Blue Box: The VoIP Security Podcast: VoIP Security

July 15, 2010

Dan's new book: Seven Deadliest Unified Communications Attacks

For those of you listening to Blue Box, you may be interested to know that I (Dan) recently wrote a book for Syngress called the "Seven Deadliest Unified Communications Attacks". In the book, I discuss the common theme that Jonathan and I have talked about on the show of needing to look at communications security at a higher-level, more "holistic" level. It's not enough just to think about the security of your IP-PBX... you also have to think about the security of your mail servers, your firewalls, your databases, etc.

You also have to think beyond voice to also including instant messaging/IM, video, presence, mobile devices and more. And... you have to think about them in the context of a globally-distributed IP infrastructure.

Information about the book and links to resources mentioned in the book are available from the books website:

www.7ducattacks.com

I have also posted links there to two podcast interviews I've done related to the book:

I am working on getting permission to run those both as Blue Box Special Editions (I have approval on the VUC session).

In many ways, much of the book came out of the three years of great conversations that Jonathan and I had with so many of you - and I have to thank all of you who have participated in the Blue Box community over the years for your questions, your comments and all the feedback. I hope you will find that this book continues that dialogue and discussion about how to secure our communications networks.

If you found this post interesting or useful, please consider either subscribing to the RSS feed or following BlueBox on Twitter.

Posted by Dan York on July 15, 2010 at 11:49 AM in Books, VoIP Security | Permalink | Comments (0) | TrackBack (0)

October 22, 2009

Blue Box #86: An Update on Blue Box, One Year Later

Synopsis: Blue Box #86: Dan and Jonathan provide an update on what's happened in the year since Blue Box #85 and talk a bit about what's next

Welcome to Blue Box: The VoIP Security Podcast #86, a 19-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 9 MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
Dan and Jonathan discuss what has happened in the past year and why there have not been new shows.
Discussion of what some of the main issues in VoIP security have been over the past year.
Mention that fugitive Edwin Pena was extradited back to the US and arraigned in New Jersey court last Friday
Mention of the recent traffic on the VOIPSEC public mailing list
Wrap-up of the show
19:38 - End of show

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to [email protected]. Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows. You may also call the listener comment line at either +1-415-830-5439 or via SIP to '[email protected]' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

If you found this post interesting or useful, please consider either subscribing to the RSS feed or following BlueBox on Twitter.

Posted by Dan York on October 22, 2009 at 12:47 PM in Blue Box, Podcasts, VoIP Security | Permalink | Comments (0) | TrackBack (0)

October 23, 2008

Blue Box #85: Internet phone calls and terrorism, Georgia Tech report on Emerging Cyber Security Threats, phone jamming, 802.1X-REV, 802.1AE, VoIP security news and more

Synopsis: Blue Box #85: Internet phone calls and terrorism, Georgia Tech report on Emerging Cyber Security Threats, phone jamming, 802.1X-REV, 802.1AE, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #85, a 32-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 15 MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
Programming notes:
- Three-year anniversary of Blue Box coming up on October 24th - any thoughts you'd like to share with us? (Please send them to us by October 23rd.)
The Times: "Internet phone calls are crippling fight against terrorism" - and my response on the Voice of VOIPSA blog
FierceVoIP: "UK crimefighting concern over VoIP calls, social networks"
BBC: Data powers behind the times
GA Tech Survey (PDF) (link about the GA conference )
Dark Reading: Cellphone Botnets, Blackmailing VOIP & a Healthy Cybercrime Economy
bMighty.com: Georgia Tech Security Report Scarier Than Its Football Team
cNet: Botnets on cell phones in 2009?
telecoms.com: Smartphone is a hotbed of security issues
VNUnet: Security industry falling behind hackers
AP: Phone Jamming in NH
GigaOm: EEF Challenges Telco Immunity in Court
Information Week: New Protocols Secure Layer 2
Voice of VOIPSA: Asking The Cisco Systems IPICS and JPS Raytheon ACU-2000 Experts: Questions 36-40
Other Voice of VOIPSA articles
snom technology AG: snom 820 combines mature VoIP technology with exclusive design
IDC Finds Increasing Hype Around Unified Communications Is Affecting How Customers Select Telephony Systems and Services (interesting movement in the top vendors used - Nortel out and IBM in)
Peerless VoIP Peering
Comment (IM) from Christian Wieser
Review of the last week's traffic on the VOIPSEC public mailing list
Wrap-up of the show
32:10 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on October 23, 2008 at 03:42 PM in Blue Box, Podcasts, VoIP Security | Permalink | Comments (0) | TrackBack (0)

Tags: 802.1x, blue box, bluebox, dan york, danyork, georgia tech, jonathan zar, phone jamming, sip, skype, terrorism, uk, voice, voice over ip, voice security, voip, voip security, voipsa, voipsecurity

October 20, 2008

Blue Box's 3-year anniversary coming up on Friday...

