VoIP Security Threats
VoIP has many economical and functional benefits. VoIP also brings with it its own set of vulnerabilities. Companies who are willing to adopt the new technology must be aware of the inherent risks involved in implementing it. This document assumes that the reader has some understanding of the basics of VoIP
Data security and assurance is a hot topic in Corporate America’s IT departments. Companies are being held liable by customers and the government for their protection of private data. Non-compliance with government standards noticeable security breaches can result in costly fines from the Federal Trade Commission. The loss of private customer data can result in the severing of relationships between customers and corporations . Many large corporations in America have had data stolen in the last two years. Seisint, the Lexis-Nexis research company, had a security breach that allows the intruders to gain names, addresses and social security numbers of some 300,000 people. Bank of America reportedly lost magnetic tapes that contained information on around 1.2 million government employees’ credit cards .
VoIP is no different when it comes to data security and theft. In June of 2006, an owner of a VoIP company in Miami was arrested for a theft of service scam that allowed him to gain nearly $1 million. Edwin Pena hacked into a competitor’s VoIP system and routed his customers’ calls through the hacked network. This allowed Pena to collect subscription fees without having to pay for overhead costs . In January of 2003 it was reported that some companies fell victim to the Slammer worm. The worm infected data networks and quickly spread to wreak havoc on VoIP systems.
Spam is a huge problem for consumers and in the corporate environment today. Corporations spend millions of dollars on appliances that prevent spam from flooding the inboxes of their employees. In the telephony world a similar problem is telemarketing. Thousands of call centers worldwide dial consumers and sometimes businesses asking the called party to buy something. This annoyance has yielded many legislation bills to stop these unwanted calls. VoIP unfortunately experiences the marriage of these two annoyances, called spam over Internet telephony (SPIT). SPIT allows spammers to create audio files and send them to millions of voicemail boxes at a time.
While phishing is still a big problem that plagues consumers, a new type of phishing has emerged that uses VoIP technology instead of URLs and the web, called vishing for “voice phishing”. Vishing attacks can take many forms but in the most common case a person receives an e-mail stating that their credit card or financial information has been compromised. The victim is given a fake 800 number to call in order to regain access to their account. When the victim dials the number, an Interactive Voice Response system asks the victim to verify his or her bank account or credit card numbers by pressing the appropriate numbers on the keypad . The phone system on the other end records this information and relays it to the vishing thieves.
Porter, T. (2006). Practical VoIP Security. Rockland, MA: Syngress Publishing.
Kuhn, R. (2006). Voice Over Internet Protocol (VOIP) Security [Power Point Presentation].
Kay, R. (2004). Phishing [Electronic Version]. ComputerWorld. Retrieved November 5, 2006 from http://www.computerworld.com/securitytopics/security/story/0,10801,89096,00.html.