Blue Box: The VoIP Security Podcast:

Crossing the 100,000 download mark!

Sometime this morning between about 7 and 8am Eastern US time, this podcast crossed a major milestone.... the 100,000th download occurred!

Now in the world of "mainstream" media this is a trival number that would hardly merit attention. But in the new and emerging medium of podcasting, I, for one, will celebrate that milestone... especially for something that is admittedly as niche of a topic as "VoIP security"!

To look at it another way, we've put out 74 shows since we started about 1.5 years ago. That works out to an average of 1,351 downloads per show... for a show that averages 45 minutes in length!

That there are that many folks interested in our show and topic continues to be a very humbling fact. It's an honor for us... and a responsibility that we don't take lightly. We know that just as easily as you have subscribed and downloaded our show, you have an amazing amount of choices out there and you can just as easily go elsewhere.

Both Jonathan and I THANK YOU for your continued support and participation! We have been delighted by the community of listeners and contributors that has grown up around the show and we do look forward to the continued growth of that community and to reaching many more milestones in the months and years ahead. Thank you all.

Read on if you have interest in statistics...

Continue reading "Crossing the 100,000 download mark!" »

Posted by Dan York on April 24, 2007 at 10:07 AM in Administrivia | Permalink | Comments (0) | TrackBack (0)

If you subscribe via RSS, you may need to re-download Blue Box #56

If you downloaded Blue Box #56 and wound up with a PDF file, here's why - as I noted in an "UPDATE" section at the top of the show notes to Blue Box #56, I inadvertently deleted the "enclosure" link attribute that clues podcatchers in to which media file to download. Without an enclosure link attribute, podcatchers seem to download the last "media" file. Normally, this might not have been a problem as we usually just link to other web pages, but because we linked later to the SAGE Journal PDF file, that file was chosen as the one to download. (Although it still boggles my mind a bit that podcatchers couldn't be designed to download only MP3 files or others from a range of audio/video formats.

I've fixed the link and podcatcher downloads are now working, but if you wound up with a PDF file instead, you'll unfortunately need to download the audio file directly from the Blue Box #56 show notes.

Posted by Dan York on April 24, 2007 at 10:00 AM in Administrivia | Permalink | Comments (0) | TrackBack (0)

April 23, 2007

Blue Box #56 - Voice encryption tutorial, Skype worm, McAfee's Sage Journal, Zfone, VoIP security news, listener comments and more...

Synopsis: Voice encryption tutorial, Skype worm, McAfee's Sage Journal, Zfone, VoIP security news, listener comments and more...

UPDATE - April 24: Unfortunately, due to an error in coding the appropriate enclosure (now fixed) many of you who subscribe via RSS will have downloaded a PDF file instead of the MP3 file. My apologies, and you'll need to unfortunately download the file directly from the website at this point.

Welcome to Blue Box: The VoIP Security Podcast #56, a 38-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 18MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
01:24 - New worm wriggles around on Skype (also on CSO Online ) - See also F-Secure blog and Jan Geirnaert
03:06 - Voice of VOIPSA: Ghosts of VoIP Security Tools Past…and Future? (note the comment in reply from the grugq)
04:41 - McAfee’s Sage Journal and their Global Threat Review (and the mention of VoIP)
- McAfee news release
- McAfee Sage Journal (PDF)
- InfoWorld: McAfee: Cyber-crime will continue to pay
- CNET/ZDNet: McAfee offers ‘Sage’ advice on security issues
- Tech.co.uk: Cybercrims will ‘find new ways to make money’
- Khaleej Times (UAE): Cybercrime, other security issues will increase=
- also interesting to note that McAfee Avert Labs has a blog

