CCSP CSI Exam Certification: SAFE IP Telephony Design

This chapter is from the book

CCSP CSI Exam Certification Guide, 2nd Edition

Learn More Buy

This chapter is from the book

This chapter is from the book 

CCSP CSI Exam Certification Guide, 2nd Edition

Learn More Buy

Foundation Topics

Examining SAFE IP Telephony Design Fundamentals

The "SAFE: IP Telephony Security in Depth" whitepaper provides best-practice information for the deployment of IP telephony in the various SAFE blueprints. Although this whitepaper covers a wide range of topics related to IP telephony, it does not discuss many other topics, including quality of service (QoS) applied to the voice traffic to eliminate echoes and jitter, and the security of the voice protocols between the voice gateways. Because of the nature of IP telephony and the requirements for low latency, QoS is an extremely important feature that you must enable network-wide before deploying IP telephony. The whitepaper focuses on centralized call processing, not distributed call processing. It is assumed, however, that all remote sites have a redundant link to the headend or the local call-processing backup, in case of headend failure. Finally, the interaction between IP telephony and Network Address Translation (NAT) is not covered.

The following design objectives guided the decision-making process for the SAFE IP telephony whitepaper:

• Security and attack mitigation based on policy

• Quality of service

• Reliability, performance, and scalability

• Authentication of users and devices (identity)

• Options for high availability (some designs)

• Secure management

The SAFE IP telephony design must provide telephony services in the same way that current telephony services are deployed. In addition, it must maintain the same characteristics as traditional telephony in as secure a manner as possible. Finally, it must integrate with existing network designs.

IP Telephony Network Components

IP telephony adds four voice-specific devices to a network:

• IP telephony devices—This category includes any device that supports placing calls in an IP telephony network, such as IP phones and PC softphones (IP phone software running on a PC).

• Call-processing manager—This system is the server that provides call control and configuration management for IP telephony devices in the network. It provides bootstrap information for IP telephony devices, call setup, and call routing throughout the network to other voice-enabled devices such as voice gateways and voice-mail systems.

• Voice-mail system—This system primarily provides IP-based voice-mail storage services. In addition, it can provide user directory lookup capabilities and call-forwarding features.

• Voice gateway—This is a generic term that refers to any gateway that provides voice services, such as IP packet routing, backup call processing, Public Switched Telephone Network (PSTN) access, and other voice services. This device is the interface between the legacy voice systems that can provide backup for the IP telephony network in case of failure. This device is typically not a full-featured call-processing manager; it supports a subset of the call-processing functionality provided by the call-processing manager.

VoIP Protocols

At the time of writing of the "SAFE: IP Telephony Security in Depth" whitepaper, these were the three predominant protocol standards for voice over IP (VoIP):

• H.323

• Session Initiation Protocol (SIP)

• Media Gateway Control Protocol (MGCP)

The following sections describe each standard in detail.

H.323

The International Telecommunication Union (ITU) H.323 standard covers IP devices that participate in and control H.323 sessions, along with elements that interact with switched-circuit networks. This standard does not cover the LAN itself or the transport layer within the network. H.323 provides for point-to-point or multipoint sessions. The H.323 standard is composed of several components, including other standards that describe call control, signaling, registration, and packetization/synchronization of media streams. Table 19-2 lists these components.

Table 19-2 Core Components of H.323

Ports used for H.245 signaling and media channels dynamically are negotiated between the endpoints. This makes it especially difficult to impose security policy and traffic shaping. Additionally, the control channel of H.245 uses TCP as a transport protocol, but the media stream channels utilize UDP as a transport protocol. For a firewall to be placed between two (or more) H.323 endpoints, the firewall must be either H.323 enabled (that is, it must be intelligent enough to allow H.323 traffic through, appropriately utilizing an H.323 proxy) or it must monitor the control channel to determine which dynamic ports are in use for the H.323 sessions.

SIP

The Session Initiation Protocol (SIP) is an ASCII-encoded application layer control protocol that is defined in RFC 2543. You can use SIP to establish, maintain, and terminate calls between two or more endpoints. Like other protocols, it is designed to address the signaling and session-management functions in an IP telephony network. SIP does this by allowing call information to be carried across network boundaries and also by providing the capability to control calls between any endpoints.

SIP can identify the location of an endpoint through the use of address resolution, name mapping, and call redirection. Additionally, through the use of the Session Description Protocol (SDP), the protocol can determine the least common denominator of possible services between the two endpoints. This provides the capability to establish conference calls using only the media capabilities that all participants can support. SIP also can handle the transfer and termination of calls and the determination of the availability of a given endpoint, and can establish a session between two or more endpoints (as in a conference).

