Blue Box: The VoIP Security Podcast

Blue Box #49: SPIT, Skype security, disposable phone numbers, phishing, VoIP security news, listener comments and more

Synopsis: SPIT, Skype security, disposable phone numbers, phishing, VoIP security news, listener comments and more...

---

Welcome to Blue Box: The VoIP Security Podcast #49, a 55-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: This show was originally recorded January 5, 2007, and was delayed with production issues.

Download the show here (MP3, 23MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

---

Show Content:

• 00:21 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!  Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
• 03:12 - Programming notes:
  • Audio issues with #48 – writing to USB drive
  • Dan contributed to Still Secure, After All These Years, Podcast #26 which was a roundup of opinions on security issues from a range of folks
  • Show #50 is next week
• 04:37 - VoIP News: How Secure Are Your VoIP Calls – and my response
• 06:07 - Note that Mark Collier has revamped the design of his VoIP Security Blog
• 06:38 - CSO: Security in 2007: Botnets, Threat Convergence and Other Risks – note their casual mention of SPIT and “thousands of messages” – wonder where they got their data from?
• 09:28 - ZDNet: What threats does Skype face? – interview with Skype CSO Kurt Sauer – also Jan Geirnaert’s response
• 15:08 - Jan: How to use the Skype and P2P traffic blocker? Tapping into Skype Traffic with the traffictapper from Lyanda.
• 16:14 - Dark Reading: Voice Cracks
• 18:17 - IT Observer: Voice over IP Under Threat – which was slashdotted
• 20:31 - TechWeb: Phishers’ Latest Platforms: VoIP, SMS
• 21:11 - EnterpriseITPlanet: The Year in Instant Messaging
• 26:28 - Voice of Voipsa: (just quick mentions – we forgot these last week)
  • Martyn: Securing the WLAN Link
  • Shawn: Skype 3.0 – Your new Romulan phone
  • Martyn: Tell Me Your PIN, So I Can Go Shopping
  • Dustin: Skype, an Essential Tool for Interrogation (also RealGeek )
• 29:56 - Websense ‘Skype’ Trojan Analysis – followup to our story last week… not VoIP per se but an interesting analysis
• 32:05 - The PhoneBoy Blog: Eating My Words on OpenID
• 34:18 - Zycko: VoIP Security priority for 2007
• 34:50 - Network World: The year ahead: Juggling IT risks, opportunities
• 35:08 - Upcoming shows:
  • Jan 23-26, 2007, Ft. Lauderdale, FL, Internet Telephony Conference and Expo – East
  • Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
  • Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
  • Mar 1-2, 2007, London, EUSecWest
  • Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
  • Mar 23-25, Washington, DC, ShmooCon ‘07
  • Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
• 35:48 - Comment (audio) about Minnesota Asterisk user group
• 37:36 - Comment (blog) from Aswath Rao
• 39:58 - Comment (blog) from Mark Collier
• 40:07 - Comment (email) from Martyn Davies about ISS report
• 40:34 - Comments-3 (email) from Craig
• 41:52 - Comment (email) from Dave Roper pointing to Disposable Phone Numbers - discussion included Jangl, Private Phone and Craigsnumber
• 48:02 - Comment (email) from Rick McCharles
• 51:32 - Review of the last week's traffic on the VOIPSEC public mailing list
• 52:08 - Wrap-up of the show
  • Reminder that you can subscribe to the show via email as well as RSS
  • Mention of our Frappr map
• 54:38 - End of show

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

Technorati tags: voip security, voip, voipsa, skype, skype security, phishing, SPIT, security

Blue Box "Podcasts by Phone" is back up with a new phone number

For folks wondering whatever happened to the ability to listen to Blue Box podcasts over the phone, the person running the service, "natas", let me know that he had a situation where the provider of the DID phone line stopped providing that service.  He's got the server back up now with a new provider and a new phone number:

  +1-218-339-8544

Now that it's back up, he's going to be updating it with new shows as he only has up to Blue Box #40 in there right now.  So the question of the moment is... who will get done first?  Will natas update the server up through show #48?  Or will I post shows #49 and #50 to the blog?

