Number of results 25 for Security

09/01/2012 - Symantec confirms theft of some of its source code

Security specialist Symantec said some of its source code has been stolen by hackers and exposed, but said it was unsure if the security breech would impact "the functionality or security of Symantec's solutions."

Code for the company's Norton anti-virus software wasn't compromised, the company said, but two older products, Endpoint Protection 11.0 and Symantec Anti-Virus 10.2, were affected.

The company said the code was stolen from a third-party, not from its own network.

Industry experts said that because the code was from older products, "it is likely it has evolved quite a bit."

"That said, if there are any core functions that have not evolved, then hackers could take a look at Symantec's source code and find ways to manipulate it," added Robert Rachwald, director of security strategy at Imperva, an Internet security company.

Symantic's Endpoint Protection is four years old, the company said. It's designed to keep outbound data from being leaked. It has undergone regular updating. Symantec Anti-virus 10.2 was five years old and has been discontinued, although it's still supported by the company.

For more:
- see this New York Times article

Related articles:
Huawei's $530M buyout of JV with Symantec sparks security worries
Security a top concern as companies approach cloud computing warily


11/10/2011 - SIP security thoughts – whiteboards and discussion partners needed!
Having a lot of interesting discussions about Realtime Network Security, with SIP as a focus, these days. We need to get enough people in a large room with enough whiteboards to attack the issue. The SIP RFCs needs many updates in this area to help developers to develop more secure software. © Edvina AB, Sollentuna, [...]

29/07/2010 - VoIP security concerns

No Jitter asks a few 'What ifs' about the security of your data network. How do you analyze your voice data for security weaknesses without degrading the QoS? This article disccusses the issues.


17/06/2010 - EB Releases Hardened IP VoIP Phone for Military & Defence Use
 
 
EB, Elektrobit Corporation, a developer of cutting-edge embedded technology solutions for automotive and wireless industries, today announced two new VoIP phones to its EB Tough VoIP(TM) product portfolio with EB Tough VoIP Field Phone and EB Tough VoIP Desktop Phone. Introduced today at EuroSatory 2010 in Paris, these rugged products increase the ability of militaries to communicate and bring broadband data connectivity to the field, vehicles and command posts.

As part of the EB Tough VoIP product portfolio, the EB Tough VoIP Field Phone and Desktop Phone can be seamlessly integrated to customers' existing communications infrastructure. Their rugged design enhances their ability to provide reliable VoIP services when faced with demanding conditions, enabling militaries to gain new and improved operational capabilities. These cutting-edge products come equipped with the flexibility required to meet different customer-specific requirements.

EB Tough VoIP Field Phone comes with an integrated speaker, Ethernet and SHDSL connectivity. The phone enables several innovative applications, including:

·          Greater levels of voice and broadband services in the field

·          Streaming video, maps, real-time data, and situational awareness

·          Local Ethernet connection for other devices

EB Tough VoIP Desktop Phone is equipped with an integrated speaker and Ethernet connectivity providing:

·          Voice services for command post and vehicular use

·          Design allows for the solution to be wall-mounted in vehicles

"Understanding the importance for militaries to utilize broadband services over existing communications infrastructure, we designed these new phones in order to meet those demands and strengthen operational capability," said Mikko Viitaniemi, senior manager, Wireless Solutions, EB. "These products further exhibit EB's ability to develop robust products for the defense industry, and engineer the most dynamic solutions that promote next-generation communications for militaries."

Eurosatory is a defense industry trade show held every two years in Paris and is organized in partnership with the French Ministry of Defense. The show attracts global industry leaders and experts throughout the defense and security sectors.

For meeting requests with EB at Eurosatory 2010, please contact Mikko Viitaniemi, tel. +358 40 344 2579. For more information about EB Tough VoIP products, visit: www.elektrobit.com


10/06/2010 - The 7 deadly UC attacks

No Jitter has an interview regarding unified communications (UC) security and the attacks some companies find themselves combatting. Interview


26/05/2010 - Report: VoIP Cyber-Security Risks Predicted to Raise Insurance Rates
paper.gifSpurred by the lure of low cost, the unregulated and unprotected Internet–based telephone services are expected to produce major insurance losses according to a report issued by NJ-based telephone technology development and licensing company, Emerson Development.

