Light Reading
Threats to listen for as you implement WiFi VOIP, and how to stop at least some of them

Five WiFi VOIP Security Issues

Dan Jones
LR Mobile News Analysis
Dan Jones, Mobile Editor
2/16/2006
50%
50%

As enterprise deployments of WiFi VOIP systems reach the staging point, security will be a key concern for enterprise users.

Shawn Merdinger, an independent security consultant based in Austin, Texas, has worked with Cisco Systems Inc. (Nasdaq: CSCO) and 3Com Corp. (Nasdaq: COMS)/Tipping Point. He's tested around a dozen WiFi VOIP handsets and deskphones and says that security problems range from potential denial-of-service attacks to more serious issues that allow "deep access" to the device that lets a remote attacker read sensitive information on the phone.

You can see his postings on many of the devices tested, along with some workarounds here. In the wake of Merdinger's findings, Cisco Systems Inc. (Nasdaq: CSCO), Hitachi Ltd. (NYSE: HIT; Paris: PHA), and UTStarcom Inc. (Nasdaq: UTSI) have issued firmware upgrades for the devices in question. (See WiFi VOIP: How Safe?.)

Such threats are inevitable. So it's up to vendors to forestall them, according to analyst Paul Stamp, of Forrester Research Inc. "It's security 101. If we see practices like this continue as these devices get more popular then the manufacturers will only have themselves to blame when there's a widespread attack," he notes.

Still there are steps users can take to protect themselves. Here's a Top 5 list of enterprise WiFi VOIP security issues, and some ways to guard against them:

Widespread deployment equals a security headache:
Because of the "ubiquity of deployment" in many enterprises, attacks can spread quickly and be targeted to take down multiple devices at once. IT managers should stay up to the minute with phone upgrades, and consider running phones over a separate physical or virtual LAN as a defense against these attacks.

Many points of attack:
As the phones get more sophisicated, so could the points of entry for malicious attacks increase. Bluetooth, email, client Web browsers, SMS, WiFi, media players, and image viewers could open back doors for hackers. Though users can use open-source and commercial tools to continually test their phones and networks, they'll ultimately have to rely on vendors to do proactive testing on these devices. "Some vendors may engage in this testing while the majority will not," warns Merdinger.

Targeting phones in public environments:
For example, a Bluetooth scanner could be hidden at the entrance to a major airport or train station and be used to grab user data. It may be best to keep Bluetooth and other wireless features swicthed off when not needed.

Rogue again:
Meanwhile, at the office and on the road, users and IT departments will have to keep their guard up and scan for rogue access points. Hackers will set up access points to specifically target WiFi phones in the corporate space as well as at hotels, conferences, and other places business people like to congregate. Good device authentication and encryption can help provide protection here.

Targeted attacks:
Targeted attacks on specific voice-over-wireless networks could also be an issue, albeit one that the victims may try to downplay. "There will be targeted attacks on VoIP networks [from hackers or competitors] that will be kept quiet if there is no legal requirement for disclosure or obvious public knowledge," Merdinger says.

Users, however, shouldn't get in a snit about VOIP calls that are often unencrypted and therefore easier to listen in on. Unless attackers are targeting a specific user, it is much simpler to find useful information sent by the user or held on the phone than to listen in on calls, even if you're the NSA.

"Most attackers are going to go after text information -- much easier to parse for the juicy information," says Merdinger.

— Dan Jones, Site Editor, Unstrung

(0)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View
Flash Poll
LRTV Huawei Video Resource Center
Sales Director of INIT on Plug & Play Switch Devices

9|19|14   |   3:21   |   (0) comments


INIT Italy uses both the Huawei S5700 and S7700 series switches for the campus LAN environment. Sales Director Andrea Curti says their company chose these Huawei devices over others because of their performance, flexible scalability and plug-and-play features.
LRTV Huawei Video Resource Center
Saudi Arabia Upgrades Vocational Training System

9|19|14   |   3:31   |   (0) comments


The Technical and Vocational Training Corporation (TVTC) has 100,000 students, 150 government-owned institutions and oversees 1000 private institutes. The CIO of TVTC explains that Huawei devices have allowed them to manage multiple datacenters using just one software program, scientifically tracking the progress of students and teachers, saving them millions.
LRTV Huawei Video Resource Center
Huawei's Media Solutions Are Here to Stay