It was three years ago Friday, on October 24, 2005, that I uploaded Blue Box Podcast #1, an 11-minute show where I introduced the show, talked about VoIP security news (To no surprise, I was talking about Skype security!), some projects of VOIPSA and some other podcasts people might find interesting. A week later, on Halloween 2005, Jonathan joined me in Blue Box Podcast #2 and we were off and running...

Three years later... 84 main Blue Box episodes (with one more recorded) .... 26 Special Editions (with about 10 in the queue)... almost 250,000 downloads... we're still here and, with an admitted bit of a rough patch this summer, are still going along creating shows and enjoying what we do.

Jonathan and I are planning to record a 3-year show on this coming Friday, October 24th, and if you have any comments you would like us to include in that show, please do get them to us by the end of the day on Thursday, October 23rd. You can send them to us via:

Email to [email protected]
Phone to +1-415-830-5439
Phone via SIP to sip:[email protected]

The show started out 3 years ago as really an experiment in seeing whether or not podcasting could be used to reach out to very specific audiences... and it's been both fun, amazing and interesting to see how well it's done.

Thank you to all of you who have continued to listen and contribute over the years!

Technorati Tags: blue box, bluebox, voip, voip security, security, dan york, jonathan zar, voipsa

Posted by Dan York on October 20, 2008 at 08:22 PM in Blue Box, VoIP Security | Permalink | Comments (0) | TrackBack (0)

Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Synopsis: Blue Box #84: New Cisco, Avaya, Nortel VoIP security vulnerabilities from VoIPShield, Skype in China, UCSniff and other new tools, news and more

Welcome to Blue Box: The VoIP Security Podcast #84, a 30-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
Programming notes:
- Three-year anniversary of Blue Box coming up on October 24th - any thoughts you'd like to share with us? (Please send them to us by October 23rd.)
VoIPShield announces new vulnerabilities and http://www.voipshield.com/research.php
http://www.theregister.co.uk/2008/09/30/voip_eavesdropping_tool/
"Sipera Develops VoIP Spy Program - to Prove a Point" - http://www.voipplanet.com/trends/article.php/3776136
SecureLogix Announces Free Availability of VoIP Security Tools
NY Times: Surveillance of Skype Messages Found in China - http://www.nytimes.com/2008/10/02/technology/internet/02skype.html?_r=2&partner=rssnyt&pagewanted=print
http://securitywatch.eweek.com/privacy/skypechina_breach_is_anyone_really_surprised.html
http://www.informationweek.com/news/telecom/voip/showArticle.jhtml?articleID=210605439
Skype CEO's blog post about the issue: http://share.skype.com/sites/en/2008/10/answers_to_some_commonly_asked.html
http://www.itbusinessedge.com/blogs/top/?p=398
http://www.voip-news.com/feature/google-phone-europe-growth-092408/
http://www.itnewsafrica.com/?p=1269
http://news.cnet.com/8301-1009_3-10052393-83.html
http://www.broadbandreports.com/shownews/VoIP-Vulnerabilities-Being-Exposed-Today-98039
http://www.itbusinessedge.com/blogs/top/?p=402
http://voipsa.org/blog/2008/10/07/5th-emergency-services-workshop-to-be-held-oct-21-23-in-vienna/
http://eon.businesswire.com/news/eon/20080924005342/en
http://www.crn.com/security/210602442
http://it.tmcnet.com/topics/it/articles/41236-infoblox-unveils-dns-firewall-address-dns-vulnerability-concerns.htm
http://www.newswire.ca/en/releases/archive/September2008/29/c9005.html
No comments this week.
Review of the last week's traffic on the VOIPSEC public mailing list
Wrap-up of the show
30:26 - End of show

