Blue Box: The VoIP Security Podcast

Blue Box #51: Cisco SIP vulnerabilities, VoIP security hype, SPIT, OpenID, other VoIP security news and more...

Synopsis: Cisco SIP security vulnerabilities, VoIP security hype, SPIT, OpenID, other VoIP security news and more... 

---

Welcome to Blue Box: The VoIP Security Podcast #51, a 35-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions. 

NOTE: This show was originally recorded February 7, 2007. 

Download the show here (MP3, 16MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

---

Show Content: 

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long! Discussion of bandwidth in Japan and Asia.
• 03:13 - Programming notes
  • Podcasts by phone is back up with new number - +12183398544
• 3:53 - Cisco Security Advisory: SIP Packet Reloads IOS Devices Not Configured for SIP – note also that Cisco is now using CVSS as mentioned in their (Cisco) FAQ
• 06:33 - Multiple VOIP Phones Aredfox PA168 Chipset Session Hijacking Vulnerability
• 09:26 - InfoWorld NL: Hype versus reality in VoIP security
• 13:37 - ITWire: NEC’s VoIP spam detector turns Turing Test on its head and also Engadget: NEC invents 99 percent effective SPIT catcher and also ZDNet: VoIP spam tipped to rocket
• 16:49 - IIS Zone: What To Do When SPIT Hits The Fan (sponsored by Verisign)
• 18:59 - Network World: Expert: Phishing and other social attacks threaten VoIP (Dave Endler)
• 20:23 - CommsDesign: VoIP security: Scenarios, challenges, and counter measures—Part I
• 21:11 - CompTIA: Concerns Over IP Telephony Security Still Present in SMB Market, CompTIA Study Reveals – see also vnunet article and techtarget (sent in by Rhodri Davies)
• 23:49 - Aswath: Extending OpenID Authentication Scheme for Communication Systems
  • Comment from Shlomo Dubrowin about OpenID
• 29:09 - darkreading: FBI Faces Fresh Cyber Threats
• 29:36 - CRN: CRN Poll: No concerns around VoIP adoption (sample size?)
• 30:06 - Press Releases
  
  • Postini Annual Communications Intelligence Report Shows Security and Compliance Top Communications Professionals’ Concerns=
  • Sipera boots VoIP Security
  • Eyeball Intros AnyFirewall Engine (sent in by Craig Bowser)
  • SONUS NETWORKS OFFERS NETWORK OPERATORS ENHANCED SECURITY WITH LATEST RELEASE OF NETWORK BORDER SWITCH
  • Secure Computing Introduces Sidewinder 7.0, Industry’s First Reputation-based Firewall
  • Info Security Products Guide Awards Covergence the ’’Hot Companies’’ Recognition for 2007
• 31:18 - Hudson Barton has a new blog Borderless Communications with a VoIP Security Bulletins page
• 31:35 - Dr. Richard Zhao Liang has relocated his blog to http://sbin.cn/blog/ because of issues accessing Wordpress.com from within China His Chinese blog is still at http://blog.zhaol.cn/
• 32:07 - Rodolfo Rosini’s company has changed its name to CellCrypt and raised $3.1M in financing
• 32:22 - Comments will be held until next week.
• 32:35 - Review of the last week's traffic on the VOIPSEC public mailing list 
• 32:51 - Wrap-up of the show 
  • Dan's going to Cairo the week of March 19th - any listeners out there?
  • Reminder that you can subscribe to the show via email as well as RSS 
• 35:54 - End of show 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

If any listeners use Digg, Blue Box could use some more digging...

In browsing Digg.com this morning, I noticed that Blue Box is listed in the Digg podcast directory, but it only has a very few "Diggs" (4 before I added my own).  If any of you are Digg users and would be so inclined to go to that page and "digg" the podcast (the count at the top for the overall podcast versus the individual episodes), we'd appreciate the votes.  If enough listeners do this, it might move Blue Box up some of the lists of podcasts (note the "Up and Coming Podcasts" sidebar) and attract additional listeners that way.  Comments are also of course welcome.  Many thanks to the folks who have already "dugg" Blue Box and are responsible for it being there in the first place.  Thanks!

Blue Box #50: Grand Central anti-SPIT initiative, Cisco and Ironport, Skype and business, VoIP security news and more

 

Synopsis: Grand Central's anti-SPIT initiative, Cisco buys Ironport, Skype targets business, other VoIP security news, listener comments and more... 

---

 

Welcome to Blue Box: The VoIP Security Podcast #50, a 26-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions. 

NOTE: This show was originally recorded January 17, 2007. 

Download the show here (MP3, 12MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now: 

---

 

Show Content:

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!  Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
• 01:13 - Programming notes
• 02:34 - Skype Security Blog: Deploying Skype in a Windows domain – and my response on VOIPSA blog
• 06:13 - Voice of VOIPSA: Voice SPAM - The Fightback begins pointing to Grand Central anti-spam page (sent in my Hasan Diwan)
• 07:48 - VoipUser: How To Build A Voip Network: 7 rules for the VoIP entrepreneur in 2007 – note my comment on security
• 10:00 - VoIPNews: VoIP Scams, Phishing, And Denial Of Service Attacks
• 11:10 - Register: Security vendors talk up VoIP threats
• 11:55 - VNUNet: Convergence brings business challenges and companion Tips for securing VoIP
• TechRepublic: Make a SIP-based VoIP network more secure
• 14:42 - CRM Buyer: Cisco Buys IronPort for $830 Million – interesting for Gartner quote at end… and also for potential for VoIP security – see also earthweb
• 17:41 - VoIPNews: Will Vonage Work for Your Business?
• 19:25 - BT announces that consumer VoIP subscribers has hit the one million mark
• 20:38 - And from the alarm department – VoIP Alarm Introduced at CES
• 21:51 - ERF Launches First Secure Wireless VoIP System for Banking Industry
• 23:16 - Sipera IPCS 310 Awarded Internet Telephony Magazine’s 2006 Product of the Year=
• 23:26 - Q1 Labs Announces New Network Security Management Capabilities for VoIP Networks
• 24:10 - Upcoming shows:
• Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007 
• Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007 
• Mar 1-2, 2007, London, EUSecWest 
• Mar 19-21, 2007, San Jose, CA, Spring 2007 VON 
• Mar 23-25, Washington, DC, ShmooCon ‘07 
• Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
• 24:51 - Comments
• 25:85 - Review of the last week's traffic on the VOIPSEC public mailing list 
• 25:31 - Wrap-up of the show 
  • Thank you to our listeners for staying with us through 50 shows
  • Reminder that you can subscribe to the show via email as well as RSS 
  • Mention of our Frappr map
• 26:39 - End of show 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.