SIP is everywhere these days. And with any new technology standard, making a transition to it needs to be easy and secure. Patton, a Washington, D.C.-area based technology company, has just released its SmartNode 5200 Session Border Control to help businesses interested in SIP make an easy conversion.

The new SBC will provide security and any-to-any connections for SIP calls where the legacy firewall or Edge Router are SIP unaware. In addition, the SmartNode 5200 offers cost savings by including advanced IP router, QoS, VoIP-VPN security, least-cost call routing and IP-link redundancy all in one device.

The new offering is targeted at businesses with 50 or less employees when using the built-in virtual firewall. For companies with 50 to 250 employees the SBC can forward SIP messages to an external firewall to handle security.

For more:
- read this release
- read the company website info on the new offering

Related articles
Acme Packet retains SBC crown
Enterprise SBC revenue to increase 49% annually through 2013
Ingate intros new E-SBC for SIP

AT&T announces it now serves 1 million AT&T U-verse Voice digital home phone lines. The milestone comes two years after AT&T introduced the advanced VoIP service, which is now available to millions of homes across 22 states.

AT&T U-verse Voice is a next-generation digital voice service delivered over the AT&T U-verse IP network. More than 67 percent of new U-verse TV customers bundle U-verse Voice service.

AT&T added 248,000 U-verse TV subscribers in the fourth quarter of 2009, totaling 2.1 million U-verse TV subscribers nationwide and adding 1 million U-verse TV customers in the last year alone.

Since the commercial launch of U-verse Voice in January 2008, AT&T has continued to enhance the service and expand availability to provide more choices for consumers. U-verse Voice is now available in all 120 markets that offer U-verse TV, giving consumers another option for their home phone services.

U-verse customers benefit from flexible triple- and quad-play bundles. Customers can choose from multiple combinations of U-verse TV, U-verse Voice, U-verse High Speed Internet and AT&T wireless plans that offer significant savings and integrated features. As of the end of 2009, more than 90 percent of U-verse TV customers bundle High Speed Internet, and more than 75 percent of U-verse TV customers have a triple- or quad-play.

U-verse Voice customers also enjoy unmatched calling features that provide deeper integration across their bundle. For example, customers have a single, combined voice mailbox for convenient access to their AT&T U-verse Voice and AT&T wireless messages. They can also view their call logs on their PC or their TV screen, and initiate a call from their PC or TV. Last fall, AT&T started a market-by-market rollout of Caller ID on TV, which lets U-verse TV and Voice customers view caller ID and voicemail notifications on their TV screen.

AT&T's consumer services head, Ralph de la Vega made some interesting remarks that might effect the growth of mobile VoIP on Wednesday. Speaking at the UBS investor conference, de la Vega said that AT&T would soon give heavy mobile data users an incentive to cut back on their data usage.

According to AT&T 40 percent of data usage on the iPhone came from streaming audio and video data by about 4 percent of the user base. With audio streaming lumped into the offending sum, one has to wonder if this is going to cramp mobile VoIP's style. According to Apple Insider, "the average iPhone user consumes 10 times the bandwidth of a typical smartphone user." And that figure probably will only grow once AT&T and Apple make good on their promise to enable VoIP over 3G applications.

For more:
- read this blog post

Related articles
AT&T flip-flops, allows VoIP apps on iPhone
AT&T extends VoIP over 3G to iPhone users
Vonage Mobile for iPhone and Blackberry now ready for download
Speakeasy looks for a piece of iPhone action

AT&T U-verse is using the most advanced technology to revolutionize what Atlanta area consumers can do with their home phones. AT&T announces the availability of AT&T U-verse Voice in parts of Atlanta and the surrounding counties, bringing consumers a next-generation digital voice service delivered over the AT&T U-verse Internet Protocol network.

AT&T U-verse Voice is available to eligible U-verse TV customers in the Atlanta area, and brings together your home phone, wireless, broadband and TV services — all on one bill — with unique features that provide a new level of integration, convenience and control.

