Blue Box: The VoIP Security Podcast

Brief Break in Blue Box Schedule

Blue Box listeners - I'm on vacation this coming week and Jonathan has been travelling, so we're taking a brief break. We'll be back the week of June 25th with a regular show. We've also got some great Special Editions in the queue:

• Martin Davies has put together a great interview show about Session Border Controllers (SBCs). I think you'll definitely enjoy this one!
  
• New contributor Frank Leonhardt has an interview with some of the folks involved with Facetime about their new firewall that includes Skype management.
  
• Martyn Davies also received permission to run the audio of the panel on VoIP security that he moderated at VON Europe last week in Stockholm.

I think you should enjoy them all and I'm looking forward to making them available once I'm back from vacation.

Talk to you soon...

Update: Dan is NOT at VON Europe in Stockholm - but the Blue Box dinner will go ahead

Well, sometimes "life" intervenes in the best of plans.  As I wrote on my Disruptive Telephony blog, I will now very unfortunately NOT be attending VON Europe in Stockholm.  However, the Blue Box dinner planned for tonight will go ahead with Martyn Davies, Dean Elwood and about a dozen others.  I've already let Martyn know that I expect to get a good recorded segment out of it for inclusion in a future podcast!  :-)  

As for my Thursday panel on VoIP security that Martyn is moderating, Cullen Jennings from Cisco has agreed to step in.  Cullen is the IETF Area Director for real-time applications.. so essentially everything related to SIP rolls up to him, including VoIP security in the standards world.  I know from our many discussions that Cullen has a very strong interest in security, so the panel discussion should be quite a good one.   

I'm very disappointed that I won't be able to be there to be part of the dinner or panel, but I'm looking forward to hearing how they all go.

Blue Box #60: new VoIP security offerings from CheckPoint, VoIPShield, VoIP and business continuity, CALEA, new VoIP Security book, NAC mini-tutorial, more on botnets, listener comments and more

Synopsis: Blue Box #60: new VoIP security offerings from CheckPoint, VoIPShield, VoIP and business continuity, CALEA, new VoIP Security book, NAC mini-tutorial, more on botnets, listener comments and more

---

Welcome to Blue Box: The VoIP Security Podcast #60, a 28-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

---

Show Content:

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
• 01:15 - Programming notes
  
  • Martyn Davies will be moderating a panel on VoIP security at VON Europe that will include Dan and others
  • Blue Box dinner at the June VON show on Monday, June 11th
  • We’ve recently set up a group on the Facebook social networking site for fans of the show.  If you are a Facebook user, feel free to join.
• 02:28 - ComputerWeekly.com: Check Point promises more VoIP security, fewer slowdowns
• 03:35 - VoIPShield Security Suite Debuts…
  • VoIPShield Security Suite Debuts at Interop Las Vegas
  • Ken Camp response
  • InfoWorld
• 05:21 - PC World: Attackers Get Chatty on VoIP
• 06:37 - Skype Journal: UK: Paedophiles use Skype to find and pursue likely targets
• 07:42 - TMC.net: VoIP Helps Increase Business Continuity Awareness
• 10:10 - VoIPNews: VoIP Providers Hold Their Breath as CALEA Deadline Passes
• 12:15 - New book coming out in August: Securing VoIP Networks: Threats, Vulnerabilities and Countermeasures by Peter Thermos and Ari Takanen
• 13:38 - Voice of VOIPSA: Security: A Question of Balance
• 14:23 - Voice of VOIPSA: Google Launches Security Blog
• 14:54 - Follow-up on the Estonian botnet issue – it apparently wasn’t Russia but instead was botnet groups and Cyberattack in Estonia—what it really means
• 15:48 - SPIT Framework Internet-Draft - stay tuned for a URL
• 16:43 - News Releases:
  • Covergence Announces Support for IBM BladeCenter
• 16:54 - Feature - mini-tutorial on NAC
• 20:17 - Upcoming shows:
  
