Voice pharming attack and the trust of VoIP

@inproceedings{Wang2008VoicePA,
  title={Voice pharming attack and the trust of VoIP},
  author={Xinyuan Wang and Ruishan Zhang and Xiaohui Yang and Xuxian Jiang and Duminda Wijesekera},
  booktitle={SecureComm},
  year={2008}
}
Voice communication is fundamental to the normal operation of our society. The general public have put a lot of trust in voice communication and they have been relying on it for many critical and sensitive information exchange (e.g., emergency 911 calls, calls to customer service of financial institutions). Now more and more voice calls are carried, at least partially, over the public Internet rather than traditional Public Switched Telephone Network (PSTN). The security ramifications of using… 

Figures from this paper

Security Issues in VoIP Telecommunication Networks
An Empirical Investigation into the Security of Phone Features in SIP-Based VoIP Systems
TLDR
Empirically investigated phone features, e.g., 911 call, voicemail, and Do Not Disturb confirm that leading deployed SIP-based VoIP systems have serious security vulnerabilities.
Analysis and Protection of SIP based Services
TLDR
An ontology defined as “VoIP-Onto" is introduced that provides a formal representation of a comprehensive taxonomy of VoIP attacks followed by specific security recommendations and guidelines for protecting the underlying infrastructure from these attacks.
On the feasibility of launching the man-in-the-middle attacks on VoIP from remote attackers
TLDR
It is demonstrated that a remote attacker who is not initially in the path of VoIP traffic can indeed launch all kinds of MITM attacks on VoIP by exploiting DNS and VoIP implementation vulnerabilities and vulnerabilities of non-VoIP-specific protocols can indeed lead to compromise ofVoIP.
Denial-of-service detection and mitigation for SIP communication networks
TLDR
This thesis identifies different attacks on SIP-based networks with the focus on Denial-of-Service attacks (DoS) flooding attacks and proposes three different DoS detection and mitigation schemes, including one to handle this particular SIP DNS attack.
A Comprehensive Survey of Voice over IP Security Research
  • A. Keromytis
  • Computer Science
    IEEE Communications Surveys & Tutorials
  • 2012
TLDR
A comprehensive survey of Voice over IP security academic research is presented, using a set of 245 publications forming a closed cross-citation set, to provide a roadmap for researchers seeking to understand existing capabilities and to identify gaps in addressing the numerous threats and vulnerabilities present in VoIP systems.
Securing VOIP networks via Transport protocols Layer
TLDR
This paper examines and investigates the concerns and requirements of VoIP security, and focuses on attacks and threats at Transport protocol layer and countermeasures to it that are essential for curren t and future VoIP implantations.
Securing VoIP networks via signaling protocol layer
TLDR
This paper examines and investigates the concerns and requirements of VoIP security, and focuses on attacks and threats at signaling protocol layer and countermeasures to it that are essential for current and future VoIP implantations.
...
1
2
3
...

References

SHOWING 1-10 OF 62 REFERENCES
An overview of some techniques to exploit VoIP over WLAN
  • G. Me, D. Verdone
  • Computer Science
    International Conference on Digital Telecommunications (ICDT'06)
  • 2006
TLDR
Several typologies of attack are shown: eavesdropping and sniffing of the VoIP calls, man in the middle, denial of service, call interruption and build false calls, whenever a company deploys a VoIP network infrastructure based on some untested VoIP softphone and wireless LAN (as an internal hotspot).
Billing Attacks on SIP-Based VoIP Systems
TLDR
This paper examines how the vulnerabilities of SIP can be exploited to compromise the reliability and trustworthiness of the billing of the SIP-based VoIP systems and presents four billing attacks on VoIP subscribers that could result in charges on the calls the subscribers have not made or overcharges on the VoIP calls they have made.
SIP security issues: the SIP authentication procedure and its processing load
TLDR
This work describes the security model used by SIP, the architecture of a possible commercial IP telephony service including user authentication, and provides an experimental performance analysis of the SIP security mechanisms, based on the open source Java implementation of a SIP proxy server.
VoIP Intrusion Detection Through Interacting Protocol State Machines
TLDR
This paper proposes a highly-needed VoIP intrusion detection system that utilizes not only the state machines of network protocols but also the interaction among them for intrusion detection, and shows promising detection characteristics and low runtime impact on the perceived quality of voice streams.
SCIDIVE: a stateful and cross protocol intrusion detection architecture for voice-over-IP environments
TLDR
SCIDIVE is structured to detect different classes of intrusions, including, masquerading, denial of service, and media stream-based attacks, and can operate with both classes of protocols that compose VoIP systems - call management protocols (CMP) and media delivery protocols (MDP), e.g., RTP.
Fast Detection of Denial-of-Service Attacks on IP Telephony
TLDR
This paper presents an online statistical detection mechanism, called vFDS, to detect DoS attacks in the context of VoIP, based on Hellinger distance method, which computes the variability between two probability measures.
Secure IP Telephony using Multi-layered Protection
TLDR
This paper presents the design and analysis of a multilayer protection scheme against denial-of-service (DoS) attacks in IP telephony enabled enterprise networks and shows that the detection algorithm can quickly detect both transport and application layer attacks and is robust against various types of attacks.
Exploiting open functionality in SMS-capable cellular networks
TLDR
The ability to deny voice service to cities the size of Washington DC and Manhattan with little more than a cable modem is described and attacks targeting the entire United States are feasible with resources available to medium-sized zombie networks.
Exploiting open functionality in SMS-capable cellular networks
TLDR
The ability to deny voice service to cities the size of Washington D.C. and Manhattan with little more than a cable modem is demonstrated and countermeasures that mitigate or eliminate the threats introduced by these attacks are discussed.
Tracking anonymous peer-to-peer VoIP calls on the internet
TLDR
The analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied.
...
1
2
3
4
5
...