Blue Box: The VoIP Security Podcast: VoIP Security

March 14, 2007

Blue Box #54: new VoIP security tools list, teleworker FUD, Phil Zimmermann, ETel feedback, SPIT, IETF, listener comments and more...

Synopsis: new VoIP security tools list, teleworker FUD, Phil Zimmermann, ETel conference feedback, SPIT, IETF, listener comments and more...

Welcome to Blue Box: The VoIP Security Podcast #54, a 57-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 27MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long!
01:36 - Programming notes
- Brief notes about Emerging Telephony show
  - O’Reilly: ETel Coverage: VOIPSA wants VoIP to be secure!
  - ETel pictures now on flickr
  - Notes about Black Bag Security Review
- Authors of upcoming O’Reilly Asterisk Cookbook are looking for contributions related to security
- Dan will be in Cairo, Egypt, on the week of March 19th and would be delighted to meet with any listeners
- SRT episode on OpenID almost up there
- If you are a CISSP, listening to podcasts can be counted as CPE credits
10:00 - Debian: Gnomemeeting vulnerability
10:35 - Asterisk Unspecified SIP packet handling DoS – also see sparse Asterisk notes here and here
11:33 - ComputerWorld.au: Enterprises must avoid IP telephony for teleworkers or face attack and Dan’s response on VOIPSA blog - see also:
- ITWorld Canada: IP telephony potential security risk for businesses
- CSO: IP telephony Can Create Open Door for Attackers
15:56 - Silicon.com: VoIP threats to watch out for - part of Silicon.com VoIP Security Special Report – notice upcoming reports on “big three”, Skype and Best Practices
17:42 - ComputerWorld: How dangerous is Skype?
18:48 - TechNet: Infonetics Report Predicts Continued Growth for Network Security Gear Through 2007
19:35 - IT Business Edge: Security Must Be Built In From The Start – points to article about Pew Internet & American Life report ... last line of ITBusEdge entry is key… IT must be involved from the start.
21:57 - O’Reilly: VoIP encryption in a surveillance society
22:27 - Dean Takahashi: Interview with Phil Zimmermann
24:06 - xChange Online: Securing VoIP Relative to Number Mapping
24:52 - Voxilla: Getting Smart about SPIT
26:11 - Malaysia Star: Calling with confidence
26:56 - Voice of VOIPSA: New VoIP Phishing Scheme
28:36 - Voice of VOIPSA: New Hacking for Traditional Networks
29:31 - Voice of VOIPSA: Phone "Phreakers" Steal Minutes
31:38 - Voice of VOIPSA: IETF – Secure Call Recording with SIP and SRTP
32:48 - Voice of VOIPSA: Comment to Ringjacker story – important point here about older clients being around
34:27 - Mark and Dave’s book gets good reviews – read on Mark’s blog - including SearchNetworkingChannel.com- VoIP Security: Cisco Unified CallManager Quiz & Chapter – fun review in the form of a quiz.
36:04 - News releases:
- Lenovo Teams Up with Avaya To Add Secure VoIP Capability to Laptops – interesting the note about the fingerprint reader for user authentication
- SNOM TECHNOLOGY AND BORDERWARE TECHNOLOGIES ANNOUNCE STRATEGIC PARTNERSHIP TO INCREASE VOIP SECURITY
- snom technology focussing on VoIP security and interoperability at the CEBIT 2007
- TMC.net Sipera delivers VoIP Security to Enterprise Branch Offices
- Sipera and INSI Sign Agreement To Offer Secure Solutions for VoIP Services=
- Nevis Networks Enhances its Persistent LAN Security, Per-User Costs at $15
- Mu Security Demonstrates VoIP Testing, Measurement and Attack Surface Coverage Weaknesses at VoIPCON, VON
- Guidebook from Infineon exposes myths about VoIP – Voice quality and security put traditional telephony in the shade
38:48 - Feature discussion around IETF 68 coming up next week in Prague. The critical discussion of interest to this group is the RTPSEC BOF discussion around how to securely exchange keys for Secure RTP
- Draft agenda for RTPSEC BOF about SRTP key exchange
42:31 - Feature discussion about VoIP security tools:
- Heise – New version of live security distribution Backtrack which points to Backtrack which now includes a number of VoIP security tools
- Voice of VOIPSA: BackTrack Version 2: Pen-test CD unleases VoIP security tools
- new VOIPSA VoIP security tools list
- VoIP researcher to release auditing tool at Mid East Hackers’ Conference – “The Grugq” will release “TacVTK” at HackInTheBox Dubai, April 2-4
49:28 - Brief commentary on Verizon/Vonage judgement and impact on VoIP with regard to patents
51:45 - Upcoming shows:
- Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
- Mar 19-23, 2007, Prague, Czech Republic, 68th IETF Meeting
- Mar 23-25, Washington, DC, ShmooCon ‘07
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
NOTE - Jonathan will be out at VON next week - drop him a note if you are going to be there
53:37 - comment (email) from Frank Leonhardt about conference in London April 18-20
54:17 - comment (email) from Miguel Garcia
55:15 - Review of the last week's traffic on the VOIPSEC public mailing list
56:32 - Wrap-up of the show
- Reminder that you can subscribe to the show via email as well as RSS
57:16- End of show