MGCP

The Media Gateway Control Protocol (MGCP) is a master/slave protocol implemented in media gateway controllers or call agents. These controllers/agents run on telephony gateways, which are devices that provide the conversion of data packets used in IP telephony to audio signals that are carried on PSTN circuits. The controllers/agents provide the control, signaling, and processing skills to control the telephony gateways and implement the signaling layers of H.323. To other H.323 devices, these controllers/agents appear as an H.323 gatekeeper or as one or more H.323 endpoints.

Threats to IP Telephony Networks

Various threats are inherent in all networks but are of particular importance where IP telephony is deployed. This section describes the following threats:

• Packet sniffers/call interception

• Virus and Trojan horse applications

• Unauthorized access

• Caller identity spoofing

• Toll fraud

• Repudiation

• IP spoofing

• Denial of service

• Application layer attacks

• Trust exploitation

Packet Sniffers/Call Interception

A packet sniffer can monitor and capture the traffic in a network. A packet sniffer in a voice VLAN can capture unencrypted conversations and save them to a file. These conversations can then be reassembled for listening using such tools as Voice over Misconfigured IP Telephony (VOMIT).

Virus and Trojan Horse Applications

Viruses are malicious software that attached to other files and programs and executed by either the user opening the file or program startup. Examples of viruses include the Melissa virus and the more recent MyDoom and W32.bagle viruses.

A Trojan horse application is a program designed to appear innocuous to the user while it executes additional commands without the user's direct knowledge. A simple example is a computer game that, while the user is playing it, deletes specific files from the machine or installs a back-door mechanism for an external attacker to gain access to the system. A Trojan horse application is of particular concern because if the targeted PC is on the data segment of a network with IP telephony deployed and a PC softphone installed (thereby requiring access to the voice VLAN), an attacker might be able to bypass the segmentation between the two VLANs by installing a Trojan horse application on that system.

Unauthorized Access

Although these are not specific types of attacks, they are the most common attacks executed in today's networks. Many modern IP phones also behave as a switch providing access to both the voice and the data VLAN. An attacker could plug into the back of an IP phone and gain instant access to the network, possibly without requiring authentication.

Caller Identity Spoofing

Caller identity spoofing is much like IP spoofing. The attacker's main goal is to trick a remote user into believing that he or she is communicating with someone other than the attacker. This attack typically requires that the hacker assume the identity of someone who is not familiar to the target and can be either complex enough to require the placement of a rogue IP phone on the network or as simple as using an unattended IP phone.

Toll Fraud

Toll fraud encompasses a wide variety of illegal behavior. Typically, this involves the theft of the phone service. In its most basic form, toll fraud involves an unauthorized user accessing an unattended IP telephone and placing calls. Other attacks include placing a rogue IP phone or gateway in the network to place unauthorized calls.

Repudiation

Repudiation attacks are difficult to mitigate. If two parties talk over the phone and one party decides later to deny that the conversation took place, the other party has no proof that the conversation ever took place. However, call logging can be used to verify that a communication did take place. Without strong user authentication, however, validating who placed the call is not possible.

IP Spoofing

IP spoofing involves the impersonation of a trusted system. To do this, an attacker uses either an IP address that is within the range of trusted IP addresses or a trusted external IP address that also is provided access to target resources on the network. IP spoofing typically is associated with certain types of attacks, such as a denial-of-service (DoS) attack, in which the attacker wants to hide his or her true identity.

Denial of Service

Denial-of-service (DoS) attacks are one of the most difficult attacks to mitigate completely. DoS attacks against the call-processing manager in an IP telephony deployment can bring down the entire phone system.

Application Layer Attacks

Application layer attacks are attacks against an application such as IIS, sendmail, or Oracle that are running on a system. Exploiting weaknesses in these applications can provide an attacker with access (sometimes privileged access) to the system. Because these attacks are against applications that have ports that often are allowed through a firewall, it is critical that these attacks be mitigated through other means. For IP telephony networks, the most important element is the call-processing manager. Because many call-processing managers run a web server for remote access to manage-ment functions, they can be attacked through that application. It is important that a host-based IPS be installed and active on call-processing managers even though they might be protected by a stateful firewall to prevent application layer attacks.

Trust Exploitation

A trust-exploitation attack as it relates to IP telephony can be executed if voice and data servers have a trust relationship. The exploitation of the data server, such as a web server, then could result in the exploitation of the central call-processing manager. This provides the attacker with significant access into not just the data VLAN, but also the voice VLAN.