NOTE: Long-time listeners will note that the show notes above are in a less descriptive form than usual. After almost three years of using one wiki for preparing for our shows, Jonathan and I switched to using a new system and are still working out some of the details that will speed the input into show notes.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on October 20, 2008 at 09:32 AM in Blue Box, Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (1)

Tags: avaya, blue box, bluebox, china, cisco, dan york, danyork, jonathan zar, nortel, securelogix, sipera, sipera systems, skype, skype security, tools, voice, voice over ip, voice security, voip, voip security, voipsa, voipsecurity, voipshield

October 16, 2008

Blue Box #83: SIP and Asterisk vulnerabilities, voice biometrics, P2PSIP, Aircell blocking Skype, VoIP security news and more…

Synopsis: Blue Box #83: SIP and Asterisk vulnerabilities, voice biometrics, P2PSIP, Aircell blocking Skype, VoIP security news and more…

Welcome to Blue Box: The VoIP Security Podcast #83, a 39-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 18MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was recorded on September 4, 2008.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
Programming notes:
- Three-year anniversary of Blue Box coming up on October 24th - any thoughts you'd like to share with us? (Please send them to us by October 23rd.)
Remote DoS in reSIProcate
Remote root shell in Trixbox
Second route of VoIPShield Cisco/Avaya/Nortel vulnerabilities
AST-2008-010 – IAX2 ‘POKE’ Resource Exhaustion
AST-2008-011 – IAX2 Firmware Provisioning System
Saunderslog: Squawk Box – July 10, 2008: Voice biometrics and VoiceVerified.com
Saunderslog: Squawk Box – July 9, 2008: P2PSIP
IETF: P2PSIP Security Requirements
Voice of VOIPSA: “Aircell blocking VoIP on a plane” – part 1 , part 2 and an update
Voice of VOIPSA: Shawn Merdinger’s series on “Asking The Cisco IPICS Expert” – Questions 1-5 – 6-10 – 11-15 – 16-20 – 21-25
Voice of VOIPSA: Asterisk ‘hack’ to show blocked Caller-ID points to larger trust issues with SIP (and SpeechTEK speech)
NetworkWorld: Georgia student arrested for hacking grades, VoIP
CRN: Analysis: Hacking VoIP as easy as 1-2-3
Ari Takanen starts blogging at InfoWorld
InfoWorld: Motivation for VoIP Fuzzing
TMCnet: How to keep your tech career afloat
New analyst report: Security Threats Loom Over Unified Communications pointing to Light Reading report and article
VoIP Companies to Fight For Market Share
IEEE approves 802.11r standard
Google Chrome – upgrading the web to be application-centric
Items on my DisruptiveTelephony blog… Skype 5th birthday, Asterisk future, Digium/Nortel
No comments this week.
Review of the last week's traffic on the VOIPSEC public mailing list
Wrap-up of the show
39:08 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on October 16, 2008 at 11:10 AM in Blue Box, Podcasts, VoIP Security | Permalink | Comments (0) | TrackBack (2)

Tags: aircell, asterisk, avaya, blue box, bluebox, cisco, dan york, danyork, jonathan zar, nortel, p2psip, security, sip, skype, squawkbox, trixbox, voice, voip, voip security, voipsa, voipsecurity

September 03, 2008

Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk

Synopsis: Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about "Hacking and Attacking VoIP Systems: What You Need To Worry About" My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk. Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (Astricon, for those who don't know, is an annual developer conference for those who work with the Asterisk open source telephony platform. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know

View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him! Kudos to Michael for getting it to sound as good as it does.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on September 03, 2008 at 07:54 PM in Conferences, Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: asterisk, asterisk security, astricon, astricon2007, blue box, bluebox, dan york, danyork, open source, security, voip, voip security, voipsa

August 26, 2008

Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more

Synopsis: Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #81, a 42-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 19MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on May 21, 2008.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
Programming notes:
- Note about the hiatus
Voice of VOIPSA: Are your Skype username and password completely exposed if you use iSkoot?
Voice of VOIPSA: Chronology
Voice of VOIPSA: iSkoot disclosure of Skype credentials resolved – new version by Wednesday
Ofcom confirms VoIP providers must provide access to 999 and 112 – and Hannes Tschofenig points to 4th Emergency Services Coordination Workshop and presentation about the UK
MarketingVOX: British Proposal May Force ISPs to Fork Over Online Activity, Emails, VOIP Calls pointing to Reuters article: Britain mulls plan to store all email and calls

