Monthly Archives: June 2006

Cable VoIP in the news

Cable Hastens Telco Phone Line Losses

Cable Digitial News, who recently sold themselves to the parent of Light Reading, recently put up an interesting article saying that cable now has 62% of the 6 million customer residential VoIP market; up from 52% a year ago.  The telcos have been seeing an erosion north of 8 million lines per year and claim to be reducing the churn to closer to 6 million this year.  I scratch my head at that one.  I see the trend going in the other direction now that Comcast and Charter have launched cable VoIP products in most of their footprint.  That’s almost 50% of the US market that didn’t have a cable VoIP option a year ago.  I see the churn to cellular-only picking up speed, too.

The article couldn’t resist taking a pot shot at Vonage… the poster child of failed IPOs.  Like everybody else, I’ve been watching it crater.  The FCC news this week that Vonage is going to be required to pay into Universal Service Fund just further erodes their price advantage against the telco wireline product and the cable VoIP product.  This after rulings about CALEA and 911 requirements.  I think the company will end up being worth their cash plus about $100 per subscriber. 

It’s unfortunate that the lay person now thinks VoIP == Vonage and the brand is associated with low quality and a gigantic stockmarket failure.  The cable VoIP product has quality parity with the telco wireline product.  It just goes to show that if you set out to build a quality product rather than take advantage of regulatory arbitrage, you end up winning in the end.

An interesting factoid I’ve picked up recently is that when cable companies sell or trade properties to other cable operators, they value each customer who takes their VoIP product $1000 more than one who doesn’t.  I think this is going to be a big incentive for cable operators to roll out VoIP in their smaller markets since those are the properties that tend to be traded around frequently.  I’ll refrain from talking about my own company but Nortel just announced a scaled down version of their product called the CS 1500 that is clearly targeted at smaller markets. 

Obligatory mention of VoIP Security:

I’ve found myself deluged both from executives within my company and from the cable-oriented trade press about the Net2Phone theft of service hacker case.  There were all kinds rumors flying around that our product was somehow involved.  I had to run through the littany of layers of security that protect cable VoIP. 

  • DOCSIS is encrypted with 56-bit DES
  • Cable modem chips can only listen on the downstream.  You need a $10K piece of test equipment to sniff the upstream
  • The media terminal adapter (MTA) has a digitial certificate burned into it
  • The MTA authenticates with a Kerberos Key Distribution Center as part of the boot & provisioning sequence
  • The MTA is bound to a single Cable Modem Termination System so a cloned MTA will only work in a small geographical area
  • PacketCable Softswitches sit behind firewalls
  • Nobody turns on signaling or media security today but all the products support it and are conformance tested at CableLabs
  • With a simple port blocking strategy, you could make the Softswitch and MTA invisible on their signaling port

 I did get extensively quoted in one article but they mis-spelled my name.  So far, I’ve only consumed a few nanoseconds of my 15 minutes of fame.

FYI – comments are moderated due to large amount of blog comment spam

By the way, if you have left a comment to this blog and noticed that it didn’t appear right away, it is because we are unfortunately moderating all comments due to recieving a great amount of blog comment spam (As an example, in one recent 24-hour period, we received over 35 bogus comments across a whole range of posts here). It truly is amazing the lengths the spammers will go to in order to increase the search engine ranking of their websites. The recent variants include some mundane comment as the text (such as “Great website. I learned a lot. Keep up the great work.”) but then put the spammer’s URL in the URL for the comment author (which we currently display). It’s a bit subtle in that at first glance you might want to approve the comment… until you look at the URL.

Anyway, we are going to keep moderation on until we get a chance to put in some type of CAPTCHA system or other way to prevent bots and scripts from injecting all these comments. And yes, we do realize that spammers are paying people to sit there and fill out comment fields, thereby defeating CAPTCHA tools… but hey, at least we would eliminate the automated spam – and it potentially forces spammers to lose some profit by paying people, which somehow doesn’t upset me at all. 🙂

Not Just SPIT but SPOG and SPOM

Looking at David Piscitello’s Blog  the other day, I saw that in addition to all the various SPxxx words we use, he has coined the term SPOG for SPAM on Online Games.  Like all these low-cost ways of getting messages to would-be buyers, SPOG will curse gamers as SPAM now curses all email users.  Perhaps we could also add SPOM to the list (SPAM over Myspace), for a new way to SPAM the teenage market.

In the world of junk-mail a 1% return would be considered exceptionally successful, and the economics of mass-mailing with poor targeting works on this basis of poor returns.  I think it was Bruce Schneier that said that SPAM is basically an economic problem, because the costs of mass-emailing are so low that the low success rate is not a problem, and actually if one person in 100,000 turns into a sales prospect, then SPAM has become a legitimate marketing tool.  So as frustrating as most of us find it, those few who say “yes” will mean that we continue to receive an unending flow of material about drugs and loans.

