JohoSandy.com

It is often said that understanding the problem is 90% of the solution, and VoIP security is no exception. It is the fear of the unknown, which is likely to cause a knee-jerk reaction of panic, so that the first step is to understand the threats and classify them. We must also ask ourselves: what does security mean for me and what does it mean to my customers, sip voip monitoring to protect the client device and the identity and continuity of their service. provider of security services, the means to protect the revenue of the network and their customers. In this feature, see the disorder and theft of services.

A service can be disrupted by the breaking device of the user, to flood the network with IP traffic or failure of the service infrastructure. Adjournment is usually achieved by attacks or attacks Logic either floods or the application layer attacks.

Logic IP attacks on SIP devices are no different from any other IP device, these exploits are well known, such as: Ping of Death, teardrop, land, Chargen input and output packet stream. All these elements can disable a device that has not been fully tested to protect against these exploits.

IP flooding attacks: SYN flood attack (TCP SYN Floods are one of the oldest DoS attacks exist), Smurf Attack, Fraggle attack, and the list goes on … These attacks are designed to remove both the device by tying resources, or simply overwhelm the network by cutting the weight of traffic.

SIP logic attacks exploit vulnerabilities in implementations of SIP signaling. fields are incomplete or incorrect, invalid message types disable devices not only customers but key network devices. This type of attack can be countered by a thorough test of all units cons such suites on IETF SIP Torture test developed through events or SIPiT Protos test suite, developed by the University of Oulu.

A more sophisticated attack may be to inject messages into a call to end soon. This type of attack can be avoided by using strong authentication techniques, therefore, the injection of packets are not authenticated and, therefore, be rejected.

SIP Flood attacks exploit weaknesses before the communication stack that require more processing resources. Consequently, it takes a flood to cause much less disturbance. For example, one or more devices can send multiple registrations or call requests to a server.

Addressing this type of disturbance require that devices based on the network such as Session Border Controllers (SBC) in the signal flow of the police and of limited enrollment and appeals to softswitches to predetermined limits. Acting as a proxy in the signaling flow SBC can also filter inappropriate protocols, IP DoS attacks and valid SIP messages. It breaks the network and minimize any disruption to a single network segment.

These units will generally not be able to speed limiter and can be inundated by attacks against flooding. This means they are subject to both logical attacks and floods. Again, the user device will receive the protection of network-based DoS attacks SBC block and valid SIP messages.

A simple example of theft of service is a sign that the call is made, but changing the video data. This service is provided on two fronts:) loss of income of billing only the calls and b) the possible deterioration of quality of service for other users to cause discontent.

The structure of a VoIP call with the media and signaling streams separate led to some innovative tricks. For example, a client PC thugs, carrying RTCP media power management quality, are not implemented in most networks. Another trick is to transport media in the call waiting would not call before billing begins. Not only is this a free call, but repeated calls that can cause serious signal rate is a DoS attack in itself.

The solution is to police all the components of the call. Police SBC signaling and media to ensure that the call is made as desired and the RTCP traffic within normal limits.