The report, “VoIP Security Review: Insurance”, states that the discount VoIP telephone service, which is rapidly being adopted in the U.S. and throughout the world, is causing a shift from the reliable, secure traditional telephone network now in use, to an Internet environment of extreme risk.

As it becomes more prevalent, the report anticipates that VoIP will be increasingly attractive to those with malicious intent, and therefore will be progressively more vulnerable to hostile acts such as spying / espionage, hacking, intrusion, identity and intellectual property theft, and interruption of service. It points out that VoIP is exposed to all the cyber-risks of the Internet, plus unique risks related to voice communications such as eavesdropping on and recording of phone calls, or redirecting calls to an imposter organization (e.g., a hacker instead of a bank).

This is significant to the Insurance Industry because a growing range of insured user sectors are depending upon VoIP online telephone service. These sectors include, but are not limited to government, the military, manufacturers, the legal profession, the banking industry, the transportation sector, hospitals, pharmaceutical companies and medical practices, the not-for-profit sector, and private individuals in greater and greater numbers.

“Because of the Internet’s open architecture, every person and every system has direct access to one another,” the report’s primary author and CEO of Emerson Development, Mr. Harry Emerson states, “therefore,” he continues, “we all implicitly have a trusted relationship with every hacker and terrorist in the world”. This fundamental Internet architecture, the report explains, enables the broad range of cyber-security threats experienced today; VoIP, as an Internet application, has the same unavoidable vulnerabilities.

According to FBI Director Robert Mueller, in an April 23rd release, “The FBI considers the cyber threat against our nation to be one of the greatest concerns of the 21st century.”

Report co-author, risk-management expert Mr. Glenn Tippy, President and Managing Partner of Insurance Agency Gerrity, Baker, Williams Inc., anticipates that insurance carriers will increasingly price for Internet / VoIP telephone exposure. “Cyber insurance products will be created for users of VoIP, as well as for VoIP providers and vendors. The effects upon our economy will be profound,” he said.


20/05/2010 - FBI warning of VoIP attacks

Just the facts, M'am. The FBI is seeing more denial of service attacks on VoIP, so best to be careful when securing your VoIP network. Luckily, we spolighted Sipera in today's issue and NoJitter has some more info on VoIP security. Article


19/03/2010 - Sipera Systems Unveils Enterprise VoIP and UC on iPhone
sipera_logo.jpg Sipera Systems unveils a series of enterprise UC application security breakthroughs at the VoiceCon Orlando conference next week. Sipera also announced its SLiC smartphone security solution has been designated a Best in VoiceCon award finalist.

Sipera, a VoiceCon Orlando Silver sponsor, will conduct multiple demonstrations and product overviews in Sipera's booth, #408, the Cisco Systems Partner Pavilion, booth #1111, and with Coleman, a Presidio Company, in booth #937. Highlights include:
  • Unveiling secure Unified Communications on the iPhone, extending private, controlled and compliant IP-based UC from the enterprise to employees in any location using the Sipera SLiC secure smartphone UC solution. Sipera SLiC already supports leading smartphones and secures the mobile UC traffic of thousands of enterprise employees in countries around the world.
  • Demonstrating compliant and secure enterprise Video Conferencing for teleworkers and the distributed virtual enterprise. Demonstrations will showcase methods to avoid common service disruption risks, prevent security violations and ensure communications compliance.
  • Securing enterprise Instant Messaging, to satisfy privacy and security mandates, which is critical for users in healthcare, financial services, and other industries handling large quantities of real-time and historic sensitive information.
Sipera will also showcase UC application and device security best practices, and the company's solutions, including the UC-Sec product family and SLiC.


10/03/2010 - 360networks Turns to Empirix to Enhance Network Monitoring and Troubleshooting
360networks_logo.gif 360networks has selected Empirix’s Hammer XMS to enhance its monitoring and troubleshooting capabilities of potential issues across its more than 17,000 route miles of fiber optic network across the western United States.

360networks helps its voice, data and web-based application and service provider customers quickly pursue next-generation strategies, migrate from legacy networks, grow into new markets and services, and increase network diversity. By providing increased efficiency for analyzing, diagnosing and troubleshooting network issues, as well as providing the ability to correlate multiple VoIP and SS7 protocols, Hammer XMS enables 360networks to deliver high quality services to these customers.

Hammer XMS delivers carrier-class network monitoring that provides complete visualization into real-time service quality. Along with a flexible and easy-to-use Graphical User Interface, it optimizes the search and diagnosis process, while continuously monitoring the network. This benefit enables service providers to detect negative trends in voice quality early on, thus preventing poor service quality from reaching the customer.


