Slashdot Log In
Voice Over IP Under Threat?
Posted by
Zonk
on Fri Jan 05, 2007 10:11 AM
from the keeping-phone-calls-expensive dept.
from the keeping-phone-calls-expensive dept.
An anonymous reader writes "The IT Observer is discussing the possible scary future of Voice over IP targeted viruses, and what that could mean for the consumer. The article discusses the likelihood that VoIP is going to become even more popular, and the damage that a targeted 'flash virus' could perpetrate in a very short amount of time. From the article: 'Let's imagine a scenario that could become commonplace in the near future: A user has an IP telephony system on his computer (both at home and at work). In his address book on the computer there is an entry, under the name Bank, with the number 123-45-67. Now, a hacker launches a mass-mailing attack on thousands or millions of email addresses using code that simply enters users' address books and modifies any entry under the name Bank to 987-65-43. ... If any of these users receives a message saying that there is a problem in their account, and asking them to call their bank (a typical phishing strategy), they may not be suspicious, as they are not clicking on a link in an email ... If they use their VoIP system to call the bank, they will be calling the modified number, where a friendly automated system will record all their details. ' "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The problem of telephony + the Internet... (Score:5, Funny)
Re:The problem of telephony + the Internet... (Score:4, Interesting)
Parent
Re:The problem of telephony + the Internet... (Score:5, Insightful)
I have been doing it for a while now (need to clean the code for the AGI plugin and post it). For my incoming phone lines I have scheduled times when the phone does not ring, when it rings only in my office for known callerIDs or when it rings for everyone who has not withheld their callerid. Trivial to do with asterisk+perl-AGI and quite more powerfull compared to the default autoattendant.
The article brands all VOIP to be Skypelike (and vice versa). VOIP is not just PC based systems and this attack currently applies only to PC based systems. In addition to that it is limited to a specific VOIP system. A valid Skype attack is not applicable to Yahoo, MSN, SIP phones, etc.
Things may change in the future when integrated contact management and click-to-dial becomes commonplace. This is not common enough now and can be found only on PHB/Sales laptops so it is not yet an attack vector that is worth mentioning. By the way, this will apply to any phone system that has click to dial, not just VOIP. Now having outlook+voip worm - that is a scary thought...
Parent
Re: (Score:3, Funny)
Re: (Score:2, Informative)
It's "it's your uncle" and not "its your uncle", and now you're no longer in need of correction, either. :)
Logical progression (Score:5, Insightful)
And that's why... (Score:4, Interesting)
But that just my opinion.
Re: (Score:2)
Re: (Score:2)
Exactly.
Cell Phone for day-to-day calls.
Cable Modem for day-to-day internet use.
POTS for reliability when all else goes to heck.
In the past ten years I've had both Cell and Cable fail and in each case I was able to fall back on POTS to handle my basic needs (and we're talking the center of a major urban metropoli
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Re:And that's why... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
As an AT&T CallVantage customer (Score:2)
Open VoIP Clients are Safer (Score:3, Insightful)
Re: (Score:2)
If the distribution and maintenance process is slowed down by requiring users to install (continuously bugfixed) apps under their OS, the ecosystem will remain riddled with insecurity.
VoIP-Spam is another threat (Score:3, Insightful)
VoIP will be cheap enough for spammers, and easy to handle by spamrobots...
Re: (Score:3, Insightful)
Why would this threaten VoIP? (Score:5, Insightful)
VERY UNLIKELY, see why... (Score:4, Insightful)
Re: (Score:2)
The potential scenerio quoted in the post is so far fetched, it's doubtful anyone will ever pull it off. It involves hacking their voip system, home computer (and address book), a mass-mailing spam which happens to also include the email address of the hacked computer, user intervention (they must read the spam and respond), and the hacker must also have a good enough radio voice to fool the homeowner into thinking he's actually calling his real bank.Don't know about you, but we're not to afraid of this possible Voice over IP threat.
Far fetched? Hey, the author thought it up, didn't he? Everything is far fetched (sailing around the world, explaining gravity, travelling into space) until someone actually does it. This technique requires thought and some actual work. So? If there's money in it, someone or some group out there with the wherewithal and time on their hands will try and exploit it, because basically they know your average computer users are sheep, and they have these nifty shears. It's this kind of complicated and non-obvi
Re: (Score:2)
Re: (Score:2)
Far fetched? Not really. Difficult to pull off and thus unlikely due to not being the low hanging fruit? That's more like it.
This "technique" is already possible. A mass mailed email worm (or whatever) modifies the user's "hosts" file (C:\WINDOWS\System32\Drivers\etc\hosts) so that www.paypal.com gets pointed to his or her IP address. The usual precautions the victim would engage in wouldn't apply, as the victim would actually be going to the website directly (rather than clicking on a link in an email)
If! But! Maybe! Might! Could! (Score:2)
Seriously though, there were an awful lot of 'if's and 'maybe's in that, and at least one of those steps can be avoided by being at least slightly knowledgable about the internet. It's a matter of education and in that respect people have to help themselves, or other people will help themselves instead.
To all your money.
Again People Are the Weakness (Score:2)
Not Unique to VOIP (Score:4, Informative)
Changing phone numbers in an address book isn't unique to VOIP. A virus could scan Outlook and other common address book systems and change phone numbers, whether VOIP or not. Since most people don't have their bank phone numbers memorized, they'll assume that the address book entry is correct. Even if they use a non-VOIP phone, the phishing attack can work.