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to [email protected]. Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows. You may also call the listener comment line at either +1-206-350-2583 or via SIP to '[email protected]' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on March 14, 2007 at 10:22 AM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: IETF, security, security tools, skype, skype security, SPIT, tools, voip, voip security, voip security tools, voipsecurity

March 13, 2007

Blue Box SE #16: ETel 2007 - The Black Bag Security Briefing with Dan York, Jonathan Zar and Shawn Merdinger

Synopsis: Emerging Telephony 2007 Workshop by Blue Box co-hosts Dan York and Jonathan Zar and security researcher Shawn Merdinger called the "Black Bag Security Briefing" covering VoIP security threats, tools and best practices.

Welcome to Blue Box: The VoIP Security Podcast Special Edition #16, a 91-minute podcast of a workshop presentation by Blue Box co-hosts Dan York and Jonathan Zar along with security researcher Shawn Merdinger called the "Black Bag Security Briefing" at O'Reilly's Emerging Telephony Conference on February 27, 2007.

Download the show here (MP3, 43MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

At O'Reilly's 2007 Emerging Telephony conference last week in San Francisco, Jonathan, Shawn Merdinger and I presented a 90-minute workshop in which we discussed the threats to VoIP security, the tools out there to test/defend your network and the best practices for securing VoIP systems. We had a great audience that also included folks like blogger/podcaster Ken Camp and IETF RAI Area Director Cullen Jennings. This is a recording of the full session including the Q&A.

Slides will be available soon.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on March 13, 2007 at 11:24 PM in Conferences, Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (1)

Tags: etel, etel2007, security, voip, voip security, voipsa, voipsecurity

March 12, 2007

Blue Box #53: Skype multiple login issue, OpenID, Cisco IP phone vulnerabilities, net neutrality, drive-by pharming, EU privacy legislation and are smokers really a threat to VoIP security?

Synopsis: Skype multiple login issue, OpenID, Cisco IP phone vulnerabilities, net neutrality, drive-by pharming, EU legislation and are smokers really a threat to VoIP security?

Welcome to Blue Box: The VoIP Security Podcast #53, a 48-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 22MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! D
01:36 - Programming notes
- Dan will be in Cairo, Egypt, on the week of March 19th and would be delighted to meet with any listeners
- Blogroll for listener blogs?
- If you happen to use the Digg website, we noticed there is a podcast directory there and Blue Box could use some more Diggs
- SRT episode on OpenID
- Blue Box #51 set a new record – no Skype security issues!
- Stay tuned for security sessions coming out of ETel
- Martyn Davies did an interview about VoipSEAL anti-spam solution
04:05 - Cisco: Cisco Unified IP Conference Station and IP Phone Vulnerabilities – also 802.1X -tons of press coverage, including Cisco IP phone flaws show vulnerabilities of ‘Vo-Fi’
10:15 - Voice of VOIPSA:IPTComm Call for Papers
11:07 - Voice of VOIPSA: Combatting Voice Spam with VOIP Seal (Martyn has also provided an interview which we will air as a Special Edition)
11:56 - Dan Wing of Cisco has introduced a new Internet Draft on Disclosing Secure RTP (SRTP) Session Keys with a SIP Event Package – critical thing we’ve been talking about
14:43 - An Internet-Draft is out on Requirements for Session Border Controllers
16:33 - Disruptive Telephony: I’ve been writing a good bit about OpenID and Dean Elwood has reponded with Why SIP doesn’t need OpenID
18:48 - Barton Hudson: A suggestion for solving the Skype multiple login issue
23:55 - eWeek: VoIP: What? Me, worry?
24:37 - Kevin Murphy summarizes a draft paper by researchers at Indiana University and Symantec in an article in Computer Business Review Online: Drive-By Pharming Attack Could Hit Home Networks -also see
25:44 - Net Neutrality is back in the news at the FCC, At the FTC and in wireless as it relates to Skype
30:43 - IT Reseller Online: Seven Tips For VoIP Security Success (requires login)
31:47 - Irwin Lazar is in a Cisco video: Cisco Techwise TV on securing unified communications (requires login)
32:34 - ComputerWorld: Smokers may be the weak IT security link (the attacker tried to get on the VoIP network)
35:06 - Feature - EU privacy legislation -IHT article on privacy
40:02 - IT Business Edge - Consumer Mobile VoIP Services: The Next Security Challenge?
40:59 - Upcoming shows:
- Mar 1-2, 2007, London, EUSecWest
- Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
- Mar 23-25, Washington, DC, ShmooCon ‘07
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
41:47 - comment (email) from Andy Zmolek about BlueBox gathering at RSA… and note that we’d be glad to publicize dinners at conferences
42:39 - comment (email) from Martyn Davies about IPTComm
42:53 - comment (email) from Bill Stackpole
44:24 - comment (blog) from Tonio
47:07 - Review of the last week's traffic on the VOIPSEC public mailing list
47:4 - Wrap-up of the show
- Dan's going to Cairo the week of March 19th - any listeners out there?
- Reminder that you can subscribe to the show via email as well as RSS
48:24- End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on March 12, 2007 at 11:06 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (1)

