VoIP Users Conference » security http://www.voipusersconference.org Live every Friday at 12 Noon Eastern time Sat, 04 Feb 2012 06:43:49 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 http://www.voipusersconference.org/feed/podcast/ This is a weekly live meeting of people all over the world who are interested in sharing knowledge and experiences about telephony over the Internet. Guests include authors, innovators, programmers and Internet personalities. The conference is reached by phoning in using SIP, Skype or a web page widget shown on the main web site http://vuc.me @voipusers clean @voipusers itunes@voipusersconference.org itunes@voipusersconference.org (@voipusers) VOIP allows you to do almost anything with incoming and outgoing telephone lines. telephony,communications,international,asterisk,freeswitch,freepbx,skype VoIP Users Conference » security http://www.voipusersconference.org/wp-content/uploads/powerpress/_vuc144.jpg http://www.voipusersconference.org Voicemail (in)Security http://www.voipusersconference.org/2011/voicemail-insecurity/ http://www.voipusersconference.org/2011/voicemail-insecurity/#comments Fri, 15 Jul 2011 11:00:43 +0000 VUC http://www.voipusersconference.org/?p=3396

In the aftermath of the big and controversial voicemail hack starring the NOTW… wait – “controversial”, does anyone think this was OK? Anyway it’s our topic and we hope to gather some knowledgable people to chat about it including Tim Panton, Humbug Telecom’s Boaz Bechar, Truphone’s James Body, Dan York of Voxeo and anyone else ready to “testify”. Be there!

 

Video of the talking heads is here

]]> http://www.voipusersconference.org/2011/voicemail-insecurity/feed/ 0 Boaz Bechar,Dan York,Humbug Telecom,James Body,PhoneFromHere.com,security,Tim Panton,Truphone,voicemail,voxeo labs In the aftermath of the big and controversial voicemail hack starring the NOTW... wait - "controversial", does anyone think this was OK? Anyway it's our topic and we hope to gather some knowledgable people to chat about it including Tim Panton, In the aftermath of the big and controversial voicemail hack starring the NOTW... wait - "controversial", does anyone think this was OK? Anyway it's our topic and we hope to gather some knowledgable people to chat about it including Tim Panton (http://phonefromhere.com), Humbug Telecom's Boaz Bechar (https://plus.google.com/105263759632917377626/about), Truphone's James Body (https://plus.google.com/102855196688335034813/about), Dan York (http://danyork.com) of Voxeo and anyone else ready to "testify". Be there!   Video of the talking heads is here (http://www.justin.tv/randulo/b/290250265) @voipusers clean 1:03:02 VoIP Abuse Project http://www.voipusersconference.org/2010/voip-abuse-project/ http://www.voipusersconference.org/2010/voip-abuse-project/#comments Fri, 01 Oct 2010 11:00:09 +0000 VUC http://www.voipusersconference.org/?p=2462

Thanks to those who requested this on our mailing list! We have liftoff! (VoIP Security)

VoIP Abuse Project . J. Oquendo

“Arkeos is a program primarily used on Unix based servers running the Asterisk Open Source PBX. The application mimics a valid extension in which an attacker, after bruteforcing an account, attempts to place calls. What the attacker doesn’t know is that their calls go nowhere. The sole purpose of allowing them to perceive they have an account is to track them. Where they come from, what accounts they use, what VoIP account scanners they use, what numbers they try to dial. Because of the flexibility of Asterisk and Unix as a whole, the application does a lot more than stated however, I will not disclose too much otherwise any attackers reading this might catch on. Then I won’t have anyone to play with.”

