1 / 19

Carrier VoIP Security: Threats and Defenses

Carrier VoIP Security: Threats and Defenses. Agenda. Security Philosophy VoIP Basics (IETF SIP-based) VoIP Threats Fundamental VoIP Security Mechanisms and Tasks Enhanced VoIP Security – Session Border Control Enhanced VoIP Security – Application Layer Firewall.

lalasa
Download Presentation

Carrier VoIP Security: Threats and Defenses

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Carrier VoIP Security:Threats and Defenses

  2. Agenda • Security Philosophy • VoIP Basics (IETF SIP-based) • VoIP Threats • Fundamental VoIP Security Mechanisms and Tasks • Enhanced VoIP Security – Session Border Control • Enhanced VoIP Security – Application Layer Firewall

  3. 21st Century Security Philosophy Security must be layered, i.e. defenses in depth. Perimeter hardening, like physical measures, is just a first step. All network elements must be hardened as "defensive strong points" in their own right. Deploy multiple security technologies. Deployed assets MUST have integrated security capabilities that support end-to-end protection. NO clear-text passwords, use secure protocols. NO networking link is trustable anywhere!

  4. PSTN /SS7 Internet SIP-Based VoIP Softswitch Servers SIP-BasedVoice Mail Common Services Infrastructure TDM-Based Voice Mail ALF /SBC Circuit Switch Softswitch / SIP SS7 GW POTS Phone Trunk Gateway Softswitch / SIP SS7 GW PSTN /SS7 ILEC LATA IP Network ALF /SBC POTS Phone BYOBB Trunk Gateway FiOS Nomadic Customer C FiOS Customer A FiOS Customer B

  5. VoIP Threat Taxonomy

  6. SIP and VoIP Security Concerns • VoIP Denial of Service • IP Phone Provisioning / Credentialing • Caller ID Spoofing • VoIP Theft of Service • SIP Registration Hijacking • SIP Proxy Impersonation • SIP and RTP message tampering / injection • SIP to SS7 Signaling Conversion • IP-Based Voicemail Fraud • E911 Availability • CALEA / Law Enforcement • Oh yes, and that issue with NAT

  7. VoIP Security – Minimum Defenses • Use SIP Digest Authentication • Drawn from HTTP MD5 Digest Authentication per RFC 2617 • Server sends a nonce to client which client hashes with shared secret • This digest is sent back to server for verification and authentication • It provides a way to verify a user’s (claimed) identity without having to send passwords or secrets “in the clear”. • It makes it difficult for an intruder to tamper with a user’s service by “replaying” portions of previous messages. (Replay prevention) • It supports an optional capability for ensuring that a SIP message has not been altered. (Message integrity)

  8. VoIP Security – Minimum Defenses The Inputs for Digest Authentication • These inputs are sent to the client by the server in the 401 or 407 challenging response: • nonce = a random string • realm = hostname/domain defining the server • qop = quality of protection; can be “auth” or “auth-int” (w/ integrity) • opaque = server generated string; no well-defined use • These are inputs provided by the client: • nc-value = nonce count; used in preventing replay • cnonce = client generated nonce; used to prevent chosen plaintext attacks, provide some mutual authentication and integrity. • method = SIP method (i.e., INVITE, SUBSCRIBE, NOTIFY, …) • username • password

  9. VoIP Security – Minimum Defenses • After getting challenged and receiving the server inputs (with a specified qop), the client then performs either of the following calculations where H(x) is the hash of x: • When qop = “auth” H ( H(username:realm:password):nonce: nc-value:cnonce:qop:H(method;URI of called party) ) • When qop = “auth-int” H ( H(username:realm:password):nonce: nc-value:cnonce:qop:H(method:URI of calledparty: H(entity-body) ) )

  10. VoIP Security – Minimum Defenses Don’t be a Cache Cow • The security is weakened if the nonces are cached for more than a brief period • The security can be enhanced by making use of the nonce-count and the next-nonce values. • nonce-count = # of times a nonce has been used including the current request • next-nonce = the nonce that the server sends for a client to use in next request • The next-nonce mechanism has a negative impact on signaling performance for pipelined requests. • The nonce-count provides some good replay security without the performance hit of next-nonce.

  11. VoIP Security – Minimum Defenses SIP Digest Authentication Bob Alice Proxy INVITE 407 Proxy Authentication Required ACK INVITE (with the digested credentials) INVITE 200 OK 180 Ringing 180 Ringing 200 OK 200 OK ACK Media Session BYE 200 OK

  12. VoIP Security – Minimum Defenses • Use encryption when provisioning IP phones • Harden Softswitch (usually multiple servers) • Enable rate /session limits within Switch Application • Run IPSec on SIP inter-carrier peering • Lock down DNS (Lots to do) • Vulnerability scanning • Don’t you dare “trust” your management network • Identify relevant inputs to a Fraud Analysis process

  13. Enchanced VoIP Security – SBCs • Using Session Border Controllers • SIP layer and RTP alternate routing • Inbound / Outbound SIP Proxy • Call Admission Control • RTP firewall pinhole management • SIP layer rewriting for NAT Traversal • SIP layer rewriting for topology hiding • SIP Call State awareness for optimizing softswitch assets • Point of collection for CALEA / LI targets

  14. VoIP Security – Robustness Testing • SIP is both simple and quite complex • Format borrows heavily from HTTP and is easy to read • Session state awareness and protocol timers are complex • SIP Robustness test tools are available • Protos, Codenomicon, SIP Bomber, PacketCrafter • Essentially a Protocol Stresser and Reliability Tester • Several SIP network elements were crashed • Some SIP stacks are poorly built • No input validation, poor memory management,… • Gosh, maybe we need a SIP Application Layer Firewall

  15. Enhanced VoIP Security – SIP ALF • ALF = Application Layer Firewall • In VoIP context - the ALF is really a SIP Intrusion Prevention System • Selling management on the additional expense • Show and Tell • Demonstrated SBCs and Softswitches crashing • Avoiding exposures due to the risks • Next generation direction is to combine SBC and ALF functions in one device to gain economies

  16. Lessons Learned

  17. Industry Challenges: Service Providers: Collaborate on accumulating security related actuarial information Standards Bodies: ANSI/ITU developed architectural security framework Technology standards groups follow ANSI/ITU framework and leverage existing standard technologies (IPsec, PKI) Accommodate today's reality (NAT, Firewalls, untrusted networks) Vendor Community: Consider current best practices (e.g.. RFCs 2196, 2504, 3365) Build on standards (IPsec, PKI, NIST Common Criteria, ATIS, ITU-T, ISO) Support future needs (IPsec, IPv4 to IPv6 migration, PKI) Adjust product plans to today's security realities (NAT is a fact and everywhere, NO network segments can be assumed trustable)

  18. In Conclusion Verizon is addressing today's very real threats. Standards organizations must address carrier class security issues and architectures. The vendor community needs to produce equipment & software that meet Verizon's security objectives. Our customers and peer carriers need to work with us to mitigate security risks.

  19. Questions?

More Related