Tags: blue box, bluebox, cisco, openid, privacy, security, SIP, skype, skype security, spit, srtp, voip, voip security, voipsa, voipsecurity

March 06, 2007

Blue Box SE #15: ETel 2007 Black Bag Security Review - Dan York tells a story about VoIP security

Synopsis: Emerging Telephony 2007 General Session by Blue Box co-host Dan York called the "Black Bag Security Review" where Dan tells a story about VoIP security.

Welcome to Blue Box: The VoIP Security Podcast Special Edition #15, a 22-minute podcast of a general session presentation by Blue Box co-host Dan York called the "Black Bag Security Review" at O'Reilly's Emerging Telephony Conference 2007.

Download the show here (MP3, 10MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

At O'Reilly's 2007 Emerging Telephony conference last week in San Francisco, I (Dan) had the opportunity to give a 15-minute presentation to all attendees about VoIP security. Rather than doing the traditional slideware outlining the threats, tools, best practices, etc., I tried to do something very different and simply tell a story of what could happen if a VoIP system were installed in an insecure manner - and how to go about securing that system. I tried to make it interesting and humorous (something not often tied to VoIP security) and the feedback at the show was quite positive. Given that this was the first time I had presented the topic in this manner, I would very definitely appreciate comments (positive or negative) either left here on this blog entry or sent or called in to the email address and numbers below.

Because the presentation was quite different in style from others that were given (and yes, it does come in at 243 slides in just about 15 minutes!), I received a number of questions and wound up writing a bit more about the presentation over on my Disruptive Telephony blog. I included a bit about Lawrence Lessig and his impact on this presentation style.

I will include here an embedded view of the slides courtesy of SlideShare.net, although without being synced to the audio, they aren't terribly useful given that I was moving through them fast. At some point I will also include a PDF version of the slides as well.

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on March 06, 2007 at 05:34 PM in Conferences, Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (1)

Tags: black bag, blue box, bluebox, dan york, danyork, etel, etel2007, security, voip, voip security, voipsa

March 05, 2007

Blue Box #52: Skype spyware? Cisco SIP issue again, secure call recording, Phil Zimmermann on VON Magazine, US Congress and Caller ID, ringjacking, Skype security, VoIP security, listener comments and more

Synopsis: Skype spyware? Cisco SIP issue again, secure call recording, Phil Zimmermann on VON Magazine, US Congress and Caller ID, ringjacking, Skype security, VoIP security, listener comments and more

Welcome to Blue Box: The VoIP Security Podcast #52, a 45-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: This show was originally recorded February 14, 2007.

