VOIP SECURITY: PRACTICAL APPROACHES
Chapter 1 Introduction to VoIP Security 1 Introduction 2 The Switch Leaves the Basement 4 What Is VoIP? 6 VoIP Benefits 7 VoIP Protocols 9 VoIP Isn’t Just Another Data Protocol 10 Security Issues in Converged Networks 13 VoIP Threats 15 A New Security Model 16 Summary 18 Solutions Fast Track 20 Frequently Asked Questions 21 Chapter 2 Asterisk Configuration and Features 23 Introduction: What Are We Trying to Accomplish? 24 What Functions Does a Typical PBX Perform? 24 PBX Administration 27 Asterisk Gateway Interface (AGI) 27 Asterisk Manager API 27 Dial Plans 28 Numbering Plans 29 Choosing a Numbering Scale for Your Private Numbering Plan 31 Extensions Based on DID 33 Dialing Plan and Asterisk PBX 34 Billing 35 Billing Accounting with Asterisk PBX System 35 Routing 38 Time-of-Day Routing 39 Day-of-Week Routing 39 Source Number Routing 39 Cost-Savings Routing 39 Disaster Routing 39 Skill-Based Routing 40 DUNDi Routing Protocol 40 Other Functions 40 Music on Hold 41 Call Parking 41 Call Pickup 42 Call Recording 43 Conferencing 43 Direct Inward System Access 45 Unattended Transfer (or Blind Transfer) 46 Attended Transfer (or Consultative Transfer) 46 Consultation Hold 46 No Answer Call Forwarding 46 Busy Call Forwarding 46 Do Not Disturb (DND) 47 Three-Way Calling 48 Find-Me 48 Call-Waiting Indication 49 Voice Mail and Asterisk PBX 49 How Is VoIP Different from Private Telephone Networks? 51 Circuit-Switched and Packet-Routed Networks Compared 51 What Functionality Is Gained, Degraded, or Enhanced on VoIP Networks? 52 Gained Functionality 52 Degraded Functionality 54 Enhanced Functionality 55 Summary 56 Solutions Fast Track 56 Frequently Asked Questions 58 Chapter 3 The Hardware Infrastructure 59 Introduction 60 Traditional PBX Systems 61 PBX Lines 62 PBX Trunks 64 PBX Features 65 PBX Adjunct Servers 68 Voice Messaging 69 Interactive Voice Response Servers 70 Wireless PBX Solutions 71 Other PBX Solutions 71 PBX Alternatives 71 VoIP Telephony and Infrastructure 72 Media Servers 72 Interactive Media Service: Media Servers 73 Call or Resource Control: Media Servers 73 Media Gateways 75 Firewalls and Application-Layer Gateways 75 Application Proxies 76 Endpoints (User Agents) 76 IP Switches and Routers 80 Wireless Infrastructure 80 Wireless Encryption:WEP 80 Wireless Encryption:WPA2 81 Authentication: 8021x 82 Power-Supply Infrastructure 83 Power-over-Ethernet (IEEE 8023af ) 84 UPS 84 Energy and Heat Budget Considerations 85 Summary 86 Solutions Fast Track 86 Frequently Asked Questions 88 Chapter 4 PSTN Architecture 91 Introduction 92 PSTN: What Is It, and How Does It Work? 92 PSTN: Outside Plant 93 PSTN: Signal Transmission 95 T1 Transmission: Digital Time Division Multiplexing 96 PSTN: Switching and Signaling 102 The Intelligent Network (IN), Private Integrated Services, ISDN, and QSIG 105 ITU-T Signaling System Number 7 (SS7) 106 PSTN: Operational and Regulatory Issues 110 PSTN Call Flow 111 PSTN Protocol Security 114 SS7 and Other ITU-T Signaling Security 114 ISUP and QSIG Security 117 Summary 118 Solutions Fast Track 118 Frequently Asked Questions 120 Chapter 5 H323 Architecture 123 Introduction 124 The H323 Protocol Specification 124 The Primary H323 VoIP-Related Protocols 126 H225/Q931 Call Signaling 129 H245 Call Control Messages 134 Real-Time Transport Protocol 136 H235 Security Mechanisms 137 Summary 142 Solutions Fast Track 142 Frequently Asked Questions 143 Chapter 6 SIP Architecture 145 Introduction 146 Understanding SIP 146 Overview of SIP 147 RFC 2543 / RFC 3261 148 SIP and Mbone 149 OSI 149 SIP Functions and Features 152 User Location 152 User Availability 153 User Capabilities 153 Session Setup 153 Session Management 153 SIP URIs 154 SIP Architecture 154 SIP Components 155 User Agents 155 SIP Server 155 Stateful versus Stateless 157 Location Service 157 Client/Server versus