]]> http://www.voipusersconference.org/2010/voip-abuse-project/feed/ 0 abuse,accounting,asterisk,attacker,attempted,communication,communication software,computing,extensions,honeypot,mimic,private branch exchange Thanks to those who requested this on our mailing list! We have liftoff! (VoIP Security) - VoIP Abuse Project . J. Oquendo - "Arkeos is a program primarily used on Unix based servers running the Asterisk Open Source PBX. (http://www.voipusersconference.org/wp-content/uploads/2010/09/voipsa_small.gif)Thanks to those who requested this on our mailing list (http://vuc.me/mailinglist)! We have liftoff! (VoIP Security) VoIP Abuse Project (http://voipsa.org/blog/2010/09/28/voip-abuse-project/) . J. Oquendo "Arkeos is a program primarily used on Unix based servers running the Asterisk Open Source PBX. The application mimics a valid extension in which an attacker, after bruteforcing an account, attempts to place calls. What the attacker doesn’t know is that their calls go nowhere. The sole purpose of allowing them to perceive they have an account is to track them. Where they come from, what accounts they use, what VoIP account scanners they use, what numbers they try to dial. Because of the flexibility of Asterisk and Unix as a whole, the application does a lot more than stated however, I will not disclose too much otherwise any attackers reading this might catch on. Then I won’t have anyone to play with." @voipusers clean 58:42 Acme Packet On Session Border Controllers http://www.voipusersconference.org/2010/acme-packet-on-session-border-controllers/ http://www.voipusersconference.org/2010/acme-packet-on-session-border-controllers/#comments Fri, 18 Jun 2010 11:00:50 +0000 mjgraves http://www.voipusersconference.org/?p=2183

Friday June 18th we will be extending our recent trend in discussing matters of VoIP security.  This call will feature Ken Kuenzel from Acme Packet. Acme Packet are the leading provider of “Session Border Controllers,” aka SBCs.

What’s an SBC? What does it do?  So glad you asked…as that’s just what we aim to find out on Friday!  Acme has uploaded a slide presentation to follow while listening.

In the mean time, and for the very curious among you, Acme Packet has some great background on the topic amongst their online articles and presentations.

Yes, there’s homework!

Acme products: session border controllers (SBC), session-aware load balancers (SLB), multiservice security gateways (MSG) and session routing proxies (SRP)—operate Acme Packet Net-Net OS.

]]> http://www.voipusersconference.org/2010/acme-packet-on-session-border-controllers/feed/ 0 Acme packet,calling features,communication,computing,electronics,ken kuenzel,SBC,security,session border controller,voice over internet protocol,VoIP Friday June 18th we will be extending our recent trend in discussing matters of VoIP security.  This call will feature Ken Kuenzel from Acme Packet. Acme Packet are the leading provider of "Session Border Controllers," aka SBCs. - What's an SBC? (http://www.voipusersconference.org/wp-content/uploads/2010/06/acme-packet-150.png)Friday June 18th we will be extending our recent trend in discussing matters of VoIP security.  This call will feature Ken Kuenzel from Acme Packet (http://www.acmepacket.com/). Acme Packet are the leading provider of "Session Border Controllers," aka SBCs. What's an SBC? What does it do?  So glad you asked...as that's just what we aim to find out on Friday!  Acme has uploaded a slide presentation (http://vuc.li/acmeslides) to follow while listening. In the mean time, and for the very curious among you, Acme Packet has some great background on the topic amongst their online articles and presentations (http://www.acmepacket.com/html/page.asp?PageID={716C54F6-210A-424B-B082-9F5B0A1B49C3}). Yes, there's homework! Acme products: session border controllers (http://www.acmepacket.com/OS_SBC) (SBC), session-aware load balancers (http://www.acmepacket.com/html/page.asp?PageID=%7B2EEADF05-813A-459D-ABF0-B56DC97B7DA8%7D) (SLB), multiservice security gateways (http://www.acmepacket.com/OS_MSG) (MSG) and session routing proxies (http://www.acmepacket.com/SRP) (SRP)—operate Acme Packet Net-Net OS. @voipusers clean 51:27 SIP Hacks: who should filter what, where? http://www.voipusersconference.org/2010/sip-hack-callerid-stuffing/ http://www.voipusersconference.org/2010/sip-hack-callerid-stuffing/#comments Mon, 24 May 2010 11:27:58 +0000 VUC http://www.voipusersconference.org/?p=2139

Among others, Ward Mundy (Nerd Vittles, our guest next week) and many of the VUC regulars join in this violent argument civil discussion about who is responsible for filtering, where it should take place and the how and why of their ideas on the subject.

