The security threats cause even more concern when we think that VoIP is replacing the oldest and most secure communication system the world ever known – POTS (Plain Old Telephone System). Let us have a look at the threats VoIP users face.
Identity and Service Theft
Phreaking is a type of hacking that steals service from a service provider or use service while passing the cost to another person. Encryption is not common in SIP, which controls authentication over VoIP calls, so user credentials are vulnerable to theft. Eavesdropping is how most hackers steal credentials and other information. Through eavesdropping, a third party can obtain names, passwords and phone numbers, allowing them to gain control over voicemail, calling plan, call forwarding and billing information. This leads to service theft. Stealing credentials to make calls without paying is not the only reason behind identity theft. Thieves do it to get valuable information like business data. A phreaker can change calling plans and packages and add more credit or make calls using the victim’s account. He can, as well, access confidential elements like voice mail and do personal things like change a call forwarding number.
Vishing
Vishing is another word for VoIP Phishing, which involves a party calling you faking a trustworthy organization (e.g. your bank) and requesting confidential and often critical information.
Viruses and Malware
VoIP utilization involving softphones and software are vulnerable to worms, viruses, and malware, just like any Internet application. Running on user systems like PCs and PDAs exposes softphone applications to malicious code attacks in voice applications.
DoS (Denial of Service)
A DoS attack is an attack on a network or device denying it of service or connectivity. Attackers consume bandwidth or overload the network or the device’s internal resources. In VoIP, DoS attacks flood a target with unnecessary SIP call-signaling messages, thereby degrading the service. This causes calls to drop prematurely and halts call processing. Why would someone launch a DoS attack? Once the service stops working, the attacker can gain remote control of the administrative facilities of the system.
SPIT (Spamming over Internet Telephony)
If you use email regularly, then you must know what spamming is. Put simply, spamming is sending emails to people against their will. These emails are primarily online sales calls. Spamming in VoIP is becoming more prevalent, especially with the emergence of VoIP as an industrial tool. Every VoIP account has an associated IP address. It is easy for spammers to send their messages (voicemails) to thousands of IP addresses. Voice mailing, as a result, will suffer. Spamming clogs voicemails and more space, as well as better voicemail management tools, become necessary. Spam messages can carry viruses and spyware along with them, as well. This brings us to another flavor of SPIT, which is phishing over VoIP. Phishing attacks consist of sending a voicemail to a person, masquerading it with information from a party trustworthy to the receiver, like a bank or online paying service, making him think he is safe. The voicemail usually asks for confidential data like passwords or credit card numbers. You can imagine the rest!
Call Tampering
Call tampering is an attack that involves tampering with a phone call in progress. For example, the attacker can simply spoil the quality of the call by injecting noise packets in the communication stream. He can also withhold the delivery of packets so that the communication becomes spotty and the participants experience lengthy periods of silence during the call.
Man-in-the-Middle Attacks
VoIP is particularly vulnerable to man-in-the-middle attacks, in which the attacker intercepts call-signaling SIP message traffic and masquerades as the calling party to the called party, or vice versa. Once the attacker has gained this position, he can hijack calls via a redirection server.
