VoIP Privacy

1
VoIP Privacy

• April 2007

2
About BroadSoft

• Founded in 1998
• Commercially Deployed 5 years
• Profitable

• Hosted PBX / IP Centrex
• Bus. Trunking
• Residential Broadband
• Mobile PBX
• Voice and Multimedia

Market Leader
VoIP Application Software
Partner of Choice
Most Deployments

• Leading IMS Vendors
• E.g., Ericsson, Lucent
• 5 of top 6 TEMs OEM BroadWorks

• 250 Fixed Mobile Service Providers
• 7 of top 10 (and 13 of the top 25) global carriers

3
Leading Global Customer Base
7 of top 10 and 13 of top 25 global carriers
4
What is VoIP?

• Consumer
• Voice Over the Internet
• Vonage, Skype etc
• Business
• IP based PBX systems
• IP Centrex Systems
• Switching occurs in the service provider network

Internet
IP Network
5
Significant Global VoIP Subscriber Growth
Source Ovum Infonetics, 2006
6
Current VoIP Privacy Issues

• Normal Data Attacks
• DoS Attacks on data networks brings down all
  applications including data
• Open source PBXs have known buffer
  vulnerabilities
• SIP Vulnerabilities
• Registration hijacking
• Message tampering
• Session tear-down
• VoIP targeted DoS attack

7
Current VoIP Privacy Issues

• SPIT (Span over Internet Telephony)
• Imagine your voice mail being filled up with
  Viagra adverts?
• Huge potential for issues
• Not many real world instances
• Vishing Phishing using telephony
• VoIP lowers the cost of Vishing
• Small scale today
• Already attacks on Paypal

8
Current VoIP Privacy Issues

• VoIP Hacking
• One instance of brute force hacking in 2006
• 1M fraud Offender behind bars
• Eavesdropping
• Man in the middle attacks
• Similar techniques already in place by security
  services for Lawful Intercept

9
And LastlyStealing Minutes

• Phreakers
• Phreakers break into gateways to steal minutes
• 200M mins/month stolen worth an estimated
  26M/month
• Transport networks now moving to private
  connectivity to avoid Phreakers

Source Stealth Communications
10
Current State of Play

• All the afore mentioned problems have either been
  solved or are close to being solved by session
  boarder controllers
• Also addressed in IMS
• Service providers are implementing or have
  implemented security systems
• Businesses building their own VoIP networks will
  have to be extremely careful about implementation