If you’re into SIP technology, you’ll want to hear this discussion about who should protect people from SIP “CallerID stuffing” among Ward Mundy, Fred Posner (VoIP Tech Chat), Tim Panton, Karl Fife, Leif Madsen and the rest of the great gang of VoIP regulars. This is why you need to join us LIVE every Friday!

Programmers differ enormously over who should filter incoming data and where. There is no right answer, although the main point is to protect your users against whatever possible attacks might come through your system or pbx.

]]> http://www.voipusersconference.org/2010/sip-hack-callerid-stuffing/feed/ 3 attack,attacks,audio file,broadband,caller id,callerid,cleaning,communication,data,difference,electronic engineering,electronics Among others, Ward Mundy (Nerd Vittles, our guest next week) and many of the VUC regulars join in this violent argument civil discussion about who is responsible for filtering, where it should take place and the how and why of their ideas on the subject. Among others, Ward Mundy (Nerd Vittles (http://nerdvittles.com), our guest next week) and many of the VUC regulars join in this violent argument civil discussion about who is responsible for filtering, where it should take place and the how and why of their ideas on the subject. If you're into SIP technology, you'll want to hear this discussion about who should protect people from SIP "CallerID stuffing" among Ward Mundy, Fred Posner (VoIP Tech Chat (http://www.voiptechchat.com/)), Tim Panton, Karl Fife, Leif Madsen and the rest of the great gang of VoIP regulars. This is why you need to join us LIVE every Friday! Programmers differ enormously over who should filter incoming data and where. There is no right answer, although the main point is to protect your users against whatever possible attacks might come through your system or pbx. @voipusers clean 1:13:36 Dan York’s 7 Deadliest UC Attacks http://www.voipusersconference.org/2010/7-deadliest-uc-attacks/ http://www.voipusersconference.org/2010/7-deadliest-uc-attacks/#comments Fri, 21 May 2010 00:00:37 +0000 VUC http://www.voipusersconference.org/?p=2032

Dan York’s name is certainly familiar to you if you’re a fan of VoIP. He has made a video to explain why he wrote this book. Dan’s credentials are strong and he’s an active community member. You’ve seen him in airports between conferences, or even at one of those Voxeo events.

Dan’s blog (perhaps we should say one of his many blogs) is Disruptive Telephony. Dan can be found on Twitter as @DanYork and he’s on Linkedin, Facebook, etc. Finding those links is left as an exercise for the enthusiastic student. :)

While I’m not sure what his current role there is, Dan is a part of another effort you should know about, the VoIP Security Alliance aka VOIPSA where he writes on the VOIPSA blog.

]]> http://www.voipusersconference.org/2010/7-deadliest-uc-attacks/feed/ 1 attacks,Dan York,deadliest,new books,security,uc,voice over internet protocol,Voxeo Dan York's name is certainly familiar to you if you're a fan of VoIP. He has made a video to explain why he wrote this book. Dan's credentials are strong and he's an active community member. You've seen him in airports between conferences, (http://www.voipusersconference.org/wp-content/uploads/2010/04/6a00d8341bfc6e53ef0120a8310200970b-800wi.png) Dan York's name is certainly familiar to you if you're a fan of VoIP. He has made a video to explain why he wrote this book (http://www.7ducattacks.com/2010/04/video-intro-to-seven-deadliest-unified-communications-attacks.html). Dan's credentials are strong and he's an active community member. You've seen him in airports between conferences, or even at one of those Voxeo events (http://www.voxeo.com/summits/customer). Dan's blog (perhaps we should say one of his many blogs) is Disruptive Telephony (http://www.disruptivetelephony.com/). Dan can be found on Twitter as @DanYork (http://twitter.com/danyork) and he's on Linkedin, Facebook, etc. Finding those links is left as an exercise for the enthusiastic student. :) While I'm not sure what his current role there is, Dan is a part of another effort you should know about, the VoIP Security Alliance aka VOIPSA (http://www.voipsa.org/) where he writes on the VOIPSA blog (http://www.voipsa.org/blog/). @voipusers clean 50:46 Amazon Indifference to EC2 Attacks Continues http://www.voipusersconference.org/2010/amazon-ec2-attacks-continue/ http://www.voipusersconference.org/2010/amazon-ec2-attacks-continue/#comments Sun, 18 Apr 2010 15:43:10 +0000 VUC http://www.voipusersconference.org/?p=1968