10/02/2010 - Fugitive VoIP hacker admits 10 million minute deal for $1 million
A Miami hacker has admitted he pocketed more than $1m by selling millions of minutes of voice over IP calls and surreptitiously routing them through the networks of telecommunications companies. Edwin Andrew Pena pleaded guilty to two felonies in connection with the hacking spree, which spanned the years 2004 through 2006, according to court documents. He was apprehended last year in Mexico after skipping out on a $100,000 bond secured by the mother of his then girlfriend.

Pena appeared in US District Court in New Jersey on Wednesday and pleaded guilty to wire fraud and conspiracy to commit wire fraud and unauthorized access to a protected computer. He faces a maximum of 25 years in federal prison and fines of at least $500,000 at sentencing, which is scheduled for May 14.

Pena and cohort Robert Moore were arrested in June 2006 and accused of carrying out an elaborate scheme that routed more than 10 million minutes of VoIP calls over the networks of a dozen or so telecommunications providers without their permission. They breached the networks by using brute-force attacks that deduced the security telephone prefixes needed to gain access.

Click Here to Continue Reading


05/01/2010 - General Dynamics Receives NSA Certification for Sectera vIPer Phone with PSTN Support
 
 
The National Security Agency (NSA) has certified the Sectera vIPer Universal Secure Phone enabled with Public Switched Telephone Network (PSTN) connectivity for voice communications classified at the Top Secret level and below.
 
The Sectera vIPer Phone with PSTN Connect allows U.S. military and government personnel to make both classified and unclassified calls using traditional telephone networks via one high-end office desktop phone. The Sectera vIPer Phone is a secure communication product manufactured by General Dynamics C4 Systems, a business unit of General Dynamics.

"The certification makes the vIPer Phone with PSTN Connect a cost-effective solution as users will no longer have support and maintenance of their legacy Secure Telephone Units or STU-IIIs," said John Cole, vice president of Information Assurance for General Dynamics C4 Systems. "PSTN and VoIP network flexibility, combined with the vIPer Phone's interoperability with the government's Secure Terminal Equipment (STE), also enables customers to easily transition to the latest technology."

Introduced in 2006, the Sectera vIPer Phone remains the only Voice over IP Phone certified by the NSA to protect voice communications classified Top Secret and below over commercial, wired VoIP networks. As military and government organizations plan for evolving technology and the replacement of end-of-life STU-III phones, General Dynamics is offering a price discount of $200 for each vIPer Phone ordered to replace a deployed STU-III or STE phone.

General Dynamics C4 Systems is a leading integrator of secure communication and information systems and technology.

General Dynamics, headquartered in Falls Church, Va., employs approximately 92,300 people worldwide. The company is a market leader in business aviation; land and expeditionary combat systems, armaments and munitions; shipbuilding and marine systems; and information systems and technologies. More information about General Dynamics is available online at www.gd.com.


05/01/2010 - Jabber’s 11 year birthday and todo-list for 2010

Peter Saint-Andre blogs about Jabber’s 11th anniversary and what the focus will be for the XMPP community during 2010. Here’s his list:

  • End-to-end encryption
  • Finalizing Jingle-based file transfer
  • Multi-user Jingle for voice conferencing and the like
  • Distributing chat rooms across servers
  • Bridging between serverless mode and server mode (very useful in distressed networks)
  • Reputation systems for XMPP servers and users

All of these issues are important. End-to-end encryption is something that the SIP community should spend more time trying to handle and I can only wish for some cooperation between SIP and XMPP in trying to find a security architecture for end-to-end communication - involving both encryption and authentication.

© Edvina AB, Sollentuna, Sweden 2010 VoIP-Forum. All Rights Reserved.

.

28/10/2009 - Sipera SLiC Makes Smartphone VoIP and UC Secure and “Business Ready”

After demonstrating how easy it was to eavesdrop and record VoIP calls made over an unsecured WiFi network on the iPhone using open source software called UCSniff, Sipera Systems, which offers real-time Unified Communications (UC) security, released the Sipera Secure Live Communications (SLiC) mobility solution.

The company claims Sipera SLiC is the industry’s first security solution enabling enterprises to “tame” the smartphone, permitting employees to use VoIP, UC, cloud telephony, and other low-cost and feature-rich communications applications on mobile devices with complete security and privacy.


