McAfee recently published their top ten threat predictions for 2008. Among the other threats, attacks against VoIP systems were predicted to rise by 50% in 2008:
VoIP attacks should increase by 50 percent in 2008. More than twice the number of VoIP-related vulnerabilities were reported in 2007 versus the previous year – several high-profile “vishing” attacks, and a criminal phreaking (or fraud) conviction – so it’s clear that VoIP threats have arrived and there’s no sign of a slowdown.
I think that defense strategies are technically present (Cisco ASA and Call Manager can mitigate most of attacks by example) but that’s not concrete in the mind of enterprises. I think having some incident reports on the blogosphere will help to grow voip security countermeasures maturity.
In the last months, we can observe the demultiplication of simple tools that will help to test assets and better clarify the whole security figure around VoIP.
Pingback: McAfee predice un incremento del %50 de ataques a sistemas VoIPen messenger es todo sobre la mensajerÃa instantanea. msn messenger, windows live messenger, programas messenger, messenger adictos, …
Seems the VoIP section McAfee report is based on the NIST NVD database of vulnerabilities found in VoIP devices, yet these vulns are referred to as “attacks” — put another way, this report doesn’t seem to speculate on the use of vulnerabilities to conduct actual attacks, or of attacks on VoIP systems. Just basing this 50% increase on the number of expected vulnerabilities reported to NIST NVD is, IMHO, speculative and misleading.
–scm