EC2 attacks continue with no help from them. Amazon continues its “head in the sand” approach to our community and this is unacceptable. Forgive the intrusion on this page, look below for the VUC sessions.

You can help push this to their attention:

Please make sure you keep this issue visible by voting it up on SlashDot. If you haven’t followed out discussions, see Fred’s story. Asterisk user mailing list has a lot of info on it as well. Post on Twitter, their robot stupidly repeats all comments that contain EC2 so don’t forget to use that mention in anything you post. Post on your blogs and any forums you can.

I expected better from Amazon and I’ll withdraw my significant business from them if they don’t rise up to the challenge.

]]> http://www.voipusersconference.org/2010/amazon-ec2-attacks-continue/feed/ 0 Beginning OpenVPN 2.0.9 http://www.voipusersconference.org/2010/book-beginning-openvpn-2-0-9/ http://www.voipusersconference.org/2010/book-beginning-openvpn-2-0-9/#comments Fri, 05 Feb 2010 00:00:21 +0000 VUC http://www.voipusersconference.org/?p=1411

OpenVPN_2.0.9
The VPN topic will be of interest to all on the VUC so we’re inviting Markus Feilner, author of “Beginning OpenVPN 2.0.9“.

Two copies of this book to give away today

The following is from the preface of the book, co-authored by Norbert Graf:
OpenVPN is an outstanding piece of software that was invented by James Yonan in the year 2001 and has steadily been improved since then. No other VPN solution offers a comparable mixture of enterprise-level security, usability, and feature richness. We have been working with OpenVPN for many years now, and it has always proven to be the best solution. This book is intended to introduce OpenVPN software to network specialists and VPN newbies alike. OpenVPN works where most other solutions fail and exists on almost any platform. Thus, it is an ideal solution for problematic setups and an easy approach for the inexperienced.
On the other hand, the complexity of classic VPN solutions, especially IPsec, gives the impression that VPN technology in general is difficult and a topic only for very experienced (network and security) specialists. OpenVPN proves that this can be different, and this book aims to document that.
I want to provide both a concise description of OpenVPN’s features and an easy-to-understand introduction for the inexperienced. Though there may be many other possible ways to success in the scenarios described, the ones presented have been tested in many setups and have been selected for simplicity reasons.
LINKS
 Next scheduled session in your time zone
Freenode.net IRC web client, just add your pseudo and you're on #vuc
 VUC Google Group

  VUC linkedin group (business contacts)
Links mentioned in IRC Feb 5, 2010
[6:19pm] NerdUno: Here are some good OpenVPN tutorials: http://pbxinaflash.com/forum/showthread.php?t=4856
[6:21pm] steely_glint: ecrist - http://www.phonefromhere.com/vuc/
[6:31pm] ecrist: Why TCP Over TCP Is A Bad Idea:  http://sites.inka.de/~bigred/devel/tcp-tcp.html
[6:32pm] kfife:        http://www.packtpub.com/openvpn/book
[6:34pm] Zeeek:        http://www.linux4afrika.de/vision.html?L=0
[6:40pm] mfeilner:        http://www.linux-magazine.com/Issues/2009/99/SAFE-CALL
[6:41pm] mfeilner:        http://www.feilner-it.net
[6:42pm] mfeilner:        http://www.openvpn.eu
[6:43pm] mfeilner:        http://www.openvpn.eu/index.php?id=23&L=0