26/10/2009 - Sipera SLiC Delivers Smartphone Security for 'Business Ready' Mobile VoIP and Unified Communications
sipera_logo.jpg Sipera Systems announces availability of the Sipera Secure Live Communications (SLiC) mobility solution. Delivering breakthrough enterprise-class communications privacy and security for VoIP and UC on smartphones, Sipera SLiC makes smartphone VoIP and UC "business ready."

Sipera SLiC is the industry's first security solution enabling enterprises to "tame" the smartphone, permitting employees to use VoIP, UC, cloud telephony, and other low-cost and feature-rich communications applications on mobile devices with complete security and privacy. In an important industry first, Sipera SLiC enables smartphone VoIP to include smart-card card authentication for accessing enterprise resources, providing unparalleled access control and communications privacy.

As a result, enterprises can:
  • Extend UC and VoIP to smartphones while ensuring privacy and security compliance by seamlessly extending the enterprise security perimeter to these devices.
  • Securely enable office phone functionality on smartphones, such as interoffice extension dialing, no matter where the employee is using the smartphone.
  • Offload cellular minutes to VoIP for dramatic savings, while maintaining confidentiality of mission-critical communications. This enables fully secure utilization of VoIP with dual-mode mobile phones.
  • For the first time ever, use Two-Factor Authentication with smartphone VoIP for enhanced access control.
  • Block threats that result in data leakage, toll fraud and a host of other security risks.
  • Enforce control on incoming voice spam with a one-click option on the phone to black list calls.
  • Easily manage and enforce the enterprise communications security posture on any device in any place, both inside and outside the enterprise border.
This includes office phones, home office UC devices, soft-clients on PCs and, now, smartphones and similar smart mobile devices.

Sipera SLiC already is in use by multiple customers, including a Fortune Global 500 enterprise, which is using Sipera SLiC to securely offload millions of minutes in cellular usage to VoIP. This case study and others will be introduced when Sipera SLiC is unveiled during a special free webinar on UC Security: "The Final Frontier: Secure Unified Communications to Any Device in Any Place".

As the smartphone market has exploded, hundreds of communication applications have been introduced that take advantage of WiFi and data services such as 3G, GPRS and other technologies. But these applications do not natively integrate into the enterprise security infrastructure, making it difficult for communications security managers to ensure communications privacy, data integrity, and other critical security requirements. As a result, employees are using unauthorized VoIP or other UC applications on their smartphones and violating privacy mandates and confidentiality rules, exposing themselves to eavesdropping, and increasing information security risks.

Sipera SLiC solves the smartphone security challenge by integrating the smartphone into the enterprise communications security infrastructure. The solution:
  • Automatically authenticates the smartphone back into the enterprise PBX or call manager.
  • Ensures encryption of IP-based communications.
  • Enforces security policies in real-time.
  • Blocks threats or blacklisted callers.
With SLiC, enterprises can ensure smartphone VoIP communications support compliance with FERPA, GLBA, HIPAA, PCI DSS, Sarbanes-Oxley and other government and industry mandates regarding control and privacy of information.

Sipera SLiC solution consists of:
  • Sipera's award-winning UC-Sec security appliance, deployed in the enterprise VoIP or UC network and providing encryption, access control and authentication, policy enforcement, and threat mitigation.
  • Integration and interoperability of UC-Sec with the enterprise's smartphones, which could be complemented by the Sipera SLiC Client, available for leading smartphone operating systems.
Mobile UC security will be the focus of a free webinar sponsored by Sipera on Wednesday, Oct. 28, at Noon Eastern time: "The Final Frontier: Secure Unified Communications to Any Device in Any Place." Featuring Aberdeen Group Senior Research Analyst Andrew Borg, the webinar will review the latest industry research, costs analysis, case studies and best practices for deploying UC, including to smartphones.


20/08/2009 - Scicom Americas deploys Sipera's SIP solution for call center services

Business Process Outsourcing provider Scicom Americas announced that Cross Telecom and Sipera will provide Unified Communications security appliances and SIP trunk termination for its distributed call center services. Offering outsourced, distributed call center services to Fortune 500 and other large enterprise clients, Scicom has deployed Avaya's UC and VoIP technologies. Working with telecom integrator Cross Telecom, Scicom will leverage Sipera's UC-Sec appliances to provide security and SIP trunk termination for its distributed call centers. 

