Hacking VoIP Exposed

Updated: April 30, 2009

Hackers are a busy bunch. If they're not jamming data networks or crippling users' PCs, they're hijacking servers or stealing privileged information.

Hackers are also beginning to target VoIP systems and their users. Since VoIP is essentially an Internet-based data service, it's as vulnerable to hacker attacks as anything else that moves information across the Web. We recently spoke to Mark Collier, co-author of "Hacking VoIP Exposed" (McGraw-Hill, 2006, paperback, $49.99), for his opinion on the state of VoIP security and how businesses can better understand and deal with various types of Internet telephony threats. Collier is chief technology officer of SecureLogix Corp., an enterprise VoIP network-management tools vendor located in San Antonio, where he is responsible for all the company's product and services research and development. Here are his thoughts on hackers and VoIP.


What are the biggest VoIP hacking threats?

Mark Collier: The biggest potential issue is Denial of Service (DoS). VoIP systems are very susceptible to various forms of DoS. DoS can affect the IP PBX, supporting infrastructure services such as TFTP (Trivial File Transfer Protocol) and DHCP (Dynamic Host Configuration Protocol), the network, and IP phones. DoS can seriously degrade the quality of calls. Also, legacy issues are not going away with the adoption of VoIP. In some cases, VoIP can make some legacy security issues worse.

What can hackers do to a business's VoIP system?

Mark Collier: They can disrupt service, preventing users from effectively using the VoIP system. They can eavesdrop on calls and listen to conversations or gather information such as DTMF {the dialing tones that signify phone numbers}. They can access voice mail. They can steal minutes via toll fraud. They can manipulate the content of calls.

Is SPIT a real problem?

Mark Collier: It isn't now. It will probably develop into a real problem, but it will take several years for it to develop.

Is the hacker problem growing?

Mark Collier: As enterprises deploy more VoIP, as they extend VoIP to teleworkers and the public network, and as they increase the use of softphones and unified communications, the security issues will increase. Hackers will become more interested in attacking VoIP systems. We are already seeing an increase in interest in the hacker community, including development of more and more attack tools.

Are most business users aware of these threats?

Mark Collier: Not really. Some are and some are not. Many are focused on the wrong threats.

What are the top things a business can do to protect itself against VoIP hackers?

Mark Collier: The first step is to perform an assessment to determine what vulnerabilities exist. There are often some simple, inexpensive changes that can be made that will greatly increase security. You can't fix what you aren't aware of. Outsourcing an assessment is a good idea.

What can VoIP service providers and vendors do to make the technology safer?

Mark Collier: The major VoIP system vendors are improving their systems. With each major release, you see real security improvement with many of the vendors, including the leaders like Nortel, Cisco and Avaya. The vendors, however should work better with their customers during deployment,to make sure that the security that is available is used.

Featured Research
  • VoIP: Your New Secret Weapon for a Strong Year End

    As the end of 2017 nears, you may be feeling pressure to make sure you close the year out strong.If you’ve been sitting on the fence regarding VoIP, this may be the perfect time to switch. VoIP options had never been better or more full-featured than they are now, and it may be just the thing your business needs to see a productivity and profitability boost. more

  • Is Your Phone System Stealing Profits?

    Having the wrong phone system can dramatically cut into your profits. Despite this, many businesses just sign up for a plan or platform that seems ‘good enough’. If you haven’t carefully considered your options and the included features, there’s a very good chance that you are leaving money on the table in some way. more

  • Phone System Technology Showdown

    VoIP and IP telephony are often misconstrued as being the same type of phone system, but the truth is they operate on different technology and deployment methods. This guide will explain the differences between VoIP and IP, go into the pros and cons of both VoIP and IP-PBX, and give insight into which type of phone system will benefit your business the most. more

  • Why Enterprises are Making the Switch to VoIP

    Your phone system is your most important business communication system. It allows you to connect with your employees, prospects, and clients. And wouldn't it be great if there was a solution that helped drive down costs while providing a competitive advantage? more

  • Business Phone System Buyer's Guide

    Communication has been a focal point in business since inception, but the industry is changing drastically in how people connect to one another and what tools and systems they use to do so. Less than 15 years ago, 90% of people relied on landline phone systems for communication. Today, less than 60% of Americans even have a landline and 40% rely solely on their mobile phone. more