Since introducing AT&T U-verse in Atlanta in May 2008, AT&T has continually made the service available to more customers on an ongoing basis. AT&T U-verse TV, U-verse High Speed Internet and U-verse Voice services are available today in parts of metro Atlanta and surrounding areas including, Athens/Clarke, Barrow, Butts, Camden, Clayton, Cobb, Coweta, DeKalb, Douglas, Fayette, Floyd, Forsyth, Fulton, Glynn, Gordon, Gwinnett, Hall, Henry, Jackson, Jasper, Lamar, Madison, Newton, Oconee, Paulding, Pike, Rockdale, Spalding, Troup and Walton Counties.

Researchers at Secure Science have discovered methods to make unauthorized calls from both Skype and the Google Voice services.  Add botnets for massive dialing and let the fun (not) begin. Google says it has patched the hole; Skype isn't commenting.

Secure Science was able to leverage an online service called SpoofCard to display a different caller ID and leveraged the fact that neither Google Voice or Skype require a password to access their voicemail systems. The Skype attack would require a victim to visit a website within 30 minutes of being logged into Skype, but once done an attacker could add a specific call forwarding number, grant an attacker ability to receive the victim's incoming calls, get a Skype-To-Go number, and the ability to access victim's a voicemail, speed dial, and outbound calling via spoofed Caller-ID (i.e. where SpoofCard comes in).

Within Google Voice, an attacker could even intercept or listen on incoming calls, using the Temporary Call Forwarding feature to add another number to an account, then using something like Asterisk to answer the call before a victim could hear a ring. An attacker would need to know the victim's phone number, but Secure has figured out a way to do this through Google's Voice SMS feature.

Google said it has patched the bugs enabling Secure Science's attack, and has added a password for its voice system. It also said that a lot of things would have to go right at the same time for Secure's technique to work.

A spokesperson for Secure Science says the Skype vulnerabilities have not yet been fixed and Skype parent eBay wasn't commenting.

For more:
- IDG News Service via PC World. Post.

Related articles
Skype responds to earlier security breach - FierceVoIP
A Skype Back Door? - FierceVoIP
Skype Wiretap Nuances - FierceVoIP

As soon as Skype released its iPhone application,  problems emerged with using it with carriers both in Europe and the US.
In a USA Today article last week, a senior AT&T official, Jim Cicconi, suggested that the carrier, in cooperation with Apple, expects device vendors to block consumers' access to Skype's VoIP application that competes with AT&T's own voice service. "Skype is a competitor, just like Verizon or Sprint or T-Mobile,” he said.

Two recently released VoIP vulnerability reports have stirred up security thinking once again. But you have to love the name "INVITE of Death."

The aforementioned INVITE takes advantage of using a malformed call request (INVITE) to trigger a service failure in the OpenSBC Server, an open source session border controller. INVITE of Death crashes the OpenSBC server, resulting in denial of service for calls. The fix is relatively straight forward - strip out leading and trailing colons in a couple of places - but it does highlight the need to keep track of version updates with critical code.

SIP Digest authentication relay attack, on the other hand, takes advantage of protocol design features and has now been documented in an IETF draft. The attack relies on making a call to a target device and then sending a designed sequence of valid messages to trick the target device into authenticating a second call made by the attacker.  An attacker could use the technique to make calls through a commercial service provider at the victim's expense.

For more:
- ITProPortal talks about the latest VoIP security threats. Post.

Related articles
VoIP security firms stand to gain from SIP deployments - FierceVoIP
The latest book for VoIP Security - FierceVoIP

The evolution of the media phone product segment may just be beginning but it has the potential to become the 4th screen in the home.
That's according to a report by In-Stat, which said the device could also become a next generation business IP phone.

AT&T is reportedly working on a U-Verse IPTV box with Femtocell capabilities, claims an employee. This unit will cover TV, telephone, internet and improve your cellular reception. Being the owner of a iPhone with fairly weak AT&T reception in portions of my apartment, I'm excited to hear any news on Femtocell's to help improve my cell phone coverage.

The all-in-one box is supposed to come in 2010, while U-Verse continues to expand throughout the U.S. However, in addition to this news comes the 3G Microcell, AT&T's stand alone Femtocell pictured (right), is confirmed to be out in Q2 of 2009.