Sipera's UC-Sec security appliance provides VoIP and UC security on multiple levels, including privacy (encryption), access control, threat mitigation, and security policy enforcement. By leveraging the added security features of Sipera's UC security appliance, Scicom's clients will be able to meet specialized security requirements, such as PCI DSS (credit cards), HIPAA (healthcare privacy), GLBA (consumer data protection), and FERPA (student record privacy).

"Our clients can rest assured that their mission-critical call center communications handled by Scicom are secure," said Ramesh Ariyanayakam, Chief Operating Officer, Scicom Americas in a press release. "We chose to work with Sipera because its innovative VoIP and Unified Communications security solutions enable our clients to rely on us to safeguard their communications."  

For more:
- see the press release here

Related articles
Sipera targets VoIP toll fraud
Sipera partner network arms resellers with comprehensive UC and VoIP security


14/08/2009 - InterAct First to Validate Next Generation 9-1-1 Architecture


InterAct, a provider of software for enterprises and government agencies, announced the successful integration with proposed Next Generation 9-1-1 architecture. The company is the only provider to completely process end-to-end NG9-1-1 calls from the caller to the Computer-Aided Dispatch (CAD) and Geographic Information mapping systems (GIS) using nothing but IP connections.

08/07/2009 - Sipera adds Empirix's Hammer to testing solution

Sipera Systems, a unified communications security provider, announced that it is deploying Empirix's Hammer VoIP testing solution to develop VoIP and UC security solution. Sipera said it will use Hammer to discover, prioritize and correct issues with VoIP and UC systems prior to deployment, reducing cost of ownership for the VoIP system.

Empirix's solution supports a wide range of signaling protocols, including UDP, TCP and TLS, which Sipera said allows it to seamlessly test networks using multiple protocols. The Hammer solution is designed to mimic actual end user behavior and devices on voice networks and applications, providing insight into how the network will operate under different use conditions, according to Empirix.

For more:
- see the press release here 

Related articles
Sipera targets VoIP toll fraud
Empirix adds 'pay as you go' testing for contact centers


16/06/2009 - Three indicted for hacking 2,500 company phone systems (PBX)
The acting U.S. attorney in New Jersey unsealed indictments Friday for three people in the Philippines charged with hacking the private branch exchanges (PBX) of more than 2,500 companies for stealing pass codes they sold to call center operators in Italy.

Italian officials allege the sale of the pass codes helped finance terrorist activities, IDG News Service reported. On Friday, Italian officials arrested at least five people in raids on 10 call centers.

The three indicted in the U.S. are charged with conspiracy to commit wire fraud, unauthorized access to computers and other charges, according to U.S. attorney Ralph J. Marra, Jr.

"The hackers we've charged enabled their conspirators in Italy and elsewhere to steal large amounts of telecommunications capacity, which could then be used to further or finance just about any sort of nefarious activity here or overseas," Marra said.

Pakistani nationals in Italy used the stolen codes to offer cheap calls to their clients on the PBXs of commercial companies in the United States, Australia and Europe.

Some of the profits from the scam were used to finance the activities of Islamist extremists in Pakistan and Afghanistan, Italian officials said, according to the IDG News report.

Marra said the hackers dialed into the PBXs and used a process known as a brute force attack to hit vulnerable points of the PBX systems.

Source: IDG News Service
ADNFCR-1765-ID-19218792-ADNFCR


03/06/2009 - SIP Security Book Gives a Detailed Overview of SIP Security Issues
Research and Markets has announced the addition of John Wiley and Sons Ltd's new report "SIP Security" to their offering.

This book gives a detailed overview of SIP specific security issues and how to solve them. While the standards and products for VoIP and SIP services have reached market maturity, security and regulatory aspects of such services are still being discussed. SIP itself specifies only a basic set of security mechanisms that cover a subset of possible security issues. In this book, the authors survey important aspects of securing SIP-based services. This encompasses a description of the problems themselves and the standards-based solutions for such problems. Where a standards-based solution has not been defined, the alternatives are discussed and the benefits and constraints of the different solutions are highlighted.