Download the show here (MP3, 21MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Discussion of bandwidth in Japan and Asia.
02:07 - Programming notes
- Podcasts by phone is back up with new number - +12183398544
- Dan will be in Cairo, Egypt, on the week of March 19th and would be delighted to meet with any listeners
- Experiment with Yahoo Pipes to make a combined feed for all VOIPSA RSS feeds
- Blogroll for listener blogs?
5:08 - Cisco Security Advisory: SIP Packets Reload IOS Devices with support for SIP – we talked about it last week but now it turns out any device with SIP support is vulnerable (not just those where it was disabled)
6:59 - Voice of VOIPSA:Skype 3.0 and BIOS
10:50 - Voice of VOIPSA: Mercury News: Will wiretapping kill P2P VoIP
13:42 - Voice of VOIPSA: Ringjacker
15:06 - Voice of VOIPSA: Truth in Caller ID Act of 2007
16:48 - SC Magazine: How to protect your business from VoIP threats
17:17 - Australian IT: VoIP threat as crims seek out soft targets
18:18 - thestar (Malaysia): Getting high quality VoIP for your company
18:42 - ComputerWorld: FaceTime, Skype team on enterprise policy enforcement – also Skype blog: Skype partners with Facetime to make Enterprise control even easier and WindowsITPro: Skype teams with Symantec and Facetime
21:35 - CBC: VoIP phones disrupting some security alarm systems
24:20 - VON Magazine Cover Story on Phil Zimmermann – good background if you are not up on Zfone
26:53 - Aswath: Extending OpenID Authentication Scheme for Communication Systems
28:31 - Press Releases:

Sipera Adds Worldwide Sales and Service Provider Expertise to Management Team=

VoIP Logic Announces the Integration of Iperia and Covergence IP Applications into Its ’’Best of Breed’’ Class 5 Platform (a service provider talking about security!)

BorderWare Delivers New Class of SBCs – also at TMC.net

Security for VoIP on Sun hardware

29:52 - Quick update on Best Practices project
30:29 - Upcoming shows:
- Mar 1-2, 2007, London, EUSecWest
- Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
- Mar 23-25, Washington, DC, ShmooCon ‘07
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
31:36 - comment (email) from Martyn Davies about 3GSM conference
32:26 - comment (email) from Simon Wood
33:23 - comment (email) from Keith about feed
33:53 - comment (email) from Anthony Congdon about SRTP and recording
40:33 - comment (email) from Peter Thermos about vopsecurity.org
41:01 - comment (email) from Michael Miller
41:35 - comment (email) from Mark Noble about NEC SPIT
41:47 - thanks out to Craig Bowser and Rhodri Davies
42:19 - comment (email) from Dean Elwood about video with AT&T companies
44:11 - Review of the last week's traffic on the VOIPSEC public mailing list
44:33 - Wrap-up of the show
- Dan's going to Cairo the week of March 19th - any listeners out there?
- Reminder that you can subscribe to the show via email as well as RSS
45:18 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on March 05, 2007 at 03:28 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: cisco, secure call recording, security, skype, skype security, voip, voip security, voipsa, voipsecurity

February 22, 2007

Blue Box #51: Cisco SIP vulnerabilities, VoIP security hype, SPIT, OpenID, other VoIP security news and more...

Synopsis: Cisco SIP security vulnerabilities, VoIP security hype, SPIT, OpenID, other VoIP security news and more...

Welcome to Blue Box: The VoIP Security Podcast #51, a 35-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: This show was originally recorded February 7, 2007.

Download the show here (MP3, 16MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Discussion of bandwidth in Japan and Asia.
03:13 - Programming notes
- Podcasts by phone is back up with new number - +12183398544
3:53 - Cisco Security Advisory: SIP Packet Reloads IOS Devices Not Configured for SIP – note also that Cisco is now using CVSS as mentioned in their (Cisco) FAQ
06:33 - Multiple VOIP Phones Aredfox PA168 Chipset Session Hijacking Vulnerability
09:26 - InfoWorld NL: Hype versus reality in VoIP security
13:37 - ITWire: NEC’s VoIP spam detector turns Turing Test on its head and also Engadget: NEC invents 99 percent effective SPIT catcher and also ZDNet: VoIP spam tipped to rocket
16:49 - IIS Zone: What To Do When SPIT Hits The Fan (sponsored by Verisign)
18:59 - Network World: Expert: Phishing and other social attacks threaten VoIP (Dave Endler)
20:23 - CommsDesign: VoIP security: Scenarios, challenges, and counter measures—Part I
21:11 - CompTIA: Concerns Over IP Telephony Security Still Present in SMB Market, CompTIA Study Reveals – see also vnunet article and techtarget (sent in by Rhodri Davies)
23:49 - Aswath: Extending OpenID Authentication Scheme for Communication Systems
- Comment from Shlomo Dubrowin about OpenID
29:09 - darkreading: FBI Faces Fresh Cyber Threats
29:36 - CRN: CRN Poll: No concerns around VoIP adoption (sample size?)
30:06 - Press Releases
- Postini Annual Communications Intelligence Report Shows Security and Compliance Top Communications Professionals’ Concerns=
- Sipera boots VoIP Security
- Eyeball Intros AnyFirewall Engine (sent in by Craig Bowser)
- SONUS NETWORKS OFFERS NETWORK OPERATORS ENHANCED SECURITY WITH LATEST RELEASE OF NETWORK BORDER SWITCH
- Secure Computing Introduces Sidewinder 7.0, Industry’s First Reputation-based Firewall
- Info Security Products Guide Awards Covergence the ’’Hot Companies’’ Recognition for 2007
31:18 - Hudson Barton has a new blog Borderless Communications with a VoIP Security Bulletins page
31:35 - Dr. Richard Zhao Liang has relocated his blog to http://sbin.cn/blog/ because of issues accessing Wordpress.com from within China His Chinese blog is still at http://blog.zhaol.cn/
32:07 - Rodolfo Rosini’s company has changed its name to CellCrypt and raised $3.1M in financing
32:22 - Comments will be held until next week.
32:35 - Review of the last week's traffic on the VOIPSEC public mailing list
32:51 - Wrap-up of the show
- Dan's going to Cairo the week of March 19th - any listeners out there?
- Reminder that you can subscribe to the show via email as well as RSS
35:54 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on February 22, 2007 at 11:35 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (0)