Consumers looking to cut costs without sacrificing satisfaction for Internet, television, and telephone service should consider bundling with Verizon FiOS or AT&T U-verse. In Consumer Reports' latest survey of major telecom providers and bundled services, featured in the February issue, Verizon FiOS and AT&T U-verse, whose networks are fiber-optic based, were the most consistently satisfying providers for their Internet, television, and telephone services.

Because Verizon FiOS and AT&T U-verse are not available everywhere, many consumers must consider other options for Internet, phone and TV services. The article also includes Ratings of these three services, which are typically bundled, from various providers.

In areas where telco-delivered service is not available, a highly-rated cable company is the next-best choice for many households. Consumers may not have an option when choosing a cable provider because a majority of homes only have one cable company available in their area. According to Consumer Reports' survey, better cable companies include Cox, Cablevision and the smaller Bright House and Wow, which are fine alternatives to fiber-optic service providers for all three services in areas that they are available and also offer Internet and telephone services.

If television service is a priority and fiber-optic service isn't available, satellite service may be a fine option. Consumer Reports suggests opting for a bundle that includes DirecTV. It scored higher than all the major cable companies and Dish Network, the other major provider of satellite service, for TV picture, sound and channel selection. It is also offered in hybrid bundles along with DSL Internet and landline phone service from some telephone providers.

Bundling Prices Decline

Intense competition for cable and satellite customers between AT&T U-verse and Verizon FiOS high-speed fiber providers has driven down rates for Internet, phone and TV service and is likely the reason that companies allow these savings to continue past the promotional period. In the past year, bundles of the three services have dropped in price by up to 20 percent, to as low as $80 a month.

Bundling makes sense for many households, especially for those consumers who are served by one of the fiber carriers or one of the better cable companies. Consumer Reports' latest survey found that subscribers were very satisfied with Internet, phone and TV from the best telecom providers. However, bundling doesn't come without some problems. The survey revealed a high incidence of complaints about billing, and fees with some providers' triple-play packages. Despite its high marks overall, Verizon FiOS was below average for customer service to its triple-play customers. Cable companies that bundle services had fewer customer-service problems overall.

How to Choose

• Check alternatives. Only a small percentage of homes have two cable companies to choose from; most only have one. Satellite is more widely available, provided a home has an unobstructed view of the horizon to the southwest. DSL is widely available in urban and suburban neighborhoods. While fiber-optic service, such as Verizon FiOS and U-verse from AT&T, is spreading fast, it is still only available in about 8.5 million homes in about one-third of the states.
• Weight the case for bundling. With most providers, signing up for more services equals more savings. Bundles allow for integrated services, such as display of callers' phone numbers on the TV screen, which is offered with some phone/cable packages. Triple-play offers often come sweetened with more extras, such as free installation. Consumers may also be guaranteed low rates for a longer period of time with triple-play than when subscribing to services one at a time.
• Don't rule out a la carte. Taking fewer than three services from any one provider allows flexibility. Spreading service among a few carriers also eliminates the possibility that a network or equipment failure will knock out all telecom services. Although bundles usually ensure maximum savings, Consumer Reports found at least one instance where the cost of the service taken individually was actually lower than when it was part of a package.
• Consider phone safety. Cable VoIP and fiber phone service require a battery back-up to use during power outages. These battery backups may be provided or have to be purchased for an additional fee. Additionally, if an outage lasts longer than the battery backup, consumers may be left without a phone for the remainder of the outage. Emergency 911 service varies among technologies. Consumer Reports recommends supplementing VoIP service with basic landline service for use in 911 calls.
• Fine-tune by other attributes. Consumer Reports Ratings reveal that providers differ in more than their customers' overall satisfaction. Consumers should determine which TV providers carry programming they desire. Keep in mind that fiber and satellite usually have a termination fee but cable does not.

