Larger organisations are using VoIP within their commercial services and corporate communications and the take up of cloud based Unified Communications (UC) solutions is rising every day. However, response teams and security testers have limited knowledge of VoIP attack surfaces and threats in the wild. Due to this lack of understanding of modern UC security requirements, numerous service providers, larger organisations and subscribers are leaving themselves susceptible to attack. Current threat actors are repurposing this exposed infrastructure for botnets, toll fraud etc.
The talk aims to arm response and security testing teams with knowledge of cutting-edge attacks, tools and vulnerabilities for VoIP networks. Some of the headlines are: attacking cloud based VoIP solutions to jailbreak tenant environments; discovering critical security vulnerabilities with the VoIP products of major vendors; exploiting harder to fix VoIP protocol and service vulnerabilities; testing the security of IP Multimedia Subsystem (IMS) services; and understanding the toolset developed by the author to discover previously unknown vulnerabilities and to develop custom attacks. In addition, the business impact of these attacks will be explained for various implementations, such as cloud UC services, commercial services, service provider networks and corporate communication. Through the demonstrations, the audience will understand how can they secure and test their communication infrastructure and services. The talk will also be accompanied by the newer versions of Viproy and Viproxy developed by the author to operate the attack demonstrations.
Fatih Ozavci is a Managing Consultant with Context Information Security andthe author of the Viproy VoIP Pen-Test Kit, Viproxy MITM analyser and the VoIPWars research series. He has fifteen years extensive experience in the fieldof information security as a leading security consultant, researcher andinstructor. His current research is focused on securing IMS and UC services,IPTV systems, mobile applications, mobility security testing, hardware hackingand BYOD/MDM analysis. He has discovered previously unknown (zero-day)security vulnerabilities and design flaws in IMS, Unified Communications,Embedded Devices, MDM, Mobility and SAP integrated environments and haspublished several security advisories for SAP Netweaver, Clicksoft Mobile,Cisco CUCM/CUCDM and Microsoft Skype for Business platforms. Fatih haspreviously presented at major security conferences such as Blackhat Europe'15,HITB Singapore 2015, BlackHat USA'14, Defcon 22 and 21, Troopers'15, Cluecon2013 and Ruxcon 2013. He has provided VoIP and Mobility Security training atDefcon 23, AustCert 2014 and 2016, Kiwicon 2015 and Troopers'15.