« INTEROP: NAC Frustration is Mounting | Main | Device Driver Updates Deactivate Vista »
October 24, 2007
Security Company Announces Four Vonage Vulnerabilities
Sipera says it has found a number of vulnerabilities in pieces of Vonage’s VoIP implementation:
“Sipera VIPER Lab determined the Vonage VoIP Motorola Phone Adapter (VT 2142-VD) and Vonage service implementations leave users vulnerable to a form of VoIP identity theft, allowing hackers to take over a user’s phone service with a ‘registration replay attack,’ then make and receive calls while impersonating the victim. Incomplete security practices, such as not encrypting traffic, open Vonage users to eavesdropping on private voice and video communications. Hackers can also send multiple SIP INVITE messages to a user, an Internet version of ‘ringing the phone off the hook’ which creates a DoS attack. Leveraging these vulnerabilities, remote attackers can also send malicious messages directly to Vonage users, subjecting them to spam, social engineering and VoIP scams.”
- Vonage VoIP phone adapter vulnerable to server impersonation (link)
- Vonage SIP servers vulnerable to registration replay attack (link)
- Vonage voice conversation may be vulnerable to eavesdropping (link)
- Vonage VoIP phone adapter vulnerable to flood Denial of Service attack (link)
(via Reuters, which says Vonage has no comment.)
Posted by mhall at 6:50 PM | Add Comment
Leave a comment