Security Threats in VoIP Telephony System

Question: Discuss about the Security Threats in VoIP Telephony System. Answer: Introduction Telecommunications has become a vast and large scale system in the present era and the Voice over Internet Protocol popularly known as VOIP has brought a revolution in the way communications are carried out. VOIP refers to a methodology and a combination of a number of technologies that mark the delivery of the voice and multimedia communication over the Internet Protocol. There are a number of services that are made available through VOIP such as fax, SMS, video chat and many more (Vaishnav, 2016). There are number of several threats that are associated with the VOIP telephony system which have been discussed in the report along with the countermeasures of the same. Literature Review VoIP alludes to transmission of voice over an IP based system. This is a standout amongst the most vital developing patterns in broadcast communications today. For some end clients of conventional altered line phone, lower cost and the more prominent adaptability is exceptionally appealing. Similarly as with numerous new innovations, VoIP presents both favorable circumstances and burdens. An undeniable preferred standpoint is that you with VoIP can possibly bring down your expense for nearby and long separation calls, as VoIP is steered over the Internet and no different phone system is required. There is additionally potential for better nature of the discourse as VoIP can give higher data transfer capacity. Conventional communication gives a genuinely hearty arrangement that works the greater part of the times. VoIP requires different situations to be considered as VoIP can be directed over Internet. The nature of the administration can be uneven, system being used might be profoun dly congested, data can be dropped or defers presented by long separation calls. Another potential downside/disservice is, as VoIP is a genuinely new innovation, the security in VoIP. VoIP activity is as a rule steered on the same system as other system movement, which uncovered the voice for the same security dangers as normal information activity. Numerous suppliers of VoIP don't bolster encryption, making it conceivable to tap a line between conveying parts and listen to discussions. It additionally makes is conceivable to get tones sent from supporters of an administration suppliers that might be a wholesalers of delicate information (Fontanini, 2016). Critical analysis The first resources that has been extensively used in the research is paper on the topic A survey of Attacks on VoIP networks and Countermeasures and has been written by Obidinnu and Ibor. It covers the various attacks that take place in the VOIP environment and also explains the each one of them in complete detail. The primary purpose behind the selection was to bring forward the various forms of attacks that are associated with VOIP and to suggest the countermeasures to avoid and control the same from taking place. The need of the research was to create awareness among the business executives and the users about the level of development and activities that are taking place in the world of VOIP to make them at par with the changing times. It was also essential to bring up the forms of attacks in the limelight to make sure that stronger security practices are followed to keep the information safe and secure at all times and also to guarantee that the incidents of attacks are minimize d. The second resource that has been largely referred is the paper that is written on the topic VoIP Technology: Security Issues Analysis. It has been written by Lazzez and the selection was done to make sure that the services that are made available through the introduction of VOIP are utilized accurately and correctly to make sure that there are no risks involved during the entire procedure. The research has provided the guidelines in the form of the countermeasures to follow that can be incorporated by the organizations all across the globe to provide safer services over VOIP. The research will also benefit the end-users as they will be assured of a medium that is safe to use and will also be aware of the things and steps that can potentially go wrong during the journey. Research problem The information that is shared over VOIP comprises of three essential properties that must be maintained and are also specified in the CIA triad. These properties are Confidentiality, Integrity and Availability of the information. The threats that are associated with VOIP come under these three categories. Confidentiality Threats In order to maintain the confidentiality of the information, it is essential that it is not allowed to be accessed by the unauthorized entities. There are a number of threats that are executed that violate this rule and result in compromise of the confidentiality of the information. Eavesdropping of phone conversation There are a large number of nodes that are present between the several entities in the communications and conversations that take place over VOIP. It becomes easy for the attacker to get hold of the IP address of any of these nodes and listen to the conversation that happens over the same. There are also tools that have been developed by the attackers to save the conversation in the form of files or text document which can be easily misused later on (Xin, 2016). Call Pattern Tracking This is the unauthorized access to the information that takes place with the use of VOIP by analyzing specific call patterns. The attackers track the calls on VOIP to get the list of the participants, time of call, frequency of call and other patterns to understand