[VOIPSEC] SBC security/pen testing

[Christopher A. Martin]

Not necessarily...

Much like a firewall, those ports should be listening for specific
endpoints...other hosts probing those ports should receive a port
unreachable message...

The ports should only be dynamically listening during the time that they
are required for use as signaled by the signaling protocol for the
respective endpoints that are part of that dynamic session.

If we rely on static rules or listening ports there will be no security
and a full high risk scenario waiting to happen.

Just my 2 cents

Chris

-----Original Message-----
From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org] On
Behalf Of Geoff Devine
Sent: Monday, April 25, 2005 7:17 AM
To: Voipsec at voipsa.org
Subject: Re: [VOIPSEC] SBC security/pen testing

Given the function and architecture of an SBC, you'd expect that
virtually all UDP ports would be "open" since the box does header
substituion on thousands of UDP/RTP and UDP/RTCP streams that run on
different ports.  If there hasn't been any SIP signaling to set up a
flow from an endpoint for a particular port, you'd expect an SBC would
throw those packets on the floor since it wouldn't know how to relay
them.  Is this the behavior you are seeing?
 
Geoff 
 
------------------------------------------------------------------------
------------------------
From: A S <ccrouter at gmail.com>
I have Scan SBC's using NMAP, Nessus, Sivus. interstingly almost all of
them have UDP ports open. One has FTP port open !!!. Wondering why
vendors are not testing their Security products against very well known,
easily
avaiable security tools.