Now, a VOIP system might have an integrated address-book/speed-dial system that could also be attacked. But otherwise, I don't see where this is unique to VOIP.
Whaaat? (Score:2, Insightful)
What if someone hacks the telephone exchange and redirects all calls to the bank to a new number?
What if I get a letter from my bank saying they have moved, and a phisher builds a new bank at that address, thus allowing them to take all my details?
How would that work? (Score:2)
Re: (Score:2)
What color is the sky in your world?
Re: (Score:2)
Easy. The skype user's telephone book is most likely (I don't use Skype so I can't be sure) a file on their PC.
A virus can enter that PC in any of the normal ways that they can propagate and go modify that file. (i.e. it isn't a "VoIP Virus", it's a traditional virus that attacks your address book once you're infected)
Dr. Weird had it right after all (Score:4, Funny)
You could just stop using Windows... (Score:2)
and all this should go away. When did you last hear of a security breach on Alcatel DEC
Re:You could just stop using Windows... (Score:5, Insightful)
I'll never get caught by a phising scam because my web browser doesn't support the HTML used on fake-paypal.com and I can't even connect to it anyway because I'm using a brand of TCP/IP used only by myself and a handful of
Call me crazy, but I want to work on something that I can easily share with my colleagues - I want the most open digital environment I can get.
I refuse to accept that lazy/poor programmers can excuse the security holes in their products by claiming that everyone should be aiming for security through obscurity. Lets stop blaming Windows/Internet Explorer users for the insecurity of the products they use. Security through diversity is just renamed security through obscurity; it's no security at all.
Parent
Re:You could just stop using Windows... (Score:5, Interesting)
Now, I understand in the Slashdot world, anything that pokes at Microsoft and Windows is instantly thought of as insightful and true, but what the hell does this problem have to do with Microsoft? This problem exists because of social habits of human beings. Most phishing scams work only when there is action taken by a victim that is either uncaring, or doesn't know better.
I recently received a phishing scam email from somebody purporting to be Wells Fargo Bank. First clue is obvious, I don't have an account with them, but I was curious. So I clicked the link in Firefox. The site comes up, looks similar to the real Wells Fargo site, but has a completely non-legitimate URL. So then I clicked the link in IE7. Guess what, IE7 knew it was a phishing site.
So in my above example, Microsoft was not at fault, in fact, they were proactive enough to protect the user. Stop blaming third parties for what amounts to human error. And if you think OS diversity would help the problem, you are wrong. People react the same way to phishing scams regardless of OS.
And your suggestions are absolutely insane. One thing that computing monoculture brings is a standard implementation. How would the average consumer react if they were told "this software won't work on this OS" or worse "this software only works on certain flavors of linux, but not yours". The reason the PC grew so quickly was the ability to choose between different software and hardware easily, and be sure of compatibility. Sure, niche markets existed, such as the Mac, but the PC was much more extensible and much more desirable.
-dave
Parent
Re: (Score:3, Insightful)
Now, I understand in the Slashdot world, anything that pokes at Microsoft and Windows is instantly thought of as insightful and true, but what the hell does this problem have to do with Microsoft?
The attack described relies upon a worm that can compromise desktop systems. Worms are a lot easier to implement if their are a huge number of identical targets with identical holes. Currently that target is Windows.
This problem exists because of social habits of human beings. Most phishing scams work only whe
Re: (Score:3, Interesting)
Or, it would only require a user to run certain software, which is the reason a lot of people get malware/spyware on their computers in the first place.
Yeah, trojans are a problem, although all the studies I've seen by number of infections put malware without user interaction in the lead.
This would not stop if there were no holes. It would only stop if there was a way to ensure that people didn't run software they download AND that any software provided to them was legitimate.
OS's don't need to pr
Scaremongering (Score:2, Interesting)
OMFG, What if someone wrote a virus that relinked your favorite
Address (Score:2)
Near future - HAH (Score:2)
Or sooner now they have described what to do &
Jaj
What about a BotNet? (Score:3, Interesting)
Re: (Score:2)
A 911 center typically has a handful of human operators - so what is needed to DOS a typical PSAP is a handful of cell phones and you just have a few people phone in and the 911 center is totally full. You don't need a bot net of voip systems. The reason this does not happen is because there is very little incentive to DOS a 911 center.
Re: (Score:2)
I'll keep it brief. As other informative posts have explained, the virii potential of VOIP clients is unlikely.
Say I'm a bad guy and I want to simultaneously call 100,000 machines. I would have to spawn 100,000 connections to a voip server. Your voip server firewall has a threshold for dropping connections from a single IP address doesn't it? If the bad guy is using 100,000 zombies then the problem is not voip is it?
Let's say for a minute that I'm able to connect to a client. *The phone will ring
Maybe a FUTURE problem (Score:4, Interesting)
In short, we know the threat. And we're also the ones who use VOIP predominantly, aside of companies (who better have someone like us as their IT-security person there). Auntie Mable and Joe Hicksberger won't switch to VOIP any time soon.
So personally, I'd rate THAT threat low. At least for now.
Stop giving them ideas! (Score:2)
I'll take VOIP... (Score:2, Funny)
Those shankers hurt!
By Fernando de la Cuadra, Panda Software (Score:2)
Re: (Score:2)
Re: (Score:2)
Of course, since my bank has a branch office right next to my company's cafeteria, I don't consider this an issue.
I don't store numbers in any address book that are on websites I frequently use, this includes all of my banks. (100% of phone calls to the bank are usually the result of a "you can't do this online, call 1-800-xyz-abcd".
Re: (Score:3, Insightful)