Light Reading

Five WiFi VOIP Security Issues

Dan Jones
LR Mobile News Analysis
Dan Jones, Mobile Editor
2/16/2006
50%
50%

As enterprise deployments of WiFi VOIP systems reach the staging point, security will be a key concern for enterprise users.

Shawn Merdinger, an independent security consultant based in Austin, Texas, has worked with Cisco Systems Inc. (Nasdaq: CSCO) and 3Com Corp. (Nasdaq: COMS)/Tipping Point. He's tested around a dozen WiFi VOIP handsets and deskphones and says that security problems range from potential denial-of-service attacks to more serious issues that allow "deep access" to the device that lets a remote attacker read sensitive information on the phone.

You can see his postings on many of the devices tested, along with some workarounds here. In the wake of Merdinger's findings, Cisco Systems Inc. (Nasdaq: CSCO), Hitachi Ltd. (NYSE: HIT; Paris: PHA), and UTStarcom Inc. (Nasdaq: UTSI) have issued firmware upgrades for the devices in question. (See WiFi VOIP: How Safe?.)

Such threats are inevitable. So it's up to vendors to forestall them, according to analyst Paul Stamp, of Forrester Research Inc. "It's security 101. If we see practices like this continue as these devices get more popular then the manufacturers will only have themselves to blame when there's a widespread attack," he notes.

Still there are steps users can take to protect themselves. Here's a Top 5 list of enterprise WiFi VOIP security issues, and some ways to guard against them:

Widespread deployment equals a security headache:
Because of the "ubiquity of deployment" in many enterprises, attacks can spread quickly and be targeted to take down multiple devices at once. IT managers should stay up to the minute with phone upgrades, and consider running phones over a separate physical or virtual LAN as a defense against these attacks.

Many points of attack:
As the phones get more sophisicated, so could the points of entry for malicious attacks increase. Bluetooth, email, client Web browsers, SMS, WiFi, media players, and image viewers could open back doors for hackers. Though users can use open-source and commercial tools to continually test their phones and networks, they'll ultimately have to rely on vendors to do proactive testing on these devices. "Some vendors may engage in this testing while the majority will not," warns Merdinger.

Targeting phones in public environments:
For example, a Bluetooth scanner could be hidden at the entrance to a major airport or train station and be used to grab user data. It may be best to keep Bluetooth and other wireless features swicthed off when not needed.

Rogue again:
Meanwhile, at the office and on the road, users and IT departments will have to keep their guard up and scan for rogue access points. Hackers will set up access points to specifically target WiFi phones in the corporate space as well as at hotels, conferences, and other places business people like to congregate. Good device authentication and encryption can help provide protection here.

Targeted attacks:
Targeted attacks on specific voice-over-wireless networks could also be an issue, albeit one that the victims may try to downplay. "There will be targeted attacks on VoIP networks [from hackers or competitors] that will be kept quiet if there is no legal requirement for disclosure or obvious public knowledge," Merdinger says.

Users, however, shouldn't get in a snit about VOIP calls that are often unencrypted and therefore easier to listen in on. Unless attackers are targeting a specific user, it is much simpler to find useful information sent by the user or held on the phone than to listen in on calls, even if you're the NSA.

"Most attackers are going to go after text information -- much easier to parse for the juicy information," says Merdinger.

— Dan Jones, Site Editor, Unstrung

(0)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
Flash Poll
From The Founder
Network architects aiming to upgrade their networks to support agile, open, virtualized services in the 21st century need to consider new criteria when choosing between technology suppliers.
Live Streaming Video
BTE 2015 Sponsor Keynote: HP
Dr. Prodip Sen, CTO, Network Functions Virtualization, HP
LRTV Documentaries
IoT in Action

6|30|15   |   1:39   |   (3) comments


Two co-workers discuss the benefits of IoT technology.
LRTV Interviews
Ericsson Opens Up on OPNFV

6|30|15   |   14:16   |   (0) comments


Martin Bäckström, VP and head of industry area Datacom at Ericsson, talks to Light Reading founder and CEO Steve Saunders about the emergence of OPNFV, the importance of standards and Ericsson's OPNFV plans.
LRTV Custom TV
NetNumber Founder Discusses NFV/SDN Impact on SP Networks

6|26|15   |   4:15   |   (0) comments


NetNumber Founder Doug Ranalli examines why SPs need a new network infrastructure for service agility. While NFV and SDN are the tools, the old ways of thinking about signaling control are inhibitors. Doug provides his recommendations.
LRTV Custom TV
Orchestrating NFV vCPE Services Across Multivendor Networks