08:00 - Information Week: VoIP Too Complicated? Tell That To The Cable Companies
11:02 - TechRepublic: PKI vs. Zfone: What’s your best bet for VoIP security?
12:07 - SC Magazine: Mobile security: when will it become necessary?
13:04 - ComputerWorld Malaysia: All-in-one security devices face hurdles – interesting for the mention of “Unified Threat Management” (UTM) and the growing concern about how to work with VoIP (expressed in final paragraph)
17:04 - Security Watch by Steve Gold: VoIP – a flawed technology?
19:47 - News releases:
22:23 - Feature section on voice encryption
31:53 - Upcoming shows:
- May 14-17, Santa Clara, CA, USA Communications Developer Conference
- May 18, Rochester, NY, USA, RIT VoIP Conference
- May 23-25, Paris, France Eurosec Forum 2007 – I am speaking
- June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have to have a Blue Box dinner
- July 22-27, Chicago, USA IETF 69
- Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
- Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
- Oct 29-Nov 1, Boston, USA, Fall 2007 VON
33:25 - comment (email) from Aswath Rao
35:25 - comment (email) from Craig Bowser
35:47 - comment (blog) from Amit about VoIP SEAL PDF files
36:33 - Review of the last week's traffic on the VOIPSEC public mailing list
37:02 - Wrap-up of the show
38:14 - End of show

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to [email protected]. Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows. You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on April 23, 2007 at 10:41 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: dan york, jonathan zar, mcafee, security, skype, skype security, voice encryption, voip, voip security, voipsa, voipsecurity, zfone

If any listeners will be at InfoSec 2007 in London this week, Martyn and Frank will be there...

If any Blue Box listeners are going to be at the InfoSec 2007 conference this week in London, Frank Leonhardt will be there on Wednesday and Martyn Davies will be there on Thursday. If you would like to connect with either Frank or Martyn, leave a message here and we'll be sure they get it.

Posted by Dan York on April 23, 2007 at 10:29 AM in Conferences | Permalink | Comments (0) | TrackBack (0)

Tags: infosec, martyn davies, voip security

April 12, 2007

Blue Box #55: IP phone security vulnerabilities, SIP fuzzing, Phil Zimmermann, ZRTP and IETF, Skype security, listener comments and a brief final commentary about visiting the pyramids in Egypt

Synopsis: IP phone security vulnerabilities, SIP fuzzing, Phil Zimmermann, ZRTP and IETF, Skype security, listener comments and a brief final commentary about visiting the pyramids in Egypt

Welcome to Blue Box: The VoIP Security Podcast #55, a 78-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 36MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
01:29 - Programming notes
- Apologies for lengthy delay
- Hope you enjoyed Blue Box Special Edition #17 with Saverio Niccolini
- Jonathan's IPTV session at Spring VON
- Brief note about Dan's trip to Cairo (more at the end of the show)
- Blogroll for “Blue Box Friends” – send in email with answer to question “What is Dan’s #1 prediction for what’s going to happen in VoIP security this year?”
- If you are a CISSP, listening to podcasts can be counted as CPE credits
- Voice of VOIPSA and Blue Box part of Security Bloggers Network
11:39 - RIT VoIP Conference – Rochester, NY, May 18th – looking for papers
12:30 - SIP fuzzing vulnerabilities from the Madynes project

Cisco 7940/7960 DoS
Grandstream Budgetone 200 DoS (note that vendor did not respond to researchers)
Asterisk SDP DoS - and then also proof-Of-Concept code for Asterisk vulnerability
Thinking about "patch management plans for phones"?

