Securing VoIP a joint responsibility of network operators, device makers and consumers: Certicom

The continued rollout of Voice over Internet Protocol services will, unfortunately, increase the prevalence of the security risks associated with it, according to security firm Certicom Corp. Although these potential threats - viruses, hackers, spam - have not fully revealed themselves, security solutions developers need to predict what types of attacks could take place in order to prevent everything from general nuisances to million dollar communications disruptions. "In general, Voice over IP is susceptible, potentially to all the same vulnerabilities that any device on the Internet is susceptible to," Rick Pitz, product manager for Certicom tells Network Letter. "And since there are new attacks discovered every day on the Internet those same attacks are going to be discovered on VoIP devices." With that in mind the company launched Certicom Security for VoIP, to be applied to desktop VoIP handsets and mobile VoIP devices. Pitz says Certicom looked at what was already being done to protect data today and applied it to the voice environment, trying to maintain as much flexibility as possible to update and expand as new vulnerabilities and solutions are discovered. By leveraging its Certicom Security Architecture the system allows protocols and algorithms to be switched out as the technology advances. "It's a suite of products that have been rolled out over time," says Pitz of the solution, "and what we're really doing here is kind of bundling it all together and providing the necessary infrastructure to use it in this kind of environment." Pitz primarily attributes the lack of major VoIP security problems at this time to the relative infancy and limited use of the technology. But the potential is there, and breaches could be extremely serious. "If you take the corporate environment," Pitz says, "without security it would be possible for someone to potentially hack into disable the phone system, which for many companies would be pretty catastrophic. If you take down somebody's customer support centre or call order centre, serious financial implications." Indeed, in August 2004 the New York Times reported that a bank branch in the northeastern United States had its 500 Internet phone lines disabled by a worm, resulting in about $1 million dollars in losses. While this case illustrates the reality and potential severity of VoIP security infringements, it is rare thus far. What is currently most common, according to Pitz, are attempts to steal service through what are known as man-in-the-middle attacks, where culprits intercept a call and steal someone's identity to make phone calls for free. Of course the negative implications of such attackes range from dealing with the cost of calls made by a hacker charged to a personal account, to criminals placing calls on a business account with intent to harm a company's reputation, to outright identity theft issues. Other feared security issues include spam voicemail and telemarketing scams because it's harder to pinpoint where the calls are originating from. But beyond the strife of the end user, all VoIP security breaches could affect acceptance of the technology. "Let's say all of a sudden there's a real upsurge in hacking, in intrusion, and in other sort of scams that are put towards the IP sector, that could slow the growth of IP," says Joe Greene, VP IT security for the consulting and research firm, IDC. "Consumer acceptance may take a hit if, in fact, there are significant breaches, significant incidences in IP from a security perspective." Therefore, ensuring lines are secure should aid the rollout. Pitz says there are three main parts to securing VoIP service: securing the signalling channel; securing the voice channel; and securing the device itself. While the first two are accomplished through traditional techniques like IP security protocol (IPSec) and secure socket layer (SSL) encryption, Certicom's solution secures the device, which has been relatively overlooked until now. "It doesn't do any good if the Voice over IP server is fully secured but if the phones connecting to it have no security, so it becomes a joint responsibility," says Pitz. Certicom's offering incorporates IPsec and SSL along with datagram transport layer security protocol, but also consists of trusted boot, secure provisioning and code-signing technology. Because IP devices will be able to receive constant updates of security protocols and software to add new features, the danger exists that corrupted files will be downloaded into the phone. Pitz gives the hypothetical example of a company copying software from a phone manufacturer's website onto its server so employees have access to it. "Pretty soon somebody went in and hacked it and messed it up and I load it into my phone and strange and bizarre things happen," he says. "So using techniques like code signing, where you actually create a digital signature of the code before you post it and then you validate that signature when it's received into the device, prevents somebody from altering that code and ensures that you're installing the valid image." Potential buyers of Certicom's new solution include traditional PBX vendors, mobile handset makers, PDA manufacturers and companies that are switching from producing analog phones to IP phones. It is not a product for end users, but that's not to say that consumer responsibility will end with the purchase of their phone. "Security is technology, it's people, and it's process," says Greene, "and I think a lot of the incidents we're seeing these days are due to people. It's certainly going to continue to be up to the consumer to guard themselves against any kind of fraud that might take place. The carriers and the manufacturers can't do everything." Since security measures for VoIP are currently being based on what has already been done for the Internet, to what extent are consumers going to be responsible for telephone security in the future? The joint responsibility Pitz mentioned includes network providers and device manufacturers, but in the personal computer market, securing the device extends to the users. One possible scenario sees end users installing anti-virus software on their devices, just as they do with their PCs. Pitz has heard discussions about this, but doesn't know if security issues will ever call for it. He continues: "It becomes a matter of economics at a certain point to provide a firewall-type service and anti-virus software and all those things. It takes a fair amount of processor and memory resource. On a PC, nobody cares because everybody views their PC memory as almost free. But when you're trying to build a $100 retail phone set then every byte of memory counts and if you have to put a faster processor in it costs more, so there is a pushback from that standpoint." Regardless, the extent that security mea-sures for VoIP will be necessary will likely be largely determined on the types of breaches that take place as services are continually rolled out. And even though some consumers might be cautious for a while because of security fears, Greene is confident it won't be enough to stop its adoption. "IP is a solid growth area," he says. "That is the way of the future. Eventually the malware and the organized crime, et cetera, are going to turn their attention towards it and consumers and businesses are going to have to be ready."

Securing VoIP a joint responsibility of network operators, device makers and consumers: Certicom

News | 03/15/2006 5:00 am EST

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us