How to Get the Best Price

• Check rates, then check again. Consumers should scour the provider's Web site for the best deals, and ask a customer rep if the price quoted is the company's absolute best offer. Consider checking again. Consumer Reports found that rates could change, seemingly by the representative who took the call.
• Negotiate. It can pay off, particularly in areas where there's competition between a cable provider and a traditional telephone company, and when a promotional rate is expiring. Ask for a reduced price or free extras, such as installation or a premium channel at no cost.
• Ask for sample bills. Before finalizing a deal, ask for a summary of all charges for the first and subsequent months. Confirm that the figures include all taxes and fees, and one-time expenses such as a charge to keep an existing phone number. Try to get all the information in writing. Check the figures later against the actual bills.
• Fine-tune extras. As a rule, consumers shouldn't pay more for higher-speed Internet service unless they are doing a lot of downloading or sharing of lengthy videos or other very large files. Most VoIP and fiber-based phone plans include caller ID, answering service, and unlimited local and long-distance calling in the U.S., Canada and Puerto Rico, and sometimes other countries. Check that these features don't disappear or that the bill doesn't increase once the promotional period ends.

The complete report and Ratings are available in the February 2009 issue of Consumer Reports.

How do you avoid being phished over VoIP? No, we're not talking about a Ben and Jerry's flavor, we're discussing the tactic of being called up over the phone and being socially engineered into disclosing confidential information.  

Phishing is now a widespread tactic, with bogus emails spammed out on a daily basis. Initial attacks were mostly for-profit in nature, with an inbox letter posing as a bank or the IRS requesting security and personal information. The information would then be utilized by the attacker for either a simple credit card exploit or a more elaborate identity theft exploit. Varients such as Spear Phising and Vishing are now in vogue, but phishing attacks can be broken down into four parts: Redirect, Disclosure, Impersonation and Unauthorized Usage.

Vishing is a faster way to gain information if the attacker feels confident in his or her social engineering skills. In the days before computers, this was known as "The art of the con."  Regardless, we still have to wonder if J. Michael Straczynski understood he was writing a double-entendre when he penned the line, "Who do you serve? And who do you trust?" A look at the general practices of phishing can help in the development of strategies against vishing.

For more:
- TopTechNews breaks down Phishing and Vishing. Article

Related articles
Trend: "Vishing," VoIP phishing on the rise - FierceVoIP
VoIP Security and the Circle of Trust - FierceVoIP

If you haven't worried enough about VoIP security, UCSniff has been released officially by the Sipera Viper Lab.

First unveiled at the Toorcon security conference in late September, UCSniff allows you to target users based on corporate directory and/or extensions, record entire voice conversations, discover and hope VLANs, perform man-in-the-middle (MitM) redirection and plenty more. Sipera has now made the tool available for public download, so, if you want to really torque off your security and IT people, you could record and email them a couple of their phone calls.

If you want really scary/really paranoid thoughts, since UCSniff (and of course, a lot of other security tools) are written in C and available for Linux systems, an attacker could buy a $300 Netbook, install it in a phone closet somewhere, and with a little hackwork, record and email your conversations outside the office.

Hmm, maybe its time to re-install the old key system...

For more:
- Read the quick blog post at Dark Reading.

Related articles
UCSniff targets VoIP, UC, and the inside job - FierceVoIP
Sipera Systems, Top VoIP Company 2008: FierceVoIP, Fierce 15 ...

AT&T U-verse Voice in launches in parts of Northeastern Illinois, bringing consumers a next-generation digital voice service delivered over the AT&T U-verse Internet Protocol network. U-verse Voice brings together your AT&T home phone, wireless, broadband and TV services all on one bill with unique features that provide a new level of integration, convenience and control.

AT&T U-verse Voice completes the company's IP triple play and is available to all new and existing U-verse TV customers in the Northeastern Illinois area. With U-verse Voice, customers receive new features that highlight the benefits of having advanced video, broadband, wireless and home phone services from a single provider.

AT&T U-verse Voice is a managed IP-based service that is delivered over AT&T's fiber-rich network, unlike many VoIP providers that offer best-effort digital phone services over the public Internet. This allows U-verse Voice customers to enjoy great sound quality and reliability, as well as unmatched calling features that combine with your AT&T U-verse TV, broadband and wireless services from AT&T.