VoIP Intrusion Detection Through Interacting Protocol State Machines

Sengar, Hemant; Wijesekera, Duminda; Wang, Haining; Jajodia, Sushil

doi:10.1109/dsn.2006.73

Cited by 82 publications

(51 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Wu et al [25] and Sengar et al [18] presented using state information and cross-protocol correlation to detect denial-of-service attacks on VoIP. Sengar et al [19] detailed a VoIP intrusion detection based interactive protocol state machine. Deng and Shore [2] proposed using nonces to protect the SIP servers from flooding attacks.…”

Section: Related Workmentioning

confidence: 99%

Disabling a Computer by Exploiting Softphone Vulnerabilities: Threat and Mitigation

Farley

Wang

2013

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

Abstract. As more and more people are using VoIP softphones in their laptop and smart phones, vulnerabilities in VoIP protocols and systems could introduce new threats to the computer that runs the VoIP softphone. In this paper, we investigate the security ramifications that VoIP softphones expose their host to and ways to mitigate such threats. We show that crafted SIP traffic (noisy attack) can disable a Windows XP host that runs the official Vonage VoIP softphone within several minutes. While such a noisy attack can be effectively mitigated by threshold based filtering, we show that a stealthy attack could defeat the threshold based filtering and disable the targeted computer silently without ever ringing the targeted softphone. To mitigate the stealthy attack, we have developed a limited context aware (LCA) filtering that leverages the context and SIP protocol information to ascertain the intentions of a SIP message on behalf of the client. Our experiments show that LCA filtering can effectively defeat the stealthy attack while allowing legitimate VoIP calls to go through.

show abstract

Section: Related Workmentioning

confidence: 99%

Disabling a Computer by Exploiting Softphone Vulnerabilities: Threat and Mitigation

Farley

Wang

2013

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

show abstract

“…Sengar et al [253], [254], [255] examine the problem of cross-infrastructure vulnerabilities created by bridging VoIP and PSTN networks. They outline a high-level architecture that integrates firewall-like functionality with trust management, signaling encryption and authentication, and intrusion detection.…”

Section: ) Authentication Protocols (15 Items)mentioning

confidence: 99%

A Comprehensive Survey of Voice over IP Security Research

Keromytis

2012

IEEE Commun. Surv. Tutorials

116

View full text Add to dashboard Cite

Abstract-We present a comprehensive survey of Voice over IP security academic research, using a set of 245 publications forming a closed cross-citation set. We classify these papers according to an extended version of the VoIP Security Alliance (VoIPSA) Threat Taxonomy. Our goal is to provide a roadmap for researchers seeking to understand existing capabilities and to identify gaps in addressing the numerous threats and vulnerabilities present in VoIP systems. We discuss the implications of our findings with respect to vulnerabilities reported in a variety of VoIP products.We identify two specific problem areas (denial of service, and service abuse) as requiring significant more attention from the research community. We also find that the overwhelming majority of the surveyed work takes a black box view of VoIP systems that avoids examining their internal structure and implementation. Such an approach may miss the mark in terms of addressing the main sources of vulnerabilities, i.e., implementation bugs and misconfigurations. Finally, we argue for further work on understanding cross-protocol and cross-mechanism vulnerabilities (emergent properties), which are the byproduct of a highly complex system-of-systems and an indication of the issues in future large-scale systems.

show abstract

“…Wu et al [14] described a cross protocol intrusion detection architecture for VoIP environments. Sengar et al [15] proposed an intrusion detection system based on interactive protocol state machines. The above intrusion detection systems or methods are deployed on VoIP servers side, and ineffective to defend against the attacks we proposed.…”

Section: Related Workmentioning

confidence: 99%

An Empirical Investigation into the Security of Phone Features in SIP-Based VoIP Systems

Zhang

Wang

Yang

et al. 2009

Information Security Practice and Experience

View full text Add to dashboard Cite

Abstract. Phone features, e.g., 911 call, voicemail, and Do Not Disturb, are critical and necessary for all deployed VoIP systems. In this paper, we empirically investigate the security of these phone features. We have implemented a number of attacks and experimented with VoIP services by leading VoIP service providers Vonage, AT&T and Gizmo. Our experimental results demonstrate that a man-in-the-middle or remote attacker could transparently 1) hijack selected E911 calls and impersonate the Public Safety Answering Point (PSAP); and 2) spoof the voicemail servers of both the caller and the callee of selected VoIP calls; and 3) make spam calls to VoIP subscribers even if Do Not Disturb is enabled. These empirical results confirm that leading deployed SIP-based VoIP systems have serious security vulnerabilities.

show abstract

VoIP Intrusion Detection Through Interacting Protocol State Machines

Cited by 82 publications

References 11 publications

Disabling a Computer by Exploiting Softphone Vulnerabilities: Threat and Mitigation

Disabling a Computer by Exploiting Softphone Vulnerabilities: Threat and Mitigation

A Comprehensive Survey of Voice over IP Security Research

An Empirical Investigation into the Security of Phone Features in SIP-Based VoIP Systems

Contact Info

Product

Resources

About