Fortinet VoIP Security June 2007 Carl Windsor

The VoIP Security Problem VoIP developed by voice specialists Security an afterthought Primary concern is voice quality and latency Consumer VoIP became commonplace overnight Vendor interoperability In 2007 Voice over IP (VoIP) systems will be the target of cyber attacks. VoIP technology was deployed hastily without fully understanding security. SANS Institute: Security Trends for 2007

Common VoIP Security Issues – Sharing Resources VoIP commonly shares data networks Data network traffic can impact the voice network Large file transfers increase latency and jitter VoIP should be treated as the highest priority Mail, FTP, HTTP lower priority Virus/Worm infections on the data network can cause high volumes of traffic and effectively DoS VoIP systems Slammer Nimda

Common VoIP Security Issues – Plaintext transmission VoIP communications often unencrypted Secure VoIP implementations vendor specific Is there a risk to data in transit?

Common VoIP Security Issues – Plaintext transmission

Common VoIP Security Issues – Plaintext transmission

Common VoIP Security Issues – Plaintext transmission What if this was the sound of you entering your voice banking pin or credit card number?

Common VoIP Security Issues – Dynamic Ports and NAT The VoIP payload, RTP traffic, is dynamically assigned an even port number in the range of non-privileged UDP ports (1024-65534) and specified in the packet body of the signalling protocol.

Example VoIP Packet (Header) Source IP Source Port Destination IP Destination Port 212.32.45.6 5346 64.58.79.231 389 Message Body …… Source IP: 212.32.45.6 Source (RTP) Port: 5005 …

Common VoIP Security Issues – Dynamic Ports and NAT Options: Don’t allow VoIP communications through your firewall Open a large range of possibly damaging application ports as per their firewall or application's vendor advice To establish outbound NetMeeting connections through a firewall, the firewall must be configured to do the following: Pass through primary TCP connections on ports 389, 522, 1503, 1720, and 1731 Pass through secondary TCP and UDP connections on dynamically assigned ports (1024-65535)

Common VoIP Security Issues – Dynamic Ports and NAT The VoIP payload, RTP traffic, is dynamically assigned an even port number in the range of non-privileged UDP ports (1024-65534) and specified in the packet body of the session protocol. What happens when you use Network Address Translation? 192.168.1.10 212.32.45.6 64.58.79.231

Example VoIP Packet (Header) Source IP Source Port Destination IP Destination Port 192.168.1.10 5346 64.58.79.231 389 Message Body …… Source IP: 192.168.1.10 Source (RTP) Port: 5005 …

Example VoIP Packet – NAT Applied (Header) Source IP Source Port Destination IP Destination Port 192.168.1.10212.32.45.6 23456 64.58.79.231 389 Message Body …… Source IP: 192.168.1.10 Source (RTP) Port: 5005 …

Future Security Threats Follow what happened to e-mail and multiply by 100 DoS SPAM Misconfigured relay SPAM Botnet SPAM Real threat or hype?

Future Security Threats Not so far in the….. Future Security Threats Introducing Javabot http://www.loria.fr/~nassar/readme.html DOS: Send successive INVITE with different transactions to the target (IP phone or SIP server). To paralyze a SIP server, you may need many bots SPIT: Send media audio to some SIP user (Username +IP) SCAN: take a list of destinations and send respective INVITE messages to a SIP server. Depending on the response of the server, a destination is matched as an existent user or not. CRACK: if by scanning you discover the SIP username of one user, you can try to crack its password REGISTER: if by cracking you have the password of a user, you can register instead of it and transfer calls

Enhancing Your VoIP Security Fortinet Enhancing Your VoIP Security 16

Fortigate VoIP Support Support for VLANs Segregate your data and voice networks Support for QoS Prioritise your Voice traffic over less critical Guarantee bandwidth for VoIP traffic High Speed and throughput Encryption ASIC Accelelerated 3DES/AES IPSEC VPN Small Packet Performance High numbers of concurrent sessions Wirespeed small packet performance

Fortigate VoIP Support The FortiGate series now supports three major VoIP protocol application layer gateways (ALGs) H.323, SIP, and SCCP (Skinny) Each ALG allows the FortiGate to provide: NAT of VoIP traffic Pinhole Firewall your VoIP devices, monitoring and blocking of unwanted VoIP traffic IPS protection of VoIP protocol Protocol anomalies, denial of service attacks, buffer overflows, and header manipulation attacks

Fortigate VoIP Support Application awareness - NAT (Header) Source IP Source Port Destination IP Destination Port 192.168.1.10 212.32.45.6 23456 64.58.79.231 … Message Body …… Source IP:192.168.1.10 212.32.45.6 Source (RTP) Port: 5005 23456 Application aware firewalls understand that the data payload needs modifying as well as the header

Fortigate VoIP Support Application awareness

Fortigate VoIP Support The FortiGate series now supports three major VoIP protocol application layer gateways (ALGs) H.323, SIP, and SCCP (Skinny) Each ALG allows the FortiGate to provide: NAT of VoIP traffic Pinhole Firewall your VoIP devices, monitoring and blocking of unwanted VoIP traffic IPS protection of VoIP protocol Protocol anomalies, denial of service attacks, buffer overflows, and header manipulation attacks

Fortigate VoIP Support Intrusion and DoS prevention

Fortigate VoIP Support Logging and reporting

Example Deployment – Distributed Call Centre

Example Deployment – Corporate Offices

Future Fortinet Developments Convert SIP over TCP to UDP Support SIP on dynamically chose ports (MSN, AIM, ICQ, Yahoo) SIP header compression/decompression SIP/SIMPLE AV scanning New Vendor Specific ALGs Stream Control Transmission Protocol (SCTP) Support Call recording and archive Anti-SPIT

Questions