When good VoIP security tools turn to the dark side

It's 10pm... and do you know if your VoIP network is safe? Just like any other kind of the technology, it's all a matter of who's hands tools are in as to whether they are used for good or bad. That's no different for the open source VoIP penetration testing tool VoIP Hopper, as this Wired story describes how easy it is to hack into many VoIP networks.

VoIP hopper is roughly the equivalent of an early Nessus scanner for the VoIP world. Using VoIP Hopper you can simulate the interactions between a VoIP handset and PIBXs. In the Wired article even basic security such as MAC address filtering wasn't being used on VoIP networks they broke into. Unfortunately, again, VoIP is like so many other new technologies that are widely deployed but security is an afterthought. If someone told you we were going allow some new strange mobile device onto the network, we'd at least take a second look wouldn't we? Many VoIP networks still consider the wired network inside the firewall a "trusted" network but the opposite is really true.

If you are using VoIP in your network, you should at least be firewalling VoIP traffic through a firewall setup sepcifically for SIP and VoIP call handling, preventing access to other data and servers. VLANs and MAC filtering can help but aren't a cureall. VoIP is another reason to get your network into the 802.1X era so handsets have to authenticate. Bottom line, don't take VoIP security lightly. Voice is likely your most mission critical buisness application. Bring down voice and email, and many businesses are severely crippled.