and estimate essential information associated with the same. For instance, if the attackers acquires information such as a call took place between stock market broker and representative of a particular company then the stock exchange took place and likewise. Data Mining Attacks Email spam is a very popular category of attacks in the present era which is a form of data mining attack. In a similar manner, attackers get hold of the phone numbers through intercepted messages which are a kind of data mining attack. These numbers are then utilized to execute a number of attacks such as fraud calls, spam calls and many others (Park, 2016). Reconstruction Attacks There are also a number of reconstruction attacks in which voice, video or fax is acquired from VOIP and is reconstructed to impart misleading information. Extraction and communication is done without the consent from all the parties that are involved and the access is gained in an unauthorized manner which hampers the confidentiality of the information. Integrity Attacks Integrity attacks are broadly classified in two categories and there are a number of threats under each category that affect the integrity of the data. Integrity is violated when the changes or modifications are done on the data without the authorized permission to perform the same. Message Alteration These are the attacks that take place by making alterations to the message in between the communication such as re-routing the call in an unauthorized manner or making changes in the message that is being transferred to impart misleading information to the receiver. There are a number of entities that may be involved in a call through VOIP. Call re-routing is executed by the attackers to re-route the call and add or remove entities that are not authorized to be a part of the same. Call back holing is another form of message alteration integrity attack in which the call is intentionally delayed by making errors in the set up or increasing the turnaround time or similar activities (Obidinnu and Ibor, 2016). Media Alteration These are the attacks in which there are alterations made to the media that is exchanged in a particular operation and the same takes a toll on the integrity of the media being shared between the source and the destination. Media injection is a popular category of media alteration in which the attacker introduces additional media or injects the same in the active media channel. This entity then becomes the part of the channel and the regular path is altered. Media degrading is another form of media alteration in which an attacker makes modification to the media or the media control which results in the reduction of quality of service and also causes a number of integrity issues (Lazzez, 2016). Availability Attacks These are the attacks that are executed to hamper the availability of the service or communication taking place over VOIP. Call Flooding This is the most popular form of availability attack in which the attacker floods a particular call with unnecessary traffic that eventually leads to break down of the availability of the same (Sonkar, 2016). Media Session Hijacking When the media session is in progress, then the attacker may perform an activity in which the media session is hijacked and the media is re-directed to another endpoint. It causes the unavailability of normal communications and thus affects the availability of the information. Server Impersonating In this form of the attack, the attacker impersonates as the media server, receives the request for a particular communication, sends the response and performs the malicious activity. The availability of the normal communication in this way is not restored and the same causes a severe impact on the particular form of communication. QoS Abuse QoS stands for Quality of Services and these are the attacks which are included under the availability category since they affect the availability of communication with utmost quality. There are also attacks in this specific category in which special tools are used that exhaust the bandwidth of a particular connection or network in VOIP (Shaidani, 2016). Research question The following research questions have been covered in the research that has been conducted on the topic of VOIP attacks and countermeasures are as written under: What is the basic concept of VOIP and what are the possible attacks that are associated with the same? What are the specific attacks that come under the confidentiality property of the information that is shared through VOIP? What are the specific attacks that come under the integrity property of the information that is shared through VOIP? What are the specific attacks that come under the availability property of the information that is shared through VOIP? Which method should be adopted for data collection and what shall be the procedure that must be followed? What are the countermeasures that should be adopted to control the VOIP attacks? Methodology A mixed method has been adopted in the research by collecting the quantitative as well as qualitative method. Many different entities have been used to inquire about the information that is necessary to implement the VOIP techniques in the organization. The nature of attacks can also be determined with the help of collecting the information that is acquired from the various entities. Data Collection Procedure VOIP has gained popularity among the users in the past few years and a lot of work has been done for the betterment of the services that are made available by the same. Also, there are a number of risks that are also developed by the malicious entities to hamper the functioning of the same. There