  • Dustin Trammell will be speaking at Defcon 15 about VoIP and steganography
  • Ken Camp will be moderating two panels on VoIP Security at IT Expo
  • June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have a Blue Box dinner
  • July 22-27, Chicago, USA IETF 69
  • Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
  • Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
  • Oct 29-Nov 1, Boston, USA, Fall 2007 VON
• 21:32 - comment (email) from Rhodri Davies about SIP botnets
• 23:55 - comment (email) about analog surveillance
• 25:09 - comment (blog) from Security4All
• 25:22 - comment (blog) from Ludovic Petit that he can’t see the PDF files
• 25:44 - comment (facebook) from Reuven
• 26:31 - Review of the last week's traffic on the VOIPSEC public mailing list
• 27:29 - Wrap-up of the show 
• 28:35 - End of show 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

Blue Box Dinner: Monday, June 11, Stockholm, Sweden

Given that several of us will be attending VON Europe Spring 2007, we thought it made sense to get together for a dinner in Stockholm.  So far, Martyn Davies, Dean Elwood, Miguel Garcia and a number of others will be there.  Where is it?  Currently the plan (which might change) is:

DATE:  Monday, June 11, 2007
TIME:  7:00 pm
PLACE:  TGI Fridays, Hamngatan 19, 1147 Stockholm

It is apparently less than 1km from the Central Station and the closest metro stations are T-Central (red, green and blue lines) and Kungstradgarden (blue line).

If you want to join us at the dinner, please leave a reply to this blog posting or drop us an email (blog reply preferred so that others can see).  Anyone attending the conference - or living/working/visiting in Stockholm - is welcome to attend.

Technorati tags: blue box, bluebox, voipsa, voip security

Blue Box #59: 802.1X mini-tutorial, new VoIP security vulnerabilities, new security tools, the biggest threat to VoIP? ... botnets hitting Estonia... and chimichangas and sushi trains...

Synopsis: 802.1X mini-tutorial, new VoIP security vulnerabilities, new security tools, the biggest threat to VoIP? ... botnets hitting Estonia...  and chimichangas and sushi trains...

---

Welcome to Blue Box: The VoIP Security Podcast #59, a 55-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 24MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

---

Show Content:

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
• 01:36 - Dan and Jonathan discuss recent conferences, the US DOD's JITC certification process and stray into Mexican food...
• 06:38 - Programming notes
  
  • Martyn Davies will be moderating a panel on VoIP security at VON Europe that will include Dan and others
  • Blue Box dinner at the June VON show on Monday, June 11th
  • We’ve recently set up a group on the Facebook social networking site for fans of the show.  If you are a Facebook user, feel free to join.
• 08:01 - Sipera Finds New VoIP Phone Security Threats
• 12:58 -Information Week: Security Tools Top 2007 IT Professionals Poll (VoIP drops to 3rd) – see also IT Business Edge
• 16:59 - ITP Technology: Cracking the code
• 18:25 - Network World: Security in PacketCable networks
• 20:59 - Speaking of Network World, by way of Mark Collier , we learned that Network World has a VoIP Security page
• 21:28 - VoIPPlanet: A series of ‘The VoIP Peering Puzzle’ background pieces on SBC’s
• 23:24 - Ken Camp: What’s the biggest Threat to Enterprise VoIP?
• 25:21 - CRN: VoIP Demystified
• 26:08 - TMCnet: Trends in IP Communications and the Evolution of the SBC
• 27:15 - ComputerWeekly.com: VoIP, UC adoption continue to rise
• 29:45 - Botnet attacks against Estonia:
  
  • Washington Post: Cyber Assaults on Estonia Typify a New Battle Tactic
  • CNN: Estonia suspects Kremlin in Web attacks
  • BBC: Estonia hit by ‘Moscow cyber war’
  • Global Guerrillas: Russia vs. Estonia: 21st Century State vs State conflict 
• 34:04 - News Releases:
  • General Dynamics Awarded $18 Million Contract to Deliver VoIP to the Pentagon
  • Freebird releases VoIP call recorders
• 35:27 - Feature - mini-tutorial on IP phones and 802.1X
• 40:00 - Upcoming shows:
  