[7:39pm] Skibum: BTW more info on Bria 3 is available at: http://www.counterpath.com/bria.html
[8:00pm] mjgraves:        http://gigaset.com/chagall/provider/general/chagall223_02.bin
[8:21pm] JimCifarelli:        http://www.embeddedarm.com/about/resource.php?item=408

Part 2: Bria Tests and more

]]> http://www.voipusersconference.org/2010/book-beginning-openvpn-2-0-9/feed/ 0 Books,computer network security,computer networking,computer security,computing,encryption,internet privacy,Markus Feilner,OpenVPN,packt,security,tunneling protocols The VPN topic will be of interest to all on the VUC so we're inviting Markus Feilner, author of "Beginning OpenVPN 2.0.9". Two copies of this book to give away today - The following is from the preface of the book, (http://www.voipusersconference.org/wp-content/uploads/2009/12/OpenVPN_2.0.9.png) The VPN topic will be of interest to all on the VUC so we're inviting Markus Feilner (https://www.packtpub.com/author_view_profile/id/76), author of "Beginning OpenVPN 2.0.9". Two copies of this book to give away today The following is from the preface of the book, co-authored by Norbert Graf (https://www.packtpub.com/author_view_profile/id/432): OpenVPN is an outstanding piece of software that was invented by James Yonan in the year 2001 and has steadily been improved since then. No other VPN solution offers a comparable mixture of enterprise-level security, usability, and feature richness. We have been working with OpenVPN for many years now, and it has always proven to be the best solution. This book is intended to introduce OpenVPN software to network specialists and VPN newbies alike. OpenVPN works where most other solutions fail and exists on almost any platform. Thus, it is an ideal solution for problematic setups and an easy approach for the inexperienced. On the other hand, the complexity of classic VPN solutions, especially IPsec, gives the impression that VPN technology in general is difficult and a topic only for very experienced (network and security) specialists. OpenVPN proves that this can be different, and this book aims to document that. I want to provide both a concise description of OpenVPN's features and an easy-to-understand introduction for the inexperienced. Though there may be many other possible ways to success in the scenarios described, the ones presented have been tested in many setups and have been selected for simplicity reasons. LINKS Next scheduled session (http://vuc.me/next) in your time zone Freenode.net IRC web client (http://vuc.me/irc), just add your pseudo and you're on #vuc VUC Google Group (http://vuc.me/mailinglist) VUC linkedin group (http://vuc.me/linkedin) (business contacts) Links mentioned in IRC Feb 5, 2010 [6:19pm] NerdUno: Here are some good OpenVPN tutorials: http://pbxinaflash.com/forum/showthread.php?t=4856 [6:21pm] steely_glint: ecrist - http://www.phonefromhere.com/vuc/ [6:31pm] ecrist: Why TCP Over TCP Is A Bad Idea:  http://sites.inka.de/~bigred/devel/tcp-tcp.html [6:32pm] kfife: http://www.packtpub.com/openvpn/book [6:34pm] Zeeek: http://www.linux4afrika.de/vision.html?L=0 [6:40pm] mfeilner: http://www.linux-magazine.com/Issues/2009/99/SAFE-CALL [6:41pm] mfeilner: http://www.feilner-it.net [6:42pm] mfeilner: http://www.openvpn.eu [6:43pm] mfeilner: http://www.openvpn.eu/index.php?id=23&L=0 [7:39pm] Skibum: BTW more info on Bria 3 is available at: http://www.counterpath.com/bria.html [8:00pm] mjgraves: http://gigaset.com/chagall/provider/general/chagall223_02.bin [8:21pm] JimCifarelli: http://www.embeddedarm.com/about/resource.php?item=408 Part 2: Bria Tests and more @voipusers clean Digium Security Webinar http://www.voipusersconference.org/2009/digium-security-webinar/ http://www.voipusersconference.org/2009/digium-security-webinar/#comments Thu, 19 Nov 2009 19:11:11 +0000 VUC http://www.voipusersconference.org/?p=1229