Tags: blue box, bluebox, cisco, comptia, NEC, openid, SPIT, voip, voip security

February 14, 2007

Blue Box #50: Grand Central anti-SPIT initiative, Cisco and Ironport, Skype and business, VoIP security news and more

Synopsis: Grand Central's anti-SPIT initiative, Cisco buys Ironport, Skype targets business, other VoIP security news, listener comments and more...

Welcome to Blue Box: The VoIP Security Podcast #50, a 26-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: This show was originally recorded January 17, 2007.

Download the show here (MP3, 12MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
01:13 - Programming notes
02:34 - Skype Security Blog: Deploying Skype in a Windows domain – and my response on VOIPSA blog
06:13 - Voice of VOIPSA: Voice SPAM - The Fightback begins pointing to Grand Central anti-spam page (sent in my Hasan Diwan)
07:48 - VoipUser: How To Build A Voip Network: 7 rules for the VoIP entrepreneur in 2007 – note my comment on security
10:00 - VoIPNews: VoIP Scams, Phishing, And Denial Of Service Attacks
11:10 - Register: Security vendors talk up VoIP threats
11:55 - VNUNet: Convergence brings business challenges and companion Tips for securing VoIP
TechRepublic: Make a SIP-based VoIP network more secure
14:42 - CRM Buyer: Cisco Buys IronPort for $830 Million – interesting for Gartner quote at end… and also for potential for VoIP security – see also earthweb
17:41 - VoIPNews: Will Vonage Work for Your Business?
19:25 - BT announces that consumer VoIP subscribers has hit the one million mark
20:38 - And from the alarm department – VoIP Alarm Introduced at CES
21:51 - ERF Launches First Secure Wireless VoIP System for Banking Industry
23:16 - Sipera IPCS 310 Awarded Internet Telephony Magazine’s 2006 Product of the Year=
23:26 - Q1 Labs Announces New Network Security Management Capabilities for VoIP Networks
24:10 - Upcoming shows:

Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
Mar 1-2, 2007, London, EUSecWest
Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
Mar 23-25, Washington, DC, ShmooCon ‘07
Apr 16-20, Vancouver, BC, Canada CanSecWest 2006

24:51 - Comments
25:85 - Review of the last week's traffic on the VOIPSEC public mailing list
25:31 - Wrap-up of the show
- Thank you to our listeners for staying with us through 50 shows
- Reminder that you can subscribe to the show via email as well as RSS
- Mention of our Frappr map
26:39 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on February 14, 2007 at 05:21 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (0)

Tags: blue box, bluebox, cisco, grand central, ironport, security, SIP, skype, skype security, SPIT, voip, voip security, voipsa

January 29, 2007

Blue Box #49: SPIT, Skype security, disposable phone numbers, phishing, VoIP security news, listener comments and more

Synopsis: SPIT, Skype security, disposable phone numbers, phishing, VoIP security news, listener comments and more...

Welcome to Blue Box: The VoIP Security Podcast #49, a 55-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: This show was originally recorded January 5, 2007, and was delayed with production issues.