  • Dustin Trammell will be speaking at Defcon 15 about VoIP and steganography
  • June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have a Blue Box dinner
  • July 22-27, Chicago, USA IETF 69
  • Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
  • Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
  • Oct 29-Nov 1, Boston, USA, Fall 2007 VON
• 42:12 - comment (email) from Phil about analog tapping of VoIP phone
• 44:28 - comment (email) from Shlomo Dubrowin
• 49:13 - Review of the last week's traffic on the VOIPSEC public mailing list
• 49:35 - Wrap-up of the show 
• 51:13 - End of show 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

Blue Box #58: The SIP Botnet edition - VoIP bots are here, now what? Also rogue firmware mini-tutorial, other VoIP security news, listener comments, more...

Synopsis: The SIP Botnet edition - VoIP bots are here, now what?  Also rogue firmware mini-tutorial, other VoIP security news, listener comments, more...

---

Welcome to Blue Box: The VoIP Security Podcast #58, a 35-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 14MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

---

Show Content:

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
• 00:53 - Programming notes
  • Dan was out in Fort Huachuca, AZ, for a US DoD telecommunications conference
  • Martyn Davies will be speaking on May 23 at the Eurosec conference in Paris (replacing Dan)
• 02:20 - Voice of VOIPSA: Ready or not, here come the IRC-controlled SIP/VoIP attack botnets
• 15:15 - Voice of VOIPSA: SIPit 20 shows the very clear need for SIP security interoperability
• 15:29 - MSN Money: Your phone may be under attack
• 16:43 - TechRepublic: Four obstacles to implementing VoIP (also Russell Shaw blog post)
• 17:31 - News Releases:
  • Borderware: The economic impact of VoIP Security Vulnerabilities and how to secure VoIP for business  (announcing new white paper)
• 18:23 - Feature - mini-tutorial on set firmware and the issue of rogue firmware loads
• 22:41 - Upcoming shows:
  
  • May 23-25, Paris, France Eurosec Forum 2007 – Martyn Davies will be speaking
  • June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have a Blue Box dinner
  • July 22-27, Chicago, USA IETF 69
  • Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
  • Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
  • Oct 29-Nov 1, Boston, USA, Fall 2007 VON
• 23:20 - comment (email) from Craig Bowser about CPEs
• 25:08 - comment (email) from Frank Leonhardt about GoogleTalk and SIP
• 25:42 - comment (email) from Simon Wood about recording hardware
• 27:14 - comment (email) from natas
• 28:51 - Review of the last week's traffic on the VOIPSEC public mailing list
• 29:21 - Wrap-up of the show 
• 30:16 - End of show 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

Facebook group for "Fans of Blue Box" now created...

If any listeners use the Facebook social networking site, I have now created a "Fans of Blue Box: The VoIP Security Podcast" group which you are welcome to join.  I have no idea, really, what we will do with the group and whether or not we'll even use it for anything at all.  Largely, I suppose, that depends upon how many people join the group.  It's all just part of our continued experimentation with "social media"... and anyone who wants to join in the experimentation is welcome to do so.

Technorati tags: blue box, facebook

Blue Box #57: Call signaling encryption mini-tutorial, VoIP eavesdropping, VoIP security news, listener comments and men in white vans...

Synopsis: Call signaling encryption mini-tutorial, VoIP eavesdropping, VoIP security news, listener comments and men in white vans...

---

Welcome to Blue Box: The VoIP Security Podcast #57, a 35-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 18MB) or subscribe to the RSS feed to download the show automatically. 

You may also listen to this podcast right now:

---

Show Content:

(Time codes were lost in a browser crash and will be added back in the future.)

