Re: [Full-Disclosure] ASN.1 telephony critical infrastructure warning - VOIP

[Michael Samuel <michael () miknet net>]

Hi,

I work for a VoIP provider, and I thought I'd clear up a few points:

If desktop PCs have access to the PSTN via VoIP, it's entirely
possible for a worm (or intruder) to use the PSTN as that VoIP user.
(That could be used for a telemarketing worm or a DDoS on somebody's
phone pool, I guess)  This is regardless of which vulnerability the worm
uses.

This is made worse because some VoIP software (well, at-least one SIP
based VoIP package) disables authentication by default when adding a
user, and makes you jump through hoops to enable it.

Yet this is mostly mitigated because almost all VoIP infrastructure is
on a separate network (generally controlled by vlans and some sort of
VPN technology), which can't be accessed by desktop PCs. I beleive this
is pretty-much standard with Cisco equipment.  So, assuming the router
and switching hardware is secure and properly configured, an Internet
worm can't get to your VoIP network (or even DoS it).

That's not much comfort for those accessing a Internet->PSTN VoIP
provider (rather than just an IP Centrix or IP PBX VoIP network), but
the risk there is no greater than online shopping/banking. (Assuming
you're using a secured VoIP protocol - and you're probably NOT)