SPIT is not a really problem in the wild today.  This is partly because VoIP largely exists in islands  today, and not in a fully interconnected network.  It’s also partly because would-be SPITters have not yet come across the technology.  As with SPAM, this will be attractive to some, because it will be possible automate calling, and because the technical barriers are low, and the cost per call negligible, it will be economical to make thousands of calls per day.  And if a small percentage of those calls actually succeed in closing some sales, then once again it has become a legitimate marketing technique.

SPIT was discussed quite a bit at the recent VoIP Security Workshop, and it seems researchers have already created an impressive array and anti-SPIT techniques, although with the caveat that they have no actual real-world SPIT data to test their techniques against.  Some of these techniques are economic and some are technical, but we can well imagine combinations of these techniques giving us very high anti-SPIT coverage in the future.  For the remaining few calls that get through, please let’s all hang up on them, and for goodness sake don’t buy anything.

Internet pioneers speak out on VoIP wiretapping

As a followup to Dustin Trammell’s posting about CALEA compliance, the Information Technology Association of America released a report today entitled Security Implications of Applying the Communications Assistance to Law Enforcement Act to Voice over IP. To quote from a an InfoWorld article covering the report:

The study, co-authored by several people including TCP/IP co-creator Vinton Cerf and former U.S. National Security Agency encryption scientist Clinton Brooks, comes days after a U.S. appeals court upheld the FCC’s VOIP wiretapping rules. On Friday, the U.S. Court of Appeals for the District of Columbia upheld the ruling, requiring that VOIP providers offering a substitute for traditional telephone service comply with a 1994 telephone wiretapping law called the Communications Assistance for Law Enforcement Act (CALEA).

The FCC did not immediately respond to a request for comments about the ITAA study. But on Friday, FCC Chairman Kevin Martin said allowing law enforcement wiretapping of VOIP calls is of “paramount importance” to U.S. security.

Tracking VOIP calls would be more difficult than tracking calls on the traditional telephone network, because VOIP providers have little control over how their calls are routed across the Internet, said Whitfield Diffie, chief security officer at Sun Microsystems Inc. VOIP providers “have no special Internet privileges” to control traffic, said Diffie, one of the study’s authors.

Blue Box Podcast #30 – Martyn Davies report on 3rd Annual VoIP Security Workshop in Berlin, VoIP security news, more

Blue Box Podcast #30 is now available for download. This show features a 24-minute report from Martyn Davies about the 3rd Annual VoIP Security Workshop held recently in Berlin. Martyn provides his view on the major themes and provides brief segments of interviews he had with some of the speakers. Jonathan and I also discuss the latest VoIP security news, including, of course, the Pena/Moore fraud scam that is all over the networks. We also include the usual discussion of listener comments, review of the VOIPSEC mailing list and more…

Asterisk & IAX Client Library Buffer Overflow Advisories

Core Security released two advisories on the 9th (1, 2) covering buffer overflow vulnerabilities related to short UDP packets in two vulnerable applications, the Asterisk Open Source IPBX, and applications making use of the IAX client library which provides an IAX/IAX2 protocol stack for 3rd party applications. Both vulnerabilities center around the IAX2 protocol and truncated UDP frames.

A press release from yesterday which summarizes the advisories from Core can be found here.

Updated software releases and/or patches have been released, which are the same patches that David Endler posted about earlier this week.

VoIP providers must adhere to CALEA by May 14

One of the current hot-button issues in the VoIP Security industry is the argument between end-to-end media encryption versus hop-by-hop media encryption. The folks on the hop-by-hop side of the argument have been making the case that end-to-end media encryption schemes like ZRTP are just not feasable for use in a business environment due to the requirement for law enforcement to be able to lawfully intercept or wire-tap VoIP Calls as is similarly required by the Communications Assistance for Law Enforcement Act (CALEA) for traditional telephony providers. It seems that a recent court ruling may have just backed those folks argument. ComputerWorld has coverage on a recent court ruling on the subject. From the article:

“The U.S. Court of Appeals for the District of Columbia upheld the FCC’s August 2004 ruling saying interconnected VoIP providers must allow wiretapping by May 14, 2007.”

“The FCC ruling requires VoIP providers that offer a substitute service for traditional telephone service to comply with a 1994 telephone wiretapping law called the Communications Assistance for Law Enforcement Act (CALEA). The U.S. Department of Justice and the FBI, in requesting the ruling, argued that their surveillance efforts are “compromised” without CALEA rules for VoIP.”

Thanks to Brian Honan for sending the referenced article to the VoIPSec e-mail forum.

