle Service Orchestration and how the virtualized future will look for telecoms operators.
Between the CEOs
Cisco's Virtual Role in Saudi

11|20|15   |   12:15   |   (2) comments

Light Reading founder and CEO Steve Saunders talks with Zayan Sadek, Regional Manager at Cisco Systems, about the competitive communications services market and advance of virtualization in Saudi Arabia.
LRTV Huawei Video Resource Center
Huawei Leads With Kubernetes for Cloud PaaS

11|19|15   |   08:26   |   (0) comments

Huawei is looking to Kubernetes as a key tool for building robust open source technologies for customers and partners, said Ying Xiong, chief architect of cloud platform at Huawei, in an interview with Light Reading West Coast Bureau Chief Mitch Wagner at the recent Kubecon conference.
Women in Comms Introduction Videos
WiC in London: The Highlight Reel

11|19|15   |   5:33   |   (1) comment

NetCracker's Mervat El Dabae headlines an inspiring morning in London with help from leading women from Vodafone, TalkTalk, Hyperoptics and Ciena.
LRTV Documentaries
Why Saudi's So Hot for New Tech

11|19|15   |   05:07   |   (0) comments

Light Reading's Steve Saunders reports from Saudi Arabia, a hyper-competitive market desperate to embrace the next generation of communications technologies and services.
LRTV Custom TV
Why Data Models Deliver More Value Than Information Models

11|19|15   |   5.08   |   (0) comments

Stefan Vallin argues that more automation is needed to manage end-to-end services and the hybrid networks they run on, and that data models are key to achieving this.
Telecom Innovators Video Showcase
SDN Management & Orchestration in the WAN

11|17|15   |   7.20   |   (0) comments

Carol Wilson and Packet Design CTO Cengiz Alaettinoglu discuss CSPs' SDN service delivery and assurance requirements. Learn about a modular approach to building automated control, orchestration and management functions for the WAN that are policy- and analytics-driven.
LRTV Custom TV
Flash Networks: Optimizing for Radio Spectral Efficiency

11|17|15   |   3:34   |   (0) comments

Today most optimization vendors only focus on optimizing voice or data. Ofer Gottfried, Flash Networks' CTO, shows how improving data throughput and maximizing spectral efficiency reduces capital and operating expenses while also providing a platform for user engagement.
Allot MobileTrends Report H2/2015 reveals how daily online behavior can be used to discover smarter ways to profile customers and propose valuable, real-time offers to them.
Hot Topics
Samsung: No Sale of Wireless Unit
Dan Jones, Mobile Editor, 11/25/2015
Hong Kong Moments
Ray Le Maistre, Editor-in-chief, 11/26/2015
How Might Open Source Fail?
Mitch Wagner, West Coast Bureau Chief, Light Reading, 11/24/2015
Facebook in Africa: Beauty or Beast?
Iain Morris, News Editor, 11/27/2015
Cable Gives Thanks for Business Services
Alan Breznick, Cable/Video Practice Leader, 11/27/2015
Like Us on Facebook
Twitter Feed
December 15, 2015
Virtualizing Cable Services
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
Centec CEO James Sun talks to Steve Saunders about Ethernet switching and the white box revolution.
Light Reading founder and CEO Steve Saunders talks with Zayan Sadek, Regional Manager at Cisco Systems, about the competitive communications services market and advance of virtualization in Saudi Arabia.
Cats with Phones
Can't Find the Phone on Thanksgiving? Click Here
Check under the cat! (hint: bottom right)
Live Digital Audio

Broadband speeds are ramping up across Europe as the continent, at its own pace, follows North America towards a gigabit society. But there are many steps to take on the road to gigabit broadband availability and a number of technology options that can meet the various requirements of Europe’s high-speed fixed broadband network operators. During this radio show we will look at some of the catalysts for broadband network investments and examine the menu of technology options on offer, including vectoring and for copper plant evolution and the various deployment possibilities for FTTH/B.