Download the show here (MP3, 23MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:21 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
03:12 - Programming notes:
- Audio issues with #48 – writing to USB drive
- Dan contributed to Still Secure, After All These Years, Podcast #26 which was a roundup of opinions on security issues from a range of folks
- Show #50 is next week
04:37 - VoIP News: How Secure Are Your VoIP Calls – and my response
06:07 - Note that Mark Collier has revamped the design of his VoIP Security Blog
06:38 - CSO: Security in 2007: Botnets, Threat Convergence and Other Risks – note their casual mention of SPIT and “thousands of messages” – wonder where they got their data from?
09:28 - ZDNet: What threats does Skype face? – interview with Skype CSO Kurt Sauer – also Jan Geirnaert’s response
15:08 - Jan: How to use the Skype and P2P traffic blocker? Tapping into Skype Traffic with the traffictapper from Lyanda.
16:14 - Dark Reading: Voice Cracks
18:17 - IT Observer: Voice over IP Under Threat – which was slashdotted
20:31 - TechWeb: Phishers’ Latest Platforms: VoIP, SMS
21:11 - EnterpriseITPlanet: The Year in Instant Messaging
26:28 - Voice of Voipsa: (just quick mentions – we forgot these last week)
- Martyn: Securing the WLAN Link
- Shawn: Skype 3.0 – Your new Romulan phone
- Martyn: Tell Me Your PIN, So I Can Go Shopping
- Dustin: Skype, an Essential Tool for Interrogation (also RealGeek )
29:56 - Websense ‘Skype’ Trojan Analysis – followup to our story last week… not VoIP per se but an interesting analysis
32:05 - The PhoneBoy Blog: Eating My Words on OpenID
34:18 - Zycko: VoIP Security priority for 2007
34:50 - Network World: The year ahead: Juggling IT risks, opportunities
35:08 - Upcoming shows:
- Jan 23-26, 2007, Ft. Lauderdale, FL, Internet Telephony Conference and Expo – East
- Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
- Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
- Mar 1-2, 2007, London, EUSecWest
- Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
- Mar 23-25, Washington, DC, ShmooCon ‘07
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
35:48 - Comment (audio) about Minnesota Asterisk user group
37:36 - Comment (blog) from Aswath Rao
39:58 - Comment (blog) from Mark Collier
40:07 - Comment (email) from Martyn Davies about ISS report
40:34 - Comments-3 (email) from Craig
41:52 - Comment (email) from Dave Roper pointing to Disposable Phone Numbers - discussion included Jangl, Private Phone and Craigsnumber
48:02 - Comment (email) from Rick McCharles
51:32 - Review of the last week's traffic on the VOIPSEC public mailing list
52:08 - Wrap-up of the show
- Reminder that you can subscribe to the show via email as well as RSS
- Mention of our Frappr map
54:38 - End of show

Thank you for listening and please do let us know what you think of the show.

Technorati tags: voip security, voip, voipsa, skype, skype security, phishing, SPIT, security

Posted by Dan York on January 29, 2007 at 09:01 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (1) | TrackBack (0)

January 03, 2007

Blue Box #48: The Crystal Ball Edition - Top VoIP Security issues of 2006 and predictions for 2007, Skype worm that wasn't, drive-by SPIT, OpenID, poking holes in firewalls, listener comments and more...

Synopsis: The Crystal Ball Edition - Top VoIP Security issues of 2006 and predictions for 2007, Skype worm that wasn't, drive-by SPIT, OpenID for SIP authentication, poking holes in firewalls, listener comments and more...

Welcome to Blue Box: The VoIP Security Podcast #48, a 50-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

NOTE: For the first time in many shows we had an issue with the recording of the show that introduced gaps and other audio artifacts. Unfortunately, I was not running my backup recorder and schedules (and holidays) made a retake impractical. So my apologies... and if you are new to the show, please don't judge the show by the audio quality of this particular show.