Peer-to-Peer Architecture 158 Client/Server 158 Peer to Peer 159 SIP Requests and Responses 159 Protocols Used with SIP 162 UDP 162 Transport Layer Security 164 Other Protocols Used by SIP 165 Understanding SIP’s Architecture 168 SIP Registration 169 Requests through Proxy Servers 169 Requests through Redirect Servers 170 Peer to Peer 171 Instant Messaging and SIMPLE 172 Instant Messaging 172 SIMPLE 174 Summary 177 Solutions Fast Track 177 Frequently Asked Questions 180 Chapter 7 Other VoIP Communication Architectures 183 Introduction 184 Skype 184 History 185 Skype Protocol Design 186 Skype Messaging Sequence 186 Skype Protocol Security 189 H248 189 History 190 H248 Protocol Design 191 H248 Messaging Sequence 193 H248 Protocol Security 194 IAX 195 IAX Protocol Design 195 IAX Messaging Sequence 195 IAX Protocol Security 197 Microsoft Live Communication Server 2005 197 History 199 MLCS Protocol Design 199 MLCS Security 200 Summary 202 Solutions Fast Track 202 Frequently Asked Questions 203 Chapter 8 Support Protocols 205 Introduction 206 DNS 206 DNS Architecture 207 Fully Qualified Domain Name (FQDN) 208 DNS Client Operation 209 DNS Server Operation 211 Security Implications for DNS 212 TFTP 212 TFTP 213 TFTP File Transfer Operation 214 Security Implications for TFTP 215 HTTP 216 HTTP Protocol 216 HTTP Client Request 217 HTTP Server Response 217 Security Implications for HTTP 218 SNMP 219 SNMP Architecture 219 SNMP Operation 220 SNMP Architecture 221 DHCP 222 DHCP Protocol 222 DHCP Operation 223 Security Implications for DHCP 224 RSVP 225 RSVP Protocol 226 RSVP Operation 227 Security Implications for RSVP 228 SDP 228 SDP Specifications 229 SDP Operation 230 Security Implications for SDP 231 Skinny 231 Skinny Specifications 232 Skinny Operation 232 Security Implications for Skinny 233 Summary 234 Solutions Fast Track 235 Frequently Asked Questions 237 Chapter 9 Threats to VoIP Communications Systems 239 Introduction 240 Denial-of-Service or VoIP Service Disruption 240 Call Hijacking and Interception 248 ARP Spoofing 251 H323-Specific Attacks 256 SIP-Specific Attacks 257 Summary 258 Solutions Fast Track 259 Frequently Asked Questions 261 Chapter 10 Validate Existing Security Infrastructure 263 Introduction 264 Security Policies and Processes 265 Physical Security 277 Perimeter Protection 279 Closed-Circuit Video Cameras 279 Token System 280 Wire Closets 281 Server Hardening 281 Eliminate Unnecessary Services 282 Logging 283 Permission Tightening 284 Additional Linux Security Tweaks 287 Activation of Internal Security Controls 289 Security Patching and Service Packs 293 Supporting Services 294 DNS and DHCP Servers 294 LDAP and RADIUS Servers 296 NTP 297 SNMP 297 SSH and Telnet 298 Unified Network Management 299 Sample VoIP Security Policy 300 Purpose 300 Policy 301 Physical Security 301 VLANs 301 Softphones 301 Encryption 301 Layer 2 Access Controls 302 Summary 303 Solutions Fast Track 304 Frequently Asked Questions 306 Chapter 11 Confirm User Identity 309 Introduction 310 8021x and 80211i (WPA2) 313 8021x/EAP Authentication 315 Supplicant (Peer) 315 Authenticator 315 Authentication Server 315 EAP Authentication Types 319 EAP-TLS 322 EAP-PEAP 322 EAP-TTLS 322 PEAPv1/EAP-GTC 323 EAP-FAST 323 LEAP 323 EAP-MD-5 323 Inner Authentication Types 324 Public Key Infrastructure 327 Public Key Cryptography Concepts 328 Architectural Model and PKI Entities 330 Basic Certificate Fields 332 Certificate Revocation List 333 Certification Path 334 Minor Authentication Methods 335 MAC Tools 335 MAC Authentication 335 ARP Spoofing 336 Port Security 336 Summary 337 Solutions Fast Track 338 Frequently Asked Questions 339 Chapter 12 Active Security Monitoring 343 Introduction 344 Network Intrusion Detection Systems 346 NIDS Defined 346 Components 346 Types 348 Placement 349 Important NIDS Features 353 Maintenance 353 Alerting 353 Logging 