Voip & Wireless Pentesting

Voice over IP (VoIP) has finally come of age and is being rapidly embraced across most markets as an alternative to the traditional public-switched telephone network (PSTN). VoIP is a broad term, describing many different types of applications (hard phones, softphones, proxy servers, Instant Messaging clients, peer-to-peer clients, and so on), installed on a wide variety of platforms (Linux, Windows, VxWorks, mobile devices, PCs, and so on), and using a wide variety of both proprietary and open protocols (SIP, RTP, H.323, MGCP, SCCP, Unistim, SRTP, ZRTP, and so on) that depend heavily on your preexisting data network's infrastructure and services (routers, switches, DNS, TFTP, DHCP, VPNs, VLANs and so on). Correspondingly, VoIP security is just as broad a subject thanks to the heterogeneous nature of these environments found in the consumer, enterprise, carrier, and small/medium–sized business markets.

In order to narrow the focus, Scanyoursecurity decided to cater mainly to the enterprise IT audience and include some of the more popular deployments in our target list. Because VoIP packetizes phone calls through the same routes used by traditional enterprise data networks today, it is consequently prone to the very same cyber threats that plague those same networks. These include denial-of service attacks, worms, viruses, and general hacker exploitation. For instance, if your enterprise is under attack from a distributed denial of service (DDoS) attack, internal users' web browsing might be slower than normal. A DDoS attack on a VoIP-enabled network can completely cripple your VoIP applications, at least to the point where conversations are unintelligible.

In addition to these traditional network security and availability concerns, there are also a plethora of new VoIP protocol implementations that have yet to undergo detailed security analysis and scrutiny. Most major enterprise VoIP vendors are integrating the up-and-coming Session Initiation Protocol (SIP) into their products. As a result, SIP-specific attacks such as registration hijacking, BYE call teardown, and INVITE flooding are also likely to emerge—not to mention the plethora of financially motivated nuisances such as Spam over Internet Telephony (SPIT) and the voice phishing attacks that are just beginning to bleed into the VoIP realm.

There is no one silver bullet to solving current and emerging VoIP security problems. Rather, a well-planned defence-in-depth approach that extends your current security policy is your best bet to mitigate the current and emerging threats to VoIP. Also Scanyoursecurity follows marked points as below on Voip Testing;

  • Find out how hackers footprint, scan, enumerate, and pilfer VoIP networks and hardware
  • Fortify Cisco, Avaya, and Asterisk systems
  • Prevent DNS poisoning, DHCP exhaustion, and ARP table manipulation Thwart number harvesting, call pattern tracking, and conversation eavesdropping
  • Measure and maintain VoIP network quality of service and VoIP conversation quality
  • Stop DoS and packet flood-based attacks from disrupting SIP proxies and phones
  • Counter REGISTER hijacking, INVITE flooding, and BYE call teardown attacks
  • Avoid insertion/mixing of malicious audio Learn about voice SPAM/SPIT and how to prevent
  • Defend against voice phishing and identity theft scams

Wireless Security testing

Scanyoursecurity Wireless Testing examines the subsystems, components and security mechanisms of a wireless network and identifies any weaknesses.