Seriously, we do appreciate and thank natas for providing this service and we would still be curious to hear people's feedback about whether or not this service is useful to them.  (It's all part of the grand experiment here...)

Shows 49 and 50 are in the queue...

If you are wondering why their haven't been any Blue Box episodes since January 3rd, don't panic, we haven't "podfaded".  Shows 49 and 50 have both been recorded and are sitting in a certain producer's queue for audio post-production and editing.  Unfortunately, that producer, who shall remain nameless but whose last name starts with a "Y", has been a wee bit buried and show #49 ran a bit longer and needs some more editing than many of our episodes.   But they will be out soon....  my apologies for the delay!

Blue Box #48: The Crystal Ball Edition - Top VoIP Security issues of 2006 and predictions for 2007, Skype worm that wasn't, drive-by SPIT, OpenID, poking holes in firewalls, listener comments and more...

Synopsis: The Crystal Ball Edition - Top VoIP Security issues of 2006 and predictions for 2007, Skype worm that wasn't, drive-by SPIT, OpenID for SIP authentication, poking holes in firewalls, listener comments and more...

---

Welcome to Blue Box: The VoIP Security Podcast #48, a 50-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: For the first time in many shows we had an issue with the recording of the show that introduced gaps and other audio artifacts.  Unfortunately, I was not running my backup recorder and schedules (and holidays) made a retake impractical.  So my apologies... and if you are new to the show, please don't judge the show by the audio quality of this particular show.

Download the show here (MP3, 23MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

---

Show Content:

• 00:21 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!  Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
• 01:50 - Programming notes:
  
  • sending in ident audio files
  • Dan has launched a new blog - Disruptive Telephony
  • Dan was interviewed by Jon Arnold about VoIP Security for his podcast series
• 04:08 - CNET: Confusion over Skype security threat clears up – all sorts of reports originating from the Websense blog entry – other links: CBC ComputerWorld TechWorld SC: Hackers unleash worm that targets Skype Heise Online – also Earthtimes gets it right
• 06:31 - DarkReading: VoIP More Vulnerable
• 09:09 - McGraw-Hill press release about Hacking Exposed: VoIP and also CRN: VoIP Risks Take Center Stage in 2007
• 09:49 - CNS: Telecom execs conclude enterprise security products insufficient for carrier networks
• 11:14 - Xchange Online: Survey: Security a Concern in Product Rollouts
• 12:44 - Heise Security: The hole trick: How Skype & Co. get round firewalls (tip to 21talks )
• 13:26 - Network Magazine (India): Voice over IP: Security issues to the fore
• 15:50 - Aswath Rao: There is No Money in the Authentication Business with some reaction, particularly from PhoneBoy Kveton and Alec Saunders
• 20:51 - ITBusiness.ca: The pros and cons of having a contractor do security
• 22:22 - VoIP News: Building VoIP Security at the Gateway Level – part of a special on VoIP Gateways
• 23:47 - Greatreporter.com: Hackers ‘can eavesdrop on 70% of web calls’
• 24:44 - LinuxDevices: Belkin WiFi Skype phone based on Linux
• 26:04 - Oral Health & Dental Practice Management: Technology in Tomorrow’s Dental Office
• 27:21 -Bluesocket Achieves VoIP Vocera Certifications
• 28:42 - Feature - Top VoIP security stories from 2006 and predictions for 2007. Some links mentioned in the discussion:
  
  • RSA Speaking of Security Podcast #42 about phishing war story
  • vnunet.com’s IT security predictions for 2007
  • BCS: MessageLabs: Targeted security attacks to soar in 2007 (also in SC )
• 46:23 - Upcoming shows:
  • Jan 23-26, 2007, Ft. Lauderdale, FL, Internet Telephony Conference and Expo – East
  • Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
  • Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
  • Mar 1-2, 2007, London, EUSecWest
  • Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
  • Mar 23-25, Washington, DC, ShmooCon ‘07
  • Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
• 47:26 - Review of the last week's traffic on the VOIPSEC public mailing list
• 48:04 - No comments other than Aswath's note about OpenID that we covered earlier.
• 48:45 - Wrap-up of the show
  • Reminder that you can subscribe to the show via email as well as RSS
  • Mention of our Frappr map
• 50:11 - End of show
   

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.