The Top 9 VoIP Threats For 2008

Whether their purpose is malicious, for financial gain or just to prove it can be done, VoIP systems are a walnut that hackers and exploiters can't wait to crack. And as VoIP continues to proliferate into 2008, those threats will only get stronger and more sophisticated, according to Sachin Joglekar, vulnerability research lead for Sipera Viper Lab, a research team bent on identifying ways VoIP can be exploited.

Joglekar said word of some VoIP threats started to spread in 2006, with toll fraud and vishing—a VoIP version of phishing—taking center stage. By 2007, those threats and vulnerabilities began to manifest further. And this year, by many accounts, exploits used to bring down VoIP systems and scam their users will continue to expand, with many exploits being used in conjunction with another to form an attack powerhouse of sorts.

The biggest VoIP threats and vulnerabilities of 2007 ran the gamut from remote eavesdropping, which entails listening in on VoIP calls—easier in VoIP than with traditional PSTN telephone networks; VoIP hopping, which can allow a PC to mimic an IP phone and could give intruders the ability to access the VoIP system; vishing, which lets hackers spoof caller ID and offer up a fake phone identity; VoIP spam, which is exactly what it sounds like and just as annoying; toll fraud, in which unauthorized users access the VoIP network and finagle free calling while stiffing someone else with the charges; and the Skype worm, which infects the often free, otherwise inexpensive PC-based VoIP service. These threats will continue to make themselves known this year, Joglekar said.

Tim Hebert, president and CEO of Warwick, R.I.-based solution provider Atrion Networking Corp., said VoIP threats have evolved and grown from a "what if?" scenario into a full-blown "what now?"situation. While Hebert said he and his clients have been lucky enough to ward off attacks, he's not resting on his laurels just yet.

"We haven't had any issues with them. Knock on wood," he said. Still, Hebert said Atrion has inherited some clients from other VARs that were ripe for the picking due to poorly designed VoIP networks.

"VoIP is on the early edge, but it's moving from early adopters to the early majority," Hebert said. "There will be more and more threats. It's definitely going to grow."

Next: VoIP Security, Not Yet