Blue Box: The VoIP Security Podcast

Blue Box Podcast #1 - October 24, 2005

Welcome to Blue Box: The VoIP Security Podcast show #1, an 11-minute podcast providing news and commentary around VoIP security issues.

Download the show here (MP3, 10MB) or subscribe to the RSS feed to download the show automatically.

Show Content:

• 00:18 - Dan introduces the show, provides contact information and welcomes comments
• 01:06 - Explanation of the term "Blue Box"
• 01:45 - Mention of Skype trojan as found in PC World and
• 02:26 - Discussion of Skype security evaluation (direct link to PDF here)
• 03:41 - News of updated Voice Over IP Security Alliance (VOIPSA) web site and the release of the first view of the VoIP Security Threat Taxonomy. VOIPSA is looking for feedback and anyone can contribute through the VOIPSA wiki.
• 04:58 - Mention of Erik Lagerway podcast interviewing Andrew Graydon of Borderware about VoIP security
• 05:38 - Mention of CSO Online podcast interviewing Dan Geer and Ejovi Nuwere about the recent analysis of vulnerabilities in SMS which could easily cause a massive Denial of Service against cellular networks
• 07:20 - Review of the last week's traffic on the VOIPSEC public mailing list, including: softphone security discussion , IEEE Network special edition on VoIP Security, Skype security concerns and a request from Packetizer Labs for beta testers for their new secure H.323 softphone.
• 09:23 - Wrapup of the show and a thanks to Shel Holtz and Neville Hobson of the "For Immediate Release" podcast.

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to [email protected]. Audio comments are welcome and will be played in future shows. You may also call the listener comment line at +1-206-338-6654. Thank you for listening and next week's show will have news coming out of the Internet Telephony conference happening this week in Los Angeles, California. Until then....

Welcome to the Blue Box podcast

Greetings and welcome to the Blue Box podcast!  The first episode will appear shortly.  In the meantime, I thought I would post two questions and answers:

Who am I?  I'm a long-time data and network security guy who has been working with the Internet now for 20+ years and has written and presented on numerous TCP/IP and network topics.  But more to the point, for the last four years I have been working at Mitel where today among other responsibilities I chair our Product Security Team and am usually the point person on responding to VoIP security questions or issues.  I am also Mitel's representative to the VoIP Security Alliance where I look forward to interacting with many of my peers at other companies and organizations to find ways to address both the reality and perception of VoIP security. (Note: I mention Mitel purely so you may understand my background. There is no affiliation or endorsement between this blog and Mitel.  This is for me a personal endeavor.)  FYI, my personal blog is available at blog.danyork.com where I write about a number of different topics, including VoIP.

What is with the "blue box" title? Well, old-timers in the telecom and security space will certainly remember that the "blue box" was one of the original security threats to the PSTN.  It seemed like an appropriate nod to history as the industry confronts a new range of threats and attacks.

Now, with that out of the way, sit back and stay tuned for the podcasts to appear.