VoIP Presents Major Security Risk, Experts Say

Banks and other companies switching their phone systems to voice over IP (VoIP) are making themselves vulnerable to phishing attacks for which there are currently no effective detection or prevention tools, a security researcher warned Wednesday.

“People will be able to penetrate bank networks and hijack their phone lines,” said an independent security researcher, known by his pseudonym The Grugq, in an interview. VoIP is becoming increasingly common as companies and operators look to the technology to help cut costs, which makes them more vulnerable to attack, he said.

The Grugq, who spoke this week at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia, said VoIP phishing attacks will emerge by the end of this year. The attacks will allow hackers to steal personal data, including credit card numbers and bank account information, and there is little security managers can do to stop them.

“Theoretically, you phone up your bank and the customer service line has been taken over by hackers,” The Grugq said.

In this scenario, the customer would be asked by the hacker to enter personal banking information before being passed on to an actual bank customer-service representative. “There’s no security technology out there that companies can deploy to fix this,” The Grugq said, noting that existing intrusion-detection systems are not capable of detecting when a VoIP attack takes place.

During his presentation at the conference, The Grugq announced the release of alpha code for SIPhallis, a tool he wrote that allows security managers to manage Session Initiation Protocol VoIP packets on their networks. “It gives you an interface to create and send VoIP packets; it also allows monitoring of VoIP packets,” he said, adding that the application can also be used to inject packets into a VoIP stream.

Existing soft phone or PBX software is all that is required for hackers to launch a VoIP attack, The Grugq said.

The Hack in the Box conference runs through Thursday, Sept. 21.

-Sumner Lemon, IDG News Service (Singapore Bureau)

Related Links:

• When Voice Becomes Data
• Bruce Schneier: We Are Losing IT Security War

Keep checking in at our CSO Security Feed page for updated news coverage.