• 00:20 - Intro to the show, contact information and how to provide comments.  Welcome to all the new listeners - and to all those listeners who have been here for so long!
• VoIP News: Your VoIP Calls are Wiretapped – and Other Legal Surprises
• ZD Net blogs: They CAN spy on your IP, VoIP – through walls!
• ComputerWorldUK: Virus and access protection slip down security concerns (none of execs concerned about VoIP security) – also WebWire
• IETF: New draft of media keying security requirements
• ChannelWeb: Cisco To Partners: Make Security Part Of Every Deal
• eWeek: Extreme pumps up the network
• News Releases:
  • Sipera: Transition Toward End-to-End IP Driving Demand for Enterprise Media Gateways
• Feature section on voice encryption
• Upcoming shows:
  
  • May 14-17, Santa Clara, CA, USA Communications Developer Conference
  • May 18, Rochester, NY, USA, RIT VoIP Conference
  • May 23-25, Paris, France Eurosec Forum 2007 – I am speaking
  • June 12-14, Stockholm, Sweden, VON Europe Spring – both Martyn and I will be there… we’ll have to have a Blue Box dinner
  • July 22-27, Chicago, USA IETF 69
  • Aug 20-23, San Francisco, CA, USA VoiceCon SF 2007
  • Sept 10-12, Los Angeles, CA, USA ITEXPO West 2007
  • Oct 29-Nov 1, Boston, USA, Fall 2007 VON
• comment (blog) from Zapperlink
• comment (email) from Craig Bowser about Verizon vs Vonage
• comment (email) from Ponyboy about our mention of Project Wal-Mart Freedom
• comment (email) from Reuven Lakein
• comment (email) from Roel Villerius
• Review of the last week's traffic on the VOIPSEC public mailing list
• Wrap-up of the show 
• 35:10 - End of show 

 

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to [email protected].  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

Crossing the 100,000 download mark!

Sometime this morning between about 7 and 8am Eastern US time, this podcast crossed a major milestone.... the 100,000th download occurred!   

Now in the world of "mainstream" media this is a trival number that would hardly merit attention.  But in the new and emerging medium of podcasting, I, for one, will celebrate that milestone... especially for something that is admittedly as niche of a topic as "VoIP security"!

To look at it another way, we've put out 74 shows since we started about 1.5 years ago.  That works out to an average of 1,351 downloads per show... for a show that averages 45 minutes in length!   

That there are that many folks interested in our show and topic continues to be a very humbling fact.  It's an honor for us... and a responsibility that we don't take lightly.  We know that just as easily as you have subscribed and downloaded our show, you have an amazing amount of choices out there and you can just as easily go elsewhere. 

Both Jonathan and I THANK YOU for your continued support and participation!  We have been delighted by the community of listeners and contributors that has grown up around the show and we do look forward to the continued growth of that community and to reaching many more milestones in the months and years ahead.  Thank you all.

Read on if you have interest in statistics...

---

Continue reading "Crossing the 100,000 download mark!" »

If you downloaded Blue Box #56 and wound up with a PDF file, here's why - as I noted in an "UPDATE" section at the top of the show notes to Blue Box #56, I inadvertently deleted the "enclosure" link attribute that clues podcatchers in to which media file to download.   Without an enclosure link attribute, podcatchers seem to download the last "media" file.  Normally, this might not have been a problem as we usually just link to other web pages, but because we linked later to the SAGE Journal PDF file, that file was chosen as the one to download.  (Although it still boggles my mind a bit that podcatchers couldn't be designed to download only MP3 files or others from a range of audio/video formats.

I've fixed the link and podcatcher downloads are now working, but if you wound up with a PDF file instead, you'll unfortunately need to download the audio file directly from the Blue Box #56 show notes.

If you subscribe via RSS, you may need to re-download Blue Box #56

If you downloaded Blue Box #56 and wound up with a PDF file, here's why - as I noted in an "UPDATE" section at the top of the show notes to Blue Box #56, I inadvertently deleted the "enclosure" link attribute that clues podcatchers in to which media file to download.   Without an enclosure link attribute, podcatchers seem to download the last "media" file.  Normally, this might not have been a problem as we usually just link to other web pages, but because we linked later to the SAGE Journal PDF file, that file was chosen as the one to download.  (Although it still boggles my mind a bit that podcatchers couldn't be designed to download only MP3 files or others from a range of audio/video formats.

I've fixed the link and podcatcher downloads are now working, but if you wound up with a PDF file instead, you'll unfortunately need to download the audio file directly from the Blue Box #56 show notes.