]]> http://www.voipusersconference.org/2009/digium-security-webinar/feed/ 0 SIP Hacking, Security, AMOOCON and AGI http://www.voipusersconference.org/2009/sip-hacking-security/ http://www.voipusersconference.org/2009/sip-hacking-security/#comments Fri, 27 Mar 2009 12:00:44 +0000 VUC http://sessions.voipusersconference.org/?p=223

DC Security Guard Interupts Fox5 News Story on...
Image by Thomas Hawk via Flickr

[audio:http://media.blubrry.com/winelover/recordings.talkshoe.com/TC-22622/TS-198844.mp3]

IRC Transcript 2009-03-27

SIP hacking has escalated and there was a wave of it in recent times. John Todd published a simple common sense set of rules that are worth reading. One of the main risk areas is using user names and secrets that are too easy to guess (such as extension 200, username=2000,password=wakeme).

More on SIP for Skype etc. That looks like it will be an ongiung discussion. See the session with Michael Robertson above.

We briefly reviewed a new book called Asterisk Gateway Interface 1.4 and 1.6 Programming. John Todd and /me have both been looking at it and we both think it looks good. Since the discussion, I’ve read more of it and I will talk more about it in a future session.

Amazon link (beer money!)
Asterisk Gateway Interface 1.4 and 1.6 Programming

We also mentioned AMOOCON where we can meet up for those of you who will be in Europe or are already there. I will be presenting two papers, one on VoicePHP and one on the VoIP community and various social networking tools.

Reblog this post [with Zemanta]
]]> http://www.voipusersconference.org/2009/sip-hacking-security/feed/ 0 AGI,AMOOCON,book,randal schwartz,security,sip Image by Thomas Hawk via Flickr - IRC Transcript 2009-03-27 - SIP hacking has escalated and there was a wave of it in recent times. John Todd published a simple common sense set of rules that are worth reading. (http://farm4.static.flickr.com/3123/2551933784_3ab06caeae_m.jpg) Image by Thomas Hawk (http://www.flickr.com/photos/51035555243@N01/2551933784) via Flickr IRC Transcript 2009-03-27 (http://www.voipusersconference.org/wp-content/uploads/2009/03/2009-03-27.txt) SIP hacking has escalated and there was a wave of it in recent times. John Todd published a simple common sense set of rules (http://tr.im/sipsecurity)that are worth reading. One of the main risk areas is using user names and secrets that are too easy to guess (such as extension 200, username=2000,password=wakeme). More on SIP for Skype etc. That looks like it will be an ongiung discussion. See the session with Michael Robertson above. We briefly reviewed a new book called Asterisk Gateway Interface 1.4 and 1.6 Programming (http://www.packtpub.com/article/asterisk-gateway-interface-programming-table-of-contents). John Todd and /me have both been looking at it and we both think it looks good. Since the discussion, I've read more of it and I will talk more about it in a future session. Amazon link (beer money!) Asterisk Gateway Interface 1.4 and 1.6 Programming (http://www.amazon.com/gp/product/184719446X?ie=UTF8&tag=resmo&linkCode=as2&camp=1789&creative=390957&creativeASIN=184719446X)(http://www.assoc-amazon.com/e/ir?t=resmo&l=as2&o=1&a=184719446X) We also mentioned AMOOCON (http://www.amoocon.de) where we can meet up for those of you who will be in Europe or are already there. I will be presenting two papers, one on VoicePHP (http://voicephp.com/) and one on the VoIP community and various social networking tools. (http://img.zemanta.com/reblog_e.png?x-id=79fb93d7-56f5-4631-b746-eb5e933efa85) @voipusers clean