Business Week: Is Your VoIP Phone Vulnerable?

This morning Business Week weighed into the ongoing Pena/Moore story with their article “Is Your VoIP Phone Vulnerable?” Given that the article covers mostly familiar ground (and, like most articles in the mainstream press, brings up the fear of SPIT), the significance to me is not so much the content as it is the fact that it is in Business Week, which is well read and highly regarded within at least North American corporate leadership. I do agree with the conclusion:

Businesses would do well to consider the threats on the front end, given how fast VoIP adoption is growing. Although only 5% deploy VoIP companywide, 87% of companies are using VoIP in some capacity. Numbers like that may be too alluring for hackers to pass up.

Security should definitely be considered as part of a VoIP rollout plan – and you definitely need to be asking your vendor / reseller about the security of the VoIP system you are looking to implement.

The challenging part about this article – and most others I have seen on the subject in recent days – is that it lumps everything into a broad “VoIP” category while the reality is that there are definite differences between enterprise VoIP systems and the consumer / wholesale VoIP market. Now I don’t personally work in the consumer/carrier/service provider space, so I can’t really speak to that space, but I do see more and more “VoIP providers” popping up offering wholesale termination services. From an outsider’s point-of-view, it looks a bit Wild West-ish and in that cauldron of competition, I could easily see some newer entities overlooking security in the rush for the gold. However, through communication among VOIPSA members, I know that there are certainly service providers who do have a clue and are offering secure services. Unfortunately all get tarred with the same brush.

That same brush in articles like this unfortunately tars all of us on the corporate enterprise side as well. And I suppose the same “Wild West” image could be applied to a certain limited degree given the number of small startups launching various IP-PBXs. But that’s not the overall reality. While many of those new entrants are thriving, still most corporate enterprises are buying their phone systems from a limited range of vendors: 3Com, Alcatel, Avaya, Cisco, Mitel, NEC, Nortel, Polycom, Siemens… and probably a few others who I am forgetting right now. The point is, though, that within the enterprise market most all of us are offering VoIP systems that do provide security against many if not most or all of the threats outlined in the VOIP Security Threat Taxonomy (some of those vulnerabilities lie in the corporate network and so there is only so much we as vendors can do). Now each one of us will of course have our own reasons why our security is better than our competitors – and some are offering more security than others – but the point is that we do provide secure VoIP.

The challenge is that to those of us on the inside, the “VoIP industry” is this large space with lots of different segments and players. We can see the differences I outline (and many more). But to the larger business world, Voice over IP in general is so new that everything gets labelled as “VoIP”. That will change over time… and really it falls to organizations like VOIPSA and others to help in that education.

In the meantime, articles like this one in Business Week will hopefully at least cause business to ask questions about the security of their VoIP products – and VoIP services. To me, that’s a good thing.

[Full disclosure: I work at Mitel.]

Check Point webinar on VoIP security – June 21, 2006

Blue Box listener and frequent commenter Craig Bowser sent along a note that Check Point is offering a webinar on June 21, 2006, entitled “Cut Costs and Increase Flexibility With a Secure VoIP Solution“. The speakers include:

  • Pam Schancupp, Executive Editor, eSeminar, Ziff Davis Media
  • Debra Mielke, President, Treillage Network Strategies Inc.
  • Dr. KRS Murthy, CEO, CT Cubed
  • Zoltan Keve, Vice President, Sales, Caleidoscope Communications
  • Paul Kaspian, Sr. Product Marketing Manager, Check Point
    Software Technologies

The page notes that the webinar will cover:

  • How to evaluate what VoIP systems best fit your organization’s needs
  • How to ensure your VoIP implementation is secure
  • How to chose the right security solutions for your VoIP deployment
  • How to deploy and integrate VoIP into your existing technology infrastructure
  • How to evaluate the most cost-efficient deployment and usage scenario

Obviously all from Check Point’s point-of-view. Given that Check Point is not currently part of VOIPSA’s Technical Board of Advisors, I have not interacted with anyone from the company, so it would be quite interesting to hear their viewpoint. Unfortunately, I won’t be able to attend this webinar, but if anyone does and wants to write a summary for this blog, such contributions are always welcome. 🙂

Blue Box Podcast #29 – VoIP security news, Skype security issues, more

Blue Box Podcast #29 is now available. In this episode, Jonathan and I cover a range of recent VoIP security news items, including several related to Skype, and also cover comments from listeners. The full show notes, list of links, etc. is all available from the episode web page.

P.S. As a teaser, I’ll mention that show #30 is now in post-production and will include Martyn Davies’ audio report from the 3rd Annual VoIP Security Workshop in Berlin that he blogged a bit about here, here and here. The show should be posted within the next couple of days. Stay tuned…