17:49 - Network World: Trojan calls on Skype
18:28 - Shawn Merdinger starts blogging his "Top 10" list of questions to ask your vendor about VoIP security (part 3 presumably coming soon):
- Voice of VOIPSA: Pucker up – Intimate VoIP Phone Security Questions – part 1 of 3
- Voice of VOIPSA: Pucker up - Intimate VoIP Phone Security Questions - part 2 of 3
22:08 - Silicon.com Special report on VoIP Security
- The biggest VoIP security threats – and how to stop them
- Is Skype secure enough for businesses?
- The dos and don’ts of VOIP security
25:29 - VoIP News: Pretty Good (VoIP) Privacy
26:10 - VoIP News: CounterPath Gets Pretty Good Privacy with ZFone
28:13 - Voice of VOIPSA: Skype with a ‘Z’
30:10 - Voice of VOIPSA: Cracking the WLAN
Voice of VOIPSA: Ghosts of VoIP Security Tools Past…and Future? (note the comment in reply from the grugq)
31:01 - Aswath Rao: OpenID Negates the Need for P2P SIP
33:17 - PC Advisor: Take care of your smartphone’s security
- comment (email) from Shawn about FlexiSpy
- mention of EE Times: Getting a lock on RTOS security
36:42 - IETF: VoIP Security Threats relevant to SPEERMINT (sent in by Shawn)
38:12 - Mention of IETF BLISS working group
39:14 - Mitel Presence: Using IP Communications as a Tool For Disaster Recovery and Business Continuity
40:17 - Sipera's new VoIP Threat Advisories
41:54 - News releases:
- Amitelo AG Presents AmiVois, Competitor to Skype
43:56 - Feature discussion around the IETF 68 RTPSEC BOF that occurred in Prague about secure key exchange protocols for Secure RTP (SRTP) (with the caveat that neither of us were there)
- comment (email) from Miguel Garcia
- Voice of VOIPSA: SRTP key exchange – minutes of IETF RTPSEC BOF now posted pointing to RTPSEC minutes
53:20 - Brief mention of VOIPSA Best Practices project.
54:08 - Upcoming shows:
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
- May 14-17, Santa Clara, CA, USA Communications Developer Conference
- May 18, Rochester, NY, USA, RIT VoIP Conference
- May 23-25, Paris, France Eurosec Forum 2007 – I am speaking
- June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have to have a Blue Box dinner
- July 22-27, Chicago, USA IETF 69
- Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
- Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
- Oct 29-Nov 1, Boston, USA, Fall 2007 VON
54:20 - comment (audio) from Hasan Diwan about adding his blog, Prolific Programmer to the Blue Box blogroll
56:34 - comment (email) from Detlef
57:18 - comment (email) from Mark Collier about ETel story
57:49 - comment (email) from Dean Elwood about biometrics for identity authentication
58:49 - comment (email) from Shawn Merdinger about http://oldskoolphreak.com/tfiles/pwf.txt
59:41 - comment (email) from Shawn about Hitchhiker’s Guide to SIP
61:28 - comment (email) from Martyn Davies about OpenID
64:24 -comment (email) from Seth about adding a Podnova subscription button
64:39 - comment (email) from Roland about RSS feed not validating
64:52 - comment (email) from Martyn Davies about SE16 and removing the hum
66:05 - Review of the last week's traffic on the VOIPSEC public mailing list
67:16 - Wrap-up of the show
- A bit of a travelogue about Dan's trip to Cairo, Egypt, and his impressions of the pyramids, Cairo, etc.
78:05 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on April 12, 2007 at 02:18 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (0)

Tags: amitelo, asterisk, blue box, bluebox, cisco, dan york, dtls, ietf, ip telephony, jonathan zar, mitel, phil zimmermann, security, SIP, skype, srtp, voice over IP, voip, voip security, voipsa, voipsecurity, zfone, zrtp

April 02, 2007

Blue Box SE #17: Interview with Saverio Niccolini from NEC about efforts to combat SPIT

Synopsis: Interview with Saverio Niccolini from NEC about efforts to combat SPIT.

Welcome to Blue Box: The VoIP Security Podcast Special Edition #17, a 9-minute podcast of an interview by Martyn Davies of Saverio Niccolini from NEC about efforts to combat Spam-for-Internet-Telephony (SPIT). The interview took place at the 3GSM World Congress 2007 held February 12-15, 2007, in Barcelona, Spain.

Download the show here (MP3, 4MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

At the 3GSM World Congress 2007, Blue Box contributor Martyn Davies had a chance to record an interview with Saverio Niccolini about NEC's efforts to combat Spam for Internet Telephony (SPIT). Specifically, they discussed NEC's new program VOIPSEAL, the prototype of which was unveiled at the 3GSM conference. Saverio is a Senior Research Staff Member in the Network Laboratories at NEC (www.netlab.nec.de)