9|19|14   |   4:35   |   (0) comments


The current media revolution requires rapid upgrades in technology. New formats (HD, 3D, 4K etc.) and the subsequent explosion of file sizes demand sophisticated network and storage architecture. Social media and the multiple distribution channels require a robust asset management system. Gartner analyst Venecia Liu speaks about the current technological trends in ...
LRTV Huawei Video Resource Center
Microgenesis on Huawei's Switches

9|19|14   |   3:57   |   (0) comments


Microgenesis is a solutions and system integrator company in the Philippines whose areas of expertise include data centers, networking and security products. In this video, Executive Director Jeffrey Choa talks to us about his customers needs and they benefit from using Huawei switches.
LRTV Huawei Video Resource Center
Network Solutions Help the Philippines Jump Ahead

9|17|14   |   2:59   |   (0) comments


In the past, the Philippines has under-invested in technology. Now, the CEO of Softshell talks about how Huawei products help the Philippines jump ahead as the economy improves.
LRTV Huawei Video Resource Center
VCS Observation for Safer Cities in the Netherlands

9|17|14   |   5:20   |   (0) comments


Holland's VCS Observation has been operating for 22 years. Its main goal is to get cities safer. CEO Wim van Deijzen tells us some of the challenges his company faces and how Huawei is helping to overcome these challenges.
LRTV Huawei Video Resource Center
A Conversation With Serbia's Ministry of Interior

9|17|14   |   4:38   |   (0) comments


At HCC 2014, the Assistant Minister of the Ministry of Interior of the Republic of Serbia talks to us about his projects and corporation with Huawei. Solutions like Safe City and E-Government and services like cloud computing are just some of the areas his department is interested in.
LRTV Huawei Video Resource Center
IHS Analyst Discusses eLTE at CCW 2014

9|10|14   |   7:09   |   (0) comments


Thomas Lynch, associate director of critical communications at IHS Technology, talks about broadband in critical communications.
LRTV Huawei Video Resource Center
TCAA on Huawei eLTE: A Broadband Solution for Mission-Critical Communications

9|10|14   |   2:29   |   (0) comments


At CCW2014 in Singapore, the TCCA's Phil Kidner talks about the importance of broadband data for critical communications.
LRTV Custom TV
Spotlight on Cisco: SDN for Optical Networks

9|8|14   |   9:27   |   (0) comments


Cisco's Greg Nehib talks OpenFlow and more on the 'Software-Defined Networking for Optical Networks' panel at the Big Telecom Event in June 2014.
LRTV Custom TV
Cisco's Evolved Programmable Network (EPN)

9|8|14   |   4:05   |   (0) comments


A look at the various demos Cisco showed at Light Reading's Big Telecom Event highlighting Cisco's EPN innovation and how SDN and NFV technologies are enabling a variety of new services.
LRTV Huawei Video Resource Center
The Future of Ultra-Broadband, With Kevin Kelly (UBBF2014)

9|5|14   |   1:13   |   (1) comment


If you think the technological changes we've seen up to now are astounding, just wait until you see what the future has in store. Discuss upcoming breakthroughs with Kevin Kelly, Founding Executive Editor of Wired Magazine, at the Huawei Ultra-Broadband Forum on September 24.
Upcoming Live Events
October 29, 2014, New York City
November 6, 2014, Santa Clara
November 11, 2014, Atlanta, GA
December 2, 2014, New York City
December 3, 2014, New York City
December 9-10, 2014, Reykjavik, Iceland
June 9-10, 2015, Chicago, IL
Infographics
A survey conducted by Vasona Networks suggests that 72% of mobile users expect good performance all the time, and they'll blame the network operator when it's not up to par.
Today's Cartoon
Vacation Special Caption Competition Click Here
Latest Comment
Hot Topics
Photos: Qualcomm Takes Over San Francisco
Sarah Reedy, Senior Editor, 9/19/2014
NFV & The Data Center: Top 10 Takeaways
Sarah Reedy, Senior Editor, 9/18/2014
New NFV Forum Focused on Interoperability
Carol Wilson, Editor-at-large, 9/16/2014
Pics: LR's Women in Telecom Breakfast
Sarah Reedy, Senior Editor, 9/16/2014
EMC Mulls Merger With HP or Dell – Reports
Mitch Wagner, West Coast Bureau Chief, Light Reading, 9/22/2014
Like Us on Facebook
Twitter Feed