6|26|15   |   5:46   |   (0) comments


Nirav Modi provides an overview of vCPE, the fastest-growing NFV use case, showing how Cyan's Blue Planet orchestrates vCPE services across a multivendor infrastructure to rapidly deliver new managed services for business customers.
LRTV Custom TV
ZTE at LTE Summit Amsterdam 2015

6|26|15   |     |   (0) comments


As one of the leading global telecommunications providers, ZTE presented its cutting-edge technology at LTE World Summit 2015 in Amsterdam. On display at ZTE's booth were the latest R&D achievements in wireless, 5G development, HetNet, deep convergence of FDD and TDD, and RCS/IMD/iSDN/vCN.
LRTV Documentaries
OPNFV Director Opens Up on Women in Tech

6|25|15   |   3:25   |   (0) comments


Heather Kirksey, the director of the OPNFV, gets real about the gender disparity in open source and standards and discusses how we can change both the conversation and the gender dynamics.
LRTV Custom TV
Symantec's Service Provider Security Strategy

6|24|15   |   7:06   |   (0) comments


Didi Dayton explores Symantec's emerging enterprise security strategies for service providers. Highlights include 'killing the password,' self-defense, advanced analytics and adaptive response in a service provider architecture.
Between the CEOs
Debating Network Evolution With Cisco's Cedrik Neike

6|23|15   |   12:54   |   (2) comments


Cedrik Neike, SVP of Global Service Provider, Service Delivery, at Cisco, talks to Light Reading founder and CEO Steve Saunders about solving service provider customer problems in a virtualized, DevOps world, including multivendor support and the future of network procurement.
LRTV Documentaries
Vodafone: What's Good for Moms Is Good for Business

6|23|15   |   3:04   |   (3) comments


Megan Doberneck, the general counsel for Vodafone Americas, discusses her company's progressive maternity policy, explains why promoting women in tech is good business and offers some some good advice for any women in the industry.
LRTV Interviews
NFV: Ready for Prime Time

6|23|15   |   05:09   |   (1) comment


At BTE 2015, Vip mobile CTO Dejan Kastelic talks about how NFV is ready for the real world and how Telekom Austria is introducing centralized resources for its group operations.
LRTV Documentaries
Tykes Talk Tech

6|22|15   |   02:30   |   (9) comments


What does optical fiber look like? When will 5G arrive? What's the WiFi password at Ikea? Light Reading sat down with three 8-year-olds to answer some of the communications industry's most burning questions...
LRTV Huawei Video Resource Center
Huawei Partners With TDC for World's First Early DOCSIS 3.1 Field Test

6|22|15   |   3:06   |   (0) comments


In a move to enhance user experience, Denmark's TDC aims to become an early adopter of DOCSIS 3.1. In partnership with Huawei, TDC recently ran the world's first field tests on its coax network that reached speeds nearing 1 Gbit/s.
Upcoming Live Events
September 16-17, 2015, The Westin Galleria Dallas, Dallas, TX
September 29-30, 2015, The Westin Grand Müchen, Munich, Germany
October 6, 2015, The Westin Peachtree Plaza, Atlanta, GA
October 6, 2015, Westin Peachtree Plaza, Atlanta, GA
October 14-15, 2015, New Orleans Ernest N. Morial Convention Center, New Orleans, LA
All Upcoming Live Events
Infographics
Hot Topics
Staying Productive With My Office-in-a-Bag
Mitch Wagner, West Coast Bureau Chief, Light Reading, 6/25/2015
WiFi Calling Catches on Globally
Sarah Thomas, Editorial Operations Director, 6/23/2015
Who's Feeding Fiber to LinkNYC Hotspots?
Mari Silbey, Senior Editor, Cable/Video, 6/29/2015
First Net Neutrality Complaint Hits TWC
Mari Silbey, Senior Editor, Cable/Video, 6/23/2015
Like Us on Facebook
Twitter Feed
Webinar Archive
BETWEEN THE CEOs - Executive Interviews
Casa Systems has been going from strength to strength over the last couple of years. In 2013, it became the first vendor to ship an integrated CCAP device -- the ...
Cedrik Neike, SVP of Global Service Provider, Service Delivery, at Cisco, talks to Light Reading founder and CEO Steve Saunders about solving service provider customer problems in a virtualized, DevOps world, including multivendor support and the future of network procurement.
Cats with Phones