Key Features:
  • Will help the readers to understand the actual problems of using and developing VoIP services, and to distinguish between real problems and the general hype of VoIP security
  • Discusses key aspects of SIP security including authentication, integrity, confidentiality, non-repudiation and signalling
  • Assesses the real security issues facing users of SIP, and details the latest theoretical and practical solutions to SIP Security issues
  • Covers secure SIP access, inter-provider secure communication, media security, security of the IMS infrastructures as well as VoIP services
Vulnerabilities and countermeasures against Denial-of-Service attacks and VoIP spam this book will be of interest to IT staff involved in deploying and developing VoIP, service users of SIP, network engineers, designers and managers. Advanced undergraduate and graduate students studying data/voice/multimedia communications as well as researchers in academia and industry will also find this book valuable.


05/05/2009 - Tone Commander Intros Military-Grade Secure IP Phone - 7810 TSG-6

Tone Commander has introduced the industry’s first TSG-6 SIP-compliant phone. In addition, it announced that the National Telecommunications Security Working Group (NTSWG) has approved the device for government and military use.

 

The NTSWG, formerly known as the Telecommunications Security Group (TSG), is a Joint Working Group of the Committee on National Security Systems (CNSS), which was established under EO 13231 to protect National Security Systems. The TSG issued "standards" as the primary technical and policy resource for all aspects of the Technical Surveillance Countermeasures (TSCM) Program within the U.S. Intelligence Community. TSG Standard 6 (Updated January 2005) is a compilation of TSG-approved telephone security equipment. These items have been specifically evaluated by the NTSWG for security effectiveness.

The 7810 TSG-6 IP phone enables integration wherever IP networks are available and provides security and encryption options for customers who require ultra-secure communications. For example, it offers RTP voice encryption (AES-128) and TLS signaling encryption included in FIPS 140-2 approved algorithms. It also offers DoD features specified in DISN RTS GSR (Defense Information Systems Network, Real Time Services, Generic Systems Requirements) as well as multilevel precedence and preemption, providing barge-in capabilities for high-priority calls.

The Tone Commander 7810 TSG-6 IP phone is Class-A compliant and can be used in Sensitive Compartmented Information Facilities (SCIF) areas without any other equipment for on-hook security. Special positive metallic-disconnect circuitry is built in to guarantee that no unintended microphonic audio signals are produced on any wires leaving the phone. Moreover, additional built-in circuitry completely disconnects the phone from the network when power is removed.

Tone Commander’s 7810 TSG-6 IP phone is priced at $880.50 for retail or $599 for GSA eligible customers.

Source: Phone Plus Mag


22/04/2009 - Encrypting Voice Calls Between Offices and Mobile Cell Phones
Security vendor, Cellcrypt has announced an application which enables encrypted voice calls from smartphones to conventional office landline phones. The Cellcrypt PBX Gateway integrates with commercial office PBX systems and allows users to complete encrypted voice calls from existing landlines to mobile smartphones that are running Cellcrypt Mobile software.

The PBX Gateway also enables encrypted voice calls between landline locations that have PBX Gateway installed; for instance between offices in different locations.

Cellcrypt technology is currently undergoing certification to the FIPS 140-2 standard approved by the US National Institute of Standard (NIST).

“Organisations spend significant amounts of effort and budget securing their data but until now have not had a viable solution for voice data,” said Simon Bransfield-Garth, CEO at Cellcrypt. “While traditional secure voice solutions have provided poor call quality and fail across most international boundaries, Cellcrypt offers unparalleled voice quality, government-specification security and global coverage never before experienced, all using standard smartphone and PBX technology.”

Source: Cellular News


09/12/2008 - FBI Warns of New Vishing Attacks Targeting PBX Systems
factech_0501.gifThe FBI has identified a new technique used to conduct vishing attacks where hackers exploit a known security vulnerability in Asterisk softwar e. Asterisk is free and widely used software developed to integrate PBX systems with VoIP digital Internet voice calling services; however, early versions of the Asterisk software are known to have a vulnerability. The vulnerability can be exploited by cyber criminals to use the system as an auto dialer, generating thousands of vishing telephone calls to consumers within one hour.

Digium released a Security Advisory, AST-2008-003, in March 2008, which contains the information necessary for users to configure a system, patch the software, or upgrade the software to protect against this vulnerability.

If a consumer falls victim to this exploit, their personally identifiable information (PII) will be compromised. To prevent further loss of consumers? PII and to reduce the spread of this new technique, it is imperative that businesses using Asterisk upgrade their software to a version that has had the vulnerability fixed.

Further, consumers should not release personal information in response to unsolicited telephone calls. Providing your PII will compromise your identity.

