Abstract
Phone features, e.g., 911 call, voicemail, and Do Not Disturb, are critical and necessary for all deployed VoIP systems. In this paper, we empirically investigate the security of these phone features. We have implemented a number of attacks and experimented with VoIP services by leading VoIP service providers Vonage, AT&T and Gizmo. Our experimental results demonstrate that a man-in-the-middle or remote attacker could transparently 1) hijack selected E911 calls and impersonate the Public Safety Answering Point (PSAP); and 2) spoof the voicemail servers of both the caller and the callee of selected VoIP calls; and 3) make spam calls to VoIP subscribers even if Do Not Disturb is enabled. These empirical results confirm that leading deployed SIP-based VoIP systems have serious security vulnerabilities.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
First Report and Order and Notice of Proposed RuleMaking, http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-05-116A1.pdf
How To Deal With Voicemail When Prospecting, http://www.content4reprint.com/business/network-marketing/how-to-deal-with-voicemail-when-prospecting.htm
Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., Schooler, E.: SIP: Session Initiation Protocol. RFC 3261, IETF (June 2002)
Schulzrinne, H., Casner, S., Frederick, R., Jacobson, V.: RTP: A Transport Protocol for Real-Time Applications. RFC 1889, IETF (January 1996)
Vonage, http://www.vonage.com/
AT&T’s CallVantage, https://www.callvantage.att.com/
Gizmo, http://www.gizmoproject.com/
Zhang, R., Wang, X., Yang, X., Jiang, X.: Billing Attacks on SIP-Based VoIP Systems. In: lst USENIX Workshop on Offensive Technologies (WOOT 2007) (August 2007)
US VOIP market shares, http://blogs.zdnet.com/ITFacts/?p=11425
Zhang, R., Wang, X., Farley, R., Yang, X., Jiang, X.: On the Feasibility of Launching the Man-In-The-Middle Attacks on VoIP from Remote Attackers. In: 4th ACM Symposium on Information, Computer and Communications Security (ASIACCS 2009), Sydney, Australia (March 2009)
Arkko, J., Torvinen, V., Camarillo, G., Niemi, A., Haukka, T.: Security Mechanism Agreement for the Session Initiation Protocol (SIP). RFC 3329, IETF (January 2003)
Baugher, M., McGrew, D., Naslund, M., Carrara, E., Norrman, K.: The Secure Real-time Transport Protocol (SRTP). RFC 3711, IETF (March 2004)
Reynolds, B., Ghosal, D.: Secure IP Telephony Using Multi-layered Protection. In: 10th Network and Distributed System Security Symposium (NDSS 2003) (Feburary 2003)
Wu, Y., Bagchi, S., Garg, S., Singh, N.: SCIDIVE: A Stateful and Cross Protocol Intrusion Detection Architecture for Voice-over-IP Environments. In: 34th International Conference on Dependable Systems and Networks (DSN 2004), pp. 433–442 (July 2004)
Sengar, H., Wijesekera, D., Wang, H., Jajodia, S.: VoIP Intrusion Detection Through Interacting Protocol State Machines. In: 36th International Conference on Dependable Systems and Networks (DSN 2006) (June 2006)
Mintz-Habib, M., Rawat, A., Schulzrinne, H., Wu, X.: A VoIP Emergency Services Architecture and Prototype. In: 14th International Conference on Computer Communications and Networks (ICCCN 2005) (October 2005)
Wang, X., Zhang, R., Yang, X., Jiang, X., Wijesekera, D.: Voice Pharming Attack and the Trust of VoIP. In: 4th International Conference on Security and Privacy in Communication Networks (SecureComm 2008) (September 2008)
McGann, S., Sicker, D.C.: An analysis of Security Threats and Tools in SIP-Based VoIP Systems. In: Second VoIP Security Workshop (2005)
PROTOS SIP Fuzzer, http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/
SIP Forum Test Framework, http://www.sipfoundry.org/sip-forum-test-framework/sip-forum-test-framework-sftf.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Zhang, R., Wang, X., Yang, X., Farley, R., Jiang, X. (2009). An Empirical Investigation into the Security of Phone Features in SIP-Based VoIP Systems. In: Bao, F., Li, H., Wang, G. (eds) Information Security Practice and Experience. ISPEC 2009. Lecture Notes in Computer Science, vol 5451. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-00843-6_6
Download citation
DOI: https://doi.org/10.1007/978-3-642-00843-6_6
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-00842-9
Online ISBN: 978-3-642-00843-6
eBook Packages: Computer ScienceComputer Science (R0)