Cisco dismisses VoIP snooping concerns

Safe as houses, us


Cisco has hit back at allegations that some of its IP telephony equipment is vulnerable to communications interception or denial of service attacks.

Last month, penetration outfit SecureTest went public with test results which showed Cisco 7900 VoIP phones are susceptible to both DoS attacks and communications interception vulnerabilities. Cisco 1760 VoIP routers can be crashed with malicious traffic, SecureTest further alleged.

SecureTest said the results went beyond those covered in a posting to BugTraq last August which suggested that the issue could be resolved by upgrading to Cisco Call Manager Release 3.3(3). Call Manager is Cisco's call setup (soft PBX) software.

According to SecureTest, attackers could be able to tap any call on the network or crash the entire phone system of any organisation using vulnerable Cisco kit.

Cisco strongly disputes this: follows its implementation guidelines and you will build a robust and secure IP telephony network, it says.

Implementation weaknesses and not vulnerabilities are to blame for any exploits that SecureTest might demonstrate, Cisco argues.

It is yet to confirm the validity of SecureTest's attack scenarios. None would be possible if IP telephones and PCs are kept on separate VLANs (Virtual Lans), according to Paul King, a Cisco consultant.

"I don't buy that it's a massive new security revelation that VLANs need to be kept separate and secure. If you keep VLANs separate then it would be very difficult to listen in to calls or attack phones."

He would be "very surprised" if any Cisco resellers put in a IP Telephony system without following its guidelines.

Look deeper

Cisco VoIP phones are vulnerable to ARP spoofing, enabling man-in-the-middle attacks and including data interception and packet injection, according to SecureTest. Attacks could be carried out remotely once a Trojan had been placed onto the VoIP network, it says

Not so, Cisco replies. Even if a PC is compromised with a Trojan it would be unable to affect a VoIP system. Also security features in its IP Telephony products defend against SecureTest attack scenarios.

Cisco CallManager 3.3(3) introduces a new feature on the Cisco 79XX IP Phone family called "Gratuitous ARP: Enabled/Disabled". By setting this to disabled, the IP Phones will ignore Gratuitous ARP messages, thereby thwarting man-in-the-middle attacks.

However, it might still be possible for an attacker to fool the router into thinking that his machine is a phone and thereby listen into half a conversation (the stream from the router to the phone, but not from the phone to the router).

To resolve this, Cisco has introduced a feature called Dynamic ARP Inspection (DAI) on several of its Catalyst Ethernet switch products. This feature is capable of recognising and dropping spoofed packets at the switch, thereby thwarting attacks.

DoS attacks against VoIP networks can be thwarted by protection at the firewall and router level.

As the "icing on the cake", Cisco has added a number of security enhancements to the latest version of its soft PBX software, CallManager 4.0. Digital certificates confirm the identity of network devices to protect against entry of rogue system users and encryption has been introduced to CallManager 4.0 to ensure privacy. Cisco has also added its Cisco Security Agent (intrusion prevention) technology to Cisco CallManager 4.0.

We put these points to SecureTest's Wil Allsopp, who says the company stands by its original findings. The authentication/encryption features that come with CallManager 4.0 deliver significant security improvements, but the "switch based traffic segregation" that comes with CallManager 3.3(3) can be attacked, he says. ®

Related Stories

Cisco VoIP kit open to 'snooping attacks'
Cisco gets into video conferencing


Other stories you might like

  • Prisons transcribe private phone calls with inmates using speech-to-text AI

    Plus: A drug designed by machine learning algorithms to treat liver disease reaches human clinical trials and more

    In brief Prisons around the US are installing AI speech-to-text models to automatically transcribe conversations with inmates during their phone calls.

    A series of contracts and emails from eight different states revealed how Verus, an AI application developed by LEO Technologies and based on a speech-to-text system offered by Amazon, was used to eavesdrop on prisoners’ phone calls.

    In a sales pitch, LEO’s CEO James Sexton told officials working for a jail in Cook County, Illinois, that one of its customers in Calhoun County, Alabama, uses the software to protect prisons from getting sued, according to an investigation by the Thomson Reuters Foundation.

    Continue reading
  • Battlefield 2042: Please don't be the death knell of the franchise, please don't be the death knell of the franchise

    Another terrible launch, but DICE is already working on improvements

    The RPG Greetings, traveller, and welcome back to The Register Plays Games, our monthly gaming column. Since the last edition on New World, we hit level cap and the "endgame". Around this time, item duping exploits became rife and every attempt Amazon Games made to fix it just broke something else. The post-level 60 "watermark" system for gear drops is also infuriating and tedious, but not something we were able to address in the column. So bear these things in mind if you were ever tempted. On that note, it's time to look at another newly released shit show – Battlefield 2042.

    I wanted to love Battlefield 2042, I really did. After the bum note of the first-person shooter (FPS) franchise's return to Second World War theatres with Battlefield V (2018), I stupidly assumed the next entry from EA-owned Swedish developer DICE would be a return to form. I was wrong.

    The multiplayer military FPS market is dominated by two forces: Activision's Call of Duty (COD) series and EA's Battlefield. Fans of each franchise are loyal to the point of zealotry with little crossover between player bases. Here's where I stand: COD jumped the shark with Modern Warfare 2 in 2009. It's flip-flopped from WW2 to present-day combat and back again, tried sci-fi, and even the Battle Royale trend with the free-to-play Call of Duty: Warzone (2020), which has been thoroughly ruined by hackers and developer inaction.

    Continue reading
  • American diplomats' iPhones reportedly compromised by NSO Group intrusion software

    Reuters claims nine State Department employees outside the US had their devices hacked

    The Apple iPhones of at least nine US State Department officials were compromised by an unidentified entity using NSO Group's Pegasus spyware, according to a report published Friday by Reuters.

    NSO Group in an email to The Register said it has blocked an unnamed customers' access to its system upon receiving an inquiry about the incident but has yet to confirm whether its software was involved.

    "Once the inquiry was received, and before any investigation under our compliance policy, we have decided to immediately terminate relevant customers’ access to the system, due to the severity of the allegations," an NSO spokesperson told The Register in an email. "To this point, we haven’t received any information nor the phone numbers, nor any indication that NSO’s tools were used in this case."

    Continue reading

Biting the hand that feeds IT © 1998–2021