353 Extensibility 353 Response 353 Limitations 354 Honeypots and Honeynets 354 Host-Based Intrusion Detection Systems 355 Logging 356 Syslog 356 SNMP 358 Penetration and Vulnerability Testing 360 What Is a Penetration/Vulnerability Test? 361 Methodology 362 Discovery 362 Scanning 363 Vulnerability Assessment 364 Exploitation 364 Reporting 364 Summary 367 Solutions Fast Track 368 Frequently Asked Questions 370 Chapter 13 Logically Segregate Network Traffic 373 Introduction 374 VLANs 375 VLAN Security 378 VLANs and Softphones 379 QoS and Traffic Shaping 380 NAT and IP Addressing 382 How Does NAT Work? 383 NAT Has Three Common Modes of Operation 385 NAT and Encryption 388 NAT as a Topology Shield 391 Firewalls 392 A Bit of Firewall History 392 Shallow Packet Inspection 392 Stateful Inspection 393 Medium-Depth Packet Inspection 393 Deep Packet Inspection 394 VoIP-Aware Firewalls 396 H323 Firewall Issues 396 SIP Firewall Issues 399 Bypassing Firewalls and NAT 400 Access Control Lists 403 Summary 406 Solutions Fast Track 407 Frequently Asked Questions 409 Chapter 14 IETF Encryption Solutions for VoIP 411 Introduction 412 Suites from the IETF 412 S/MIME: Message Authentication 414 S/MIME Messages 416 Sender Agent 416 Receiver Agent 417 E-mail Address 417 TLS: Key Exchange and Signaling Packet Security 417 Certificate and Key Exchange 418 SRTP:Voice/Video Packet Security 420 Multimedia Internet Keying 421 Session Description Protocol Security Descriptions 421 Providing Confidentiality 422 Message Authentications 422 Replay Protection 423 Summary 425 IETF RFCs 425 Frequently Asked Questions 428 Chapter 15 Regulatory Compliance 431 Introduction 432 SOX: Sarbanes-Oxley Act 434 SOX Regulatory Basics 434 Direct from the Regulations 434 What a SOX Consultant Will Tell You 437 SOX Compliance and Enforcement 440 Certification 440 Enforcement Process and Penalties 441 GLBA: Gramm-Leach-Bliley Act 441 GLBA Regulatory Basics 442 Direct from the Regulations 442 What a Financial Regulator or GLBA Consultant Will Tell You 447 GLBA Compliance and Enforcement 450 No Certification 450 Enforcement Process and Penalties 450 HIPAA: Health Insurance Portability and Accountability Act 451 HIPAA Regulatory Basics 451 Direct from the Regulations 452 What a HIPAA Consultant Will Tell You 459 HIPAA Compliance and Enforcement 460 No Certification 460 Enforcement Process and Penalties 460 CALEA: Communications Assistance for Law Enforcement Act 461 CALEA Regulatory Basics 464 Direct from the Regulations 465 What a CALEA Consultant Will Tell You 477 CALEA Compliance and Enforcement 478 Certification 478 Enforcement Process and Penalties 479 E911: Enhanced 911 and Related Regulations 479 E911 Regulatory Basics 480 Direct from the Regulations 480 What an E911 Consultant Will Tell You 485 E911 Compliance and Enforcement 486 Self-Certification 486 Enforcement Process and Penalties 486 EU and EU Member Sates’ eCommunications Regulations 486 EU Regulatory Basics 487 Direct from the Regulations 488 What an EU Data Privacy Consultant Will Tell You 492 EU Compliance and Enforcement 493 No Certification 493 Enforcement Process and Penalties 493 Summary 494 Solutions Fast Track 494 Frequently Asked Questions 496 Chapter 16 The IP Multimedia Subsystem: True Converged Communications 499 Introduction 500 IMS Architecture 501 Access Network 501 Core Network 502 User Database 502 Call/Session Control 502 Application Servers 503 Media Servers 504 Breakout Gateway 505 Application Level Gateway 505 Communication Flow in IMS 505 IMS Security Architecture 506 IMS Security Issues 510 SIP Security Vulnerabilities 510 Registration Hijacking 511 IP Spoofing/Call Fraud 511 Weakness of Digest Authentication 511 INVITE Flooding 511 BYE Denial of Service 511 RTP Flooding 512 Spam over Internet Telephony (SPIT) 512 Early IMS Security Issues 512 Full IMS Security Issues 513 Summary