Download the show here (MP3, 23MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:21 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
01:50 - Programming notes:
- sending in ident audio files
- Dan has launched a new blog - Disruptive Telephony
- Dan was interviewed by Jon Arnold about VoIP Security for his podcast series
04:08 - CNET: Confusion over Skype security threat clears up – all sorts of reports originating from the Websense blog entry – other links: CBC ComputerWorld TechWorld SC: Hackers unleash worm that targets Skype Heise Online – also Earthtimes gets it right
06:31 - DarkReading: VoIP More Vulnerable
09:09 - McGraw-Hill press release about Hacking Exposed: VoIP and also CRN: VoIP Risks Take Center Stage in 2007
09:49 - CNS: Telecom execs conclude enterprise security products insufficient for carrier networks
11:14 - Xchange Online: Survey: Security a Concern in Product Rollouts
12:44 - Heise Security: The hole trick: How Skype & Co. get round firewalls (tip to 21talks )
13:26 - Network Magazine (India): Voice over IP: Security issues to the fore
15:50 - Aswath Rao: There is No Money in the Authentication Business with some reaction, particularly from PhoneBoy Kveton and Alec Saunders
20:51 - ITBusiness.ca: The pros and cons of having a contractor do security
22:22 - VoIP News: Building VoIP Security at the Gateway Level – part of a special on VoIP Gateways
23:47 - Greatreporter.com: Hackers ‘can eavesdrop on 70% of web calls’
24:44 - LinuxDevices: Belkin WiFi Skype phone based on Linux
26:04 - Oral Health & Dental Practice Management: Technology in Tomorrow’s Dental Office
27:21 -Bluesocket Achieves VoIP Vocera Certifications
28:42 - Feature - Top VoIP security stories from 2006 and predictions for 2007. Some links mentioned in the discussion:
- RSA Speaking of Security Podcast #42 about phishing war story
- vnunet.com’s IT security predictions for 2007
- BCS: MessageLabs: Targeted security attacks to soar in 2007 (also in SC )
46:23 - Upcoming shows:
- Jan 23-26, 2007, Ft. Lauderdale, FL, Internet Telephony Conference and Expo – East
- Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
- Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
- Mar 1-2, 2007, London, EUSecWest
- Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
- Mar 23-25, Washington, DC, ShmooCon ‘07
- Apr 16-20, Vancouver, BC, Canada CanSecWest 2006
47:26 - Review of the last week's traffic on the VOIPSEC public mailing list
48:04 - No comments other than Aswath's note about OpenID that we covered earlier.
48:45 - Wrap-up of the show
- Reminder that you can subscribe to the show via email as well as RSS
- Mention of our Frappr map
50:11 - End of show

Thank you for listening and please do let us know what you think of the show.

Posted by Dan York on January 03, 2007 at 07:20 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (0) | TrackBack (1)

Tags: hacking voip, openid, security, skype, skype security, voip, voip security, voipsa

December 20, 2006

Blue Box #47: Deflating VoIP security hype, SANS and the need for better VoIP security training, India moves to block Skype and other VoIP, Skype security, tutorials, listener comments and more...

Synopsis: Deflating VoIP security hype, SANS and the need for better VoIP security training, India moves to block Skype and other VoIP, Skype security, tutorials, listener comments and more...

Welcome to Blue Box: The VoIP Security Podcast #47, a 69-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 32MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

00:20 - Intro to the show, contact information and how to provide comments. Welcome to all the new listeners - and to all those listeners who have been here for so long! Special welcome to readers who found us through the new Hacking Exposed: VoIP book that was just recently released.
02:20 - Programming notes:
- sending in ident audio files
- SanDisk Cruzer disks (with U3 software)
- Blue Box dinner - photo by Martyn Davies
- Security Podcast Network
- SE #14- Interview with Ken Camp
09:19 - VoIP News: Voip Security ‘Best Practices’ Project Launches
09:41 - Voice of VOIPSA: The Register – Open Season for hackers
11:08 - SearchSecurity.com: Better VoIP training needed, SANS director says – see also Eric Chamberlin at Voxilla: VoIP Security: Stop Everything – also launched a VoIP security forum
18:30 - Economic Times (India): Illegal Web calls by BPOs face axe – see also 21Talks: India outlaws Skype, Yahoo and others
22:13 - British Computer Society: Skype – How safe is it? (sent in by both Martyn Davies and Rhodri Davies)
24:01 - Electronic Engineering Times: IP phone providers must focus on security, says report pointing to In-Stat report – VoIP Security: Preparing for the Evolving Threat – it can be yours for only $2,995 – see also In-Stat press release: Business VoIP Users Must Focus on Security
27:28 - b5media: Interview with PGP founder Phil Zimmermann: Zfone, secure VoIP media encryption software
29:41 - eWeek: Outlook 2007:VoIP
31:22 - The Age (Australia): Hackers ‘to target VoIP users’
32:39 - Greatreporter.com: VoIP wiretapping widespread, warns Scanit
34:16 - TMC.net: SPIT: Bringing Spam to Your Voicemail Box (by Bogdan Materna)
37:18 - Image and Data Manager (Australia): IM and VoIP Still Not On Security Radar
38:17 - InfoWorld ZeroDaySecurity Blog: Is social engineering always used to commit fraud?
45:16 - ZDNet UK: Weigh the pros and cons of VoIP over wireless
45:42 - Voice of VOIPSA: Security through Obscurity by Martyn Davies about the conf he attended
46:09 - Voice of VOIPSA: Cell phones, GPS location and Amber Alerts by Shawn Merdinger
47:28 - Voice of VOIPSA: IronGeek Hacking Tutorial Videos by Shawn Merdinger
48:32 - Enterprise VoIPPlanet: The VoIP Peering Puzzle: The IETF SPEERMINT Architecture
Dialogic Expands IP Media Gateway Product Line (Martyn Davies works there… note the VoIP security mention later in the release)
51:24 - comment (audio) from “the man from California” about Click-to-Call
54:01 - comment (email) from Shawn Merdinger about Click-to-Call
56:20 - comment (email) from Raul Siles (just about BP project)
57:06 - comment (email) from Yiannis Miliaresis about podcast in Greece and iptelephony.gr
58:27 - comment (email) from Julien Goodwin about CBR article
58:57 - comment (email) from Alan Garwood about mini-poll on Infosecurity Europe web page
60:16 - comment (email) from Shlomo Dubrowin about BP project
61:19 - comment (blog) from Mark Collier
62:29 - comment (email) from Frank Leonhart about BBP dinner
63:29 - comment (email) from Mike Bailey asking a question about Skype installation
64:20 - comment (email) from Dion Rowney about recorder
67:30 - Review of the last week's traffic on the VOIPSEC public mailing list
68:23 - Wrap-up of the show
- Reminder that you can subscribe to the show via email as well as RSS
- Mention of our Frappr map
69:49 - End of show