Enterprise VoIP Planet: VoIP Security: SIP-Versatile but Vulnerable

IT Business Edge: Pay Attention to VoIP Security Before The Storm

NetworkWorld: Business Guide to VoIP Security

Pocket-lint: Fraudsters targeting VoIP Users based on report out of Newport Networks (reported in VoIP News) – also covered at Fierce VoIP: Newport Networks riles up VoIP Security Fears and Computeractive: Phreak-out over VoIP and TechHerald article

Network World: Security and management considerations when deploying OCS

LXer: Secure Calling Initiative Reaches Second Milestone pointing to Secure Calling Initiative

[H]Enthusiast: Mobile Phones, VoIP Not Secure, Experts Warn=

VoIP News: The Essential Guide to VoIP Privacy

Voice of VOIPSA: Information Week interviews SecureLogix about VoIP security

eWeek: VoIP Security through Responsible Software Development

Microsoft gives back door keys to Vista to police

Comment (blog) from Martyn Davies

Comment (email) from Detlef

Comment (email) from Dan McGinn-Combs

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

41:43 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on August 26, 2008 at 09:16 PM in Blue Box, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: blue box, bluebox, dan york, danyork, iskoot, jonathan zar, ofcom, security, SIP, SIP security, skype, voip, voip security, voipsa, voipsecurity

July 15, 2008

Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Synopsis: Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically.

NOTE: This show was originally recorded on April 17, 2008.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!

MANY thanks for all the offers of audio production assistance – getting it organized now

Ingate SIP Trunking webinar now available (and a note about participating in things like this)

VOIPSA blog site hacked

Voice of VOIPSA: Quarterly VoIP Vulnerabilities Summary

VoIPshield list of vulnerabilities

Cisco Advisory

Cisco Advisory about Disaster Recovery Framework

Voice of VOIPSA: VoIPshield announces discovery of over 100 vulnerabilities along with a YouTube video

Washington Post: Reach Out And Hack Someone

Voice of VOIPSA: GNUcitizen research discovery: Default key algorithm in Thomson and BT Home Hub routers

VoIP News: The Essential Guide to VoIP Security

Information Week: Securing VoIP with SecureLogix – includes YouTube video with Mark Collier

Voice of VOIPSA: VoIP and the International Space Station

Voice of VOIPSA: Xplico Network Forensic Analysis Tool

Voice of VOIPSA: Australians falling victim to foreign phone hackers

VoIP News Australia: How ACMA Plans to Regulate VoIP

Network World: Government agencies rejecting VoIP?

Linux Professional Institute to develop enterprise-level security exam

Net neutrality and Bell Canada

ZDNet: Attacks escalate on critical U.S. government networks: Will a Manhattan Project work?

Google XSS Attack (interesting as it shows the complexity of such attacks)

The Economist: Special Report: The New Nomadism

VoiceBiometrics – May 14-15, New York

IP Telephony University – June 23-24, Alexandria, VA

Review of the last week's traffic on the VOIPSEC public mailing list

Wrap-up of the show

44:22 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on July 15, 2008 at 05:20 PM in Blue Box, Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: avaya, blue box, bluebox, cisco, dan york, danyork, jonathan zar, nortel, security, SIP, SIP security, voip, voip security, voipsa, voipsecurity, voipshield

June 10, 2008

Blue Box SE#025 - An interview with Eric Hernaez about Solegy and the OpenSBC Project

Synopsis: Blue Box Special Edition #25: An interview with Eric Hernaez, CEO of Solegy, about the OpenSBC project

Welcome to Blue Box: The VoIP Security Podcast Special Edition #25, a 13-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

In this interview, I sat down with Eric Hernaez, CEO of Solegy, to talk about the OpenSBC Project and how it provides an open source implementation of a session border controller (SBC). We talked about how OpenSBC came about, who is using it, how scalable it is and where users can learn more. We also discussed Solegy, the company supporting the open source OpenSBC project and what they are doing. It was an enjoyable talk that really came about randomly when I met Eric near the press room at IT Expo in Los Angeles back in September 2007. We had been wanting to learn more about the OpenSBC project so I put my recorder on a table and we started talking.