?As with all types of scams, whether by computer, phone, or mail, using common sense can protect you,? said Special Agent Richard Kolko, Chief, National Press Office, Washington, D.C.

To receive the latest information about cyber scams, please go to the FBI website and sign up for e-mail alerts by clicking on one of the red envelopes. If you have received a scam e-mail, please notify the IC3 by filing a complaint at www.ic3.gov. For more information on e-scams, please visit the FBI's New E-Scams and Warnings webpage.


21/11/2008 - Security tool for VoIP solutions released

A new tool which allows enterprises to assess if their VoIP solutions are vulnerable to targeted eavesdropping has been released.
UCSniff, from Sipera Systems' VIPER Lab, is a free application which allows network managers find out how easy it is to imitate an enterprise VoIP phone, download a directory and then listen in on confidential calls.

30/10/2008 - Hacking VoIP: New Book Shows How Easy it Is to Attack VoIP
VoIP is an increasingly widespread new technology that allows users to escape the tyranny of big telecom and make phone calls over the Internet. But while VoIP may be cheap and convenient, it's notoriously lacking in security. With little effort, attackers can eavesdrop on conversations, disrupt phone calls, inject content into existing conversations, change caller IDs, and access sensitive information?all without the awareness of the VoIP users making the phone calls.

Hacking VoIP approaches VoIP security from two angles, explaining VoIP's many security holes to both hackers and administrators. The book raises awareness of the importance of VoIP security, describes potential attacks, explains VoIP's biggest weaknesses, and offers solutions for protecting against potential exposure and attacks. Readers learn how to defend against VoIP attacks as they explore issues with VoIP security and the boundaries of VoIP protocols.

"VoIP is fun, but it's remarkably easy to attack," said No Starch Press founder Bill Pollock. "People think that when they pick up the telephone they're on a secure line, but not when that call is being made over VoIP. Hacking VoIP demonstrates just how easy it is to attack VoIP, and how best to plug those security holes."

Hacking VoIP explains every aspect of VoIP security, discusses popular security assessment tools, and explores the inherent vulnerabilities of common hardware and software packages. Readers learn how to:
  • Identify and defend against VoIP security attacks such as eavesdropping, audio injection, caller ID spoofing, and VoIP phishing
  • Audit VoIP network security and assess the security of enterprise-level VoIP networks such as Cisco, Avaya, and Asterisk and home implementations like Yahoo! and Vonage
  • Use VoIP protocols like H.323, SIP, RTP, and IAX
  • Locate potential vulnerabilities in any VoIP network
  • Use both existing and newly released VoIP security tools
Whether setting up and defending VoIP networks against attacks or just having sick fun testing the limits of VoIP security, Hacking VoIP is every user's go-to source for VoIP security and defense.


08/10/2008 - Cellcrypt Looks to Address Growing Concerns about Voice Security
Cellcrypt is on a mission to appoint key channel partners worldwide to address the increasing concern about voice security. Many individuals and organisations have recognised the issue of voice security, however traditional encrypted mobile phones have severe limitations. Cellcrypt Mobile breaks through these barriers allowing resellers to offer dramatically improved solutions to existing customers and to reach customers whose problems they haven?t been able to solve until now.

While the risk of telephone calls being tapped has long been recognised, recent technology changes have increased the risk; this has led to a greater demand for voice security as individual?s and organisations? integrity is threatened by risks to sensitive information in M&A transactions, corporate strategy, executive conference calls, contract negotiations, intellectual property discussions, investor relations, board discussions, increasingly across international boundaries.

Until now, secure mobile phone solutions have used the CSD data channel to transmit calls, which creates three major drawbacks: poor voice quality; long latency; and the inability to make international calls reliably. Cellcrypt Mobile makes secure calls over a mobile internet connection, allowing it to overcome all these issues, with the added benefit of low cost calls.

Cellcrypt?s new programme creates opportunities for partners to reach new and existing customers with a highly differentiated product that generates recurring revenues. The programme offers a strong financial incentive programme; a complete training curriculum; access to technical support services; and marketing, selling, and skills enablement.

Cellcrypt Mobile is a software application that, when installed on standard smartphones, encrypts voice calls between the mobile phones without impacting call quality. Cellcrypt Mobile uses high grade encryption and a very efficient VOIP implementation to deliver secure voice calls with low latency across 3G, WiFi, and GPRS networks.