Thank you for listening and please do let us know what you think of the show.

P.S. We didn't mention the "upcoming shows", but here is the list we have been maintaining:

Jan 23-26, 2007, Ft. Lauderdale, FL, Internet Telephony Conference and Expo – East
Feb 5-9, 2007, San Francisco, CA, RSA Conference 2007
Feb 27-Mar 1, 2007, San Francisco, Emerging Telephony 2007
Mar 1-2, 2007, London, EUSecWest
Mar 19-21, 2007, San Jose, CA, Spring 2007 VON
Mar 23-25, Washington, DC, ShmooCon ‘07
Apr 16-20, Vancouver, BC, Canada CanSecWest 2006

Posted by Dan York on December 20, 2006 at 03:41 PM in Podcasts, VoIP Security, VOIPSA | Permalink | Comments (2) | TrackBack (2)

Tags: blue box, bluebox, india, SANS, security, skype, skype security, voip, voip security, voipsa, voipsecurity

Blue Box: The VoIP Security Podcast

A podcast offering news, views and commentary on security issues for Voice Over IP(VoIP), Unified Communications (UC) and IP Telephony

March 14, 2007

Blue Box #54: new VoIP security tools list, teleworker FUD, Phil Zimmermann, ETel feedback, SPIT, IETF, listener comments and more...

March 13, 2007

Blue Box SE #16: ETel 2007 - The Black Bag Security Briefing with Dan York, Jonathan Zar and Shawn Merdinger

March 12, 2007

Blue Box #53: Skype multiple login issue, OpenID, Cisco IP phone vulnerabilities, net neutrality, drive-by pharming, EU privacy legislation and are smokers really a threat to VoIP security?

March 06, 2007

Blue Box SE #15: ETel 2007 Black Bag Security Review - Dan York tells a story about VoIP security

March 05, 2007

Blue Box #52: Skype spyware? Cisco SIP issue again, secure call recording, Phil Zimmermann on VON Magazine, US Congress and Caller ID, ringjacking, Skype security, VoIP security, listener comments and more

February 22, 2007

Blue Box #51: Cisco SIP vulnerabilities, VoIP security hype, SPIT, OpenID, other VoIP security news and more...

February 14, 2007

Blue Box #50: Grand Central anti-SPIT initiative, Cisco and Ironport, Skype and business, VoIP security news and more

January 29, 2007

Blue Box #49: SPIT, Skype security, disposable phone numbers, phishing, VoIP security news, listener comments and more

January 03, 2007

Blue Box #48: The Crystal Ball Edition - Top VoIP Security issues of 2006 and predictions for 2007, Skype worm that wasn't, drive-by SPIT, OpenID, poking holes in firewalls, listener comments and more...

December 20, 2006

Blue Box #47: Deflating VoIP security hype, SANS and the need for better VoIP security training, India moves to block Skype and other VoIP, Skype security, tutorials, listener comments and more...

The Obligatory Photo

Contact Information

License

Full Disclosure

Why "Blue Box"?

Archives

Categories

Search

Promote Blue Box!

Recent Posts

Recent Comments

VoIP Security Books