are attacks that are launched in the word of VOIP looking at the massive exchange that takes place over the medium. The success of these attacks allows the attackers to get hold of the important and vital information that is associated with a particular organization. These attacks are done with the use of the network and the information security features and are primarily executed to affect the confidentiality, integrity and availability of the information. Flooding, sniffing, denial of services, message alteration, media alteration, eavesdropping etc are a number of such attacks that take a toll on the information security over VOIP. The countermeasures to these attacks are also developed simultaneously to come up with the strategy to mitigate and control the impact of these attacks on the information. These measures are developed on the basis of the attack and information category. The techniques that have been used for data collection are as follows: Interviews were conducted with the entities in the organizations and with the end users as well to understand the attacks and the services of VOIP. The countermeasures have also been suggested on the basis of the response that was provided by the users. Questionnaires and surveys were also developed and circulated to determine the nature of attacks along with the key areas in which such attacks are more probable in terms of confidentiality, integrity and availability of the data. Narrative data and frequency counts were determined with the help of the observations done on the frequent level. Specialized focus groups were also created to understand and record the various factors associated with the attacks. Responses are then coded in a number of different categories. Oral conversations and case studies are also designed to interact with the people at all the organizational networks and at all the network sources and destinations. Existing data and records associated with the VOIP attacks and their countermeasures that were undertaken were also determined to understand the key areas. Conclusion The method that has been adopted in this particular research is a mix of quantitative and qualitative data collection and a number of techniques have been used for the same such as questionnaires, surveys, interviews and many others. Voice over Internet Protocol (VOIP) comprises of a list of methods and concepts that provide the conversation and communication to take place over Internet Protocol (IP). The technology has enabled the users to take advantage of an easier medium that provides a number of different services and is way ahead of the tradition system that was being followed prior to it. However, there are a number of risks that lie in the path of the services that are offered through VOIP. These risks affect the three primary properties of the information in adverse manners which are confidentiality, integrity and availability. These attacks and risks are also categorized on the basis of these three properties of the information. There are also a number of countermeasures th at have been developed looking at the number, likelihood and the impact of the risks. These countermeasures can allow the organizations to stay protected from all sorts of threats and vulnerabilities and will also make sure that the best practices are followed as per the latest standards. VOIP has provided a lot many benefits to the users and it is essential to ensure that the services are executed without any problem by making use of a few alterations in the existing architecture. References Fontanini, P. (2016). VoIP Security. [online] Brage.bibsys.no. Available at: https://brage.bibsys.no/xmlui/bitstream/handle/11250/143809/Fontanini_VOIP_Security.pdf?sequence=1 [Accessed 26 Aug. 2016]. Hung, P. (2016). THROUGH THE LOOKING GLASS: SECURITY ISSUES IN VOIP APPLICATIONS. [online] Available at: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.84.7089rep=rep1type=pdf [Accessed 26 Aug. 2016]. Kulkarni, S. (2016). VoIP Cell Phones : Security concerns and Countermeasures. [online] Available at: https://www.ijser.org/researchpaper%5CVoIP-Cell-Phones-Security-concerns-and-Countermeasures.pdf [Accessed 26 Aug. 2016]. Lazzez, A. (2016). VoIP Technology: Security Issues Analysis. [online] Available at: https://arxiv.org/ftp/arxiv/papers/1312/1312.2225.pdf [Accessed 26 Aug. 2016]. Obidinnu, J. and Ibor, A. (2016). A survey of Attacks on VoIP networks and Countermeasures. [online] Ajol.info. Available at: https://www.ajol.info/index.php/wajiar/article/viewFile/128074/117625 [Accessed 26 Aug. 2016]. Park, P. (2016). Threats Against Confidentiality VoIP Threat Taxonomy. [online] Ciscopress.com. Available at: https://www.ciscopress.com/articles/article.asp?p=1245881seqNum=2 [Accessed 26 Aug. 2016]. Shaidani, S. (2016). Attacks and Defenses Against Voice over IP (VoIP). [online] Available at: https://www.cs.tufts.edu/comp/116/archive/fall2015/sshaidani.pdf [Accessed 26 Aug. 2016]. Sonkar, S. (2016). A Review Paper: Security on Voice over Internet Protocol from Spoofing attacks. [online] Available at: https://www.ijarcce.com/upload/may/A%20Review%20Paper%20Security%20on%20Voice%20over%20Internet%20Protocol%20from%20Spoofing%20attacks.pdf [Accessed 26 Aug. 2016]. Vaishnav, C. (2016). Voice over Internet Protocol (VoIP): The Dynamics of Technology and Regulation. [online] Available at: https://web.mit.edu/chintanv/www/Publications/MIT_TPP_Thesis_Chintan_Vaishnav_Final.pdf [Accessed 26 Aug. 2016]. Xin, J. (2016). Security Issues and countermeasure for VoIP. [online] Sans.org. Available at: https://www.sans.org/reading-room/whitepapers/voip/security-issues-countermeasure-voip-1701 [Accessed 26 Aug. 2016].