Securing Voice Comms Against... Cap'n Crunch?

Accessing the TDM network is difficult. Gaining access requires a carrier to be certified (think money and lawyers), and it requires end-users to receive the service on a dedicated facility. These measures help ensure security of the TDM network.

Enter VoIP, the technology that fundamentally changed - and is still changing - the industry. The biggest impact is that carriers and subscribers can now have access to the voice infrastructure as long as they have access to the Internet. The upside is that the time to turn-up service can be measured in hours (i.e. pointing to a URL or IP address). The downside is that URL or IP address is now a source for attacks.

Attacks can be classified in a myriad of ways but they boil down to two main areas: theft of service or denial of service. Theft of service has been around since the advent of the voice network. Remember Cap'n Crunch? At one time, a toy whistle packaged in boxes of Cap'n Crunch cereal could emit a tone that was the same frequency used by a service provider to indicate that a trunk line was ready and available to route a new call. Hackers quickly learned that blowing a Cap'n Crunch whistle into a phone allowed them to make free calls. "Whistling off," as it was called, effectively disconnected one end of the trunk, allowing the still connected side to enter operator mode so that the hacker could make local, long distance or international calls without paying.

While the Cap'n Crunch whistles are now collecting dust, times have not changed that much. Are current VoIP networks vulnerable to Cap'n Crunch whistling? Heck no, but it just goes to show that even a network that is hard to get into has vulnerabilities. Today, hackers use different tools to access the network and spoof authentication. A malicious person could attack the service provider directly; we hear about numerous instances of this happening every year. To take it one step further, that same person could also access a corporate network and use the company's facility to make the same calls. In both cases, once access has been achieved it requires outliner data to catch the intrusion. One example would be if high call volume was being directed to a third world country international phone provider that charges high rates per use minute.

Denial of service is just like denial of service for any Internet application. For fun (sadly, there are people who find this amusing), revenge or for profit, hackers clog access to the application by flooding the service. Through brute force or via clever scripts they attempt to tie up all of the available resources (phone lines or call center employees) to disrupt productivity.

The last potential for security breach is starting to emerge as VoLTE begins to be deployed worldwide. Before VoLTE, voice was supported by a dedicated voice network while Internet browsing used a separate, shared network. With VoLTE traffic, both voice and data will use the same shared network. If the voice session is not secure from end-to-end, the ability to steal content is very real - and people every day, in everyday situations are at risk. Think about the conference call you take from the airport, hotel or coffee shop on your smart phone. You might be using a UC application that is sharing not only voice communications but also a PowerPoint or Excel document containing confidential information.

The good news is that securing voice communications doesn't have to be complex. A Session Border Controller - or SBC - is designed to combat these forms of fraud and others. The SBC is a point of authentication; not only does the SBC authenticate a session before allowing the session to be established, it continues to monitor the session. By understanding calling or called patterns an SBC can alert you to abnormal patterns.

Perhaps some of these common security flags sound too familiar to you:

• Do most calls through your network last for three minutes, but you have sessions lasting far greater amounts of time?
   
• Are you getting far more calls to your 1-800 number than reasonable?
   
• Are you dialing out to Africa more often?
   
• Is the call hold time on your IVRs rising?

An SBC can ensure that communication is secure regardless of the device or location of where the session takes place. At the end of the day, the cost of an SBC is far less than the cost of service theft. How secure is your network?

Visit the Sonus blog for more insights and educational articles.