VoIP vulnerable to cyber attacks

New research out of the UK has revealed VoIP infrastructure has become more susceptible to cyber attacks.

The research, performed by security consultancy firm Nettitude, says VoIP infrastructure is vulnerable due to the proliferation of both its use and the tools that can used for malicious purposes.

"The driving factor for the success of VoIP is cost reduction, both for users and providers," Nettitude observes in its report of the findings. "But VoIP doesn't only bring reduced costs, it also brings threats and vulnerabilities unprecedented to the telephone industry.

According to the report, Nettitude observed a large number of VoIP attacks against servers during the first quarter of 2015.

VoIP infrastructure is subject to most of the well-known attacks against network infrastructures. However, there are some specific attack vectors that make this a potentially attractive attack surface, the report surmises, including social threats, eavesdropping, interception and modification, service abuse, intentional interruption of service, and other interruptions such as loss of power.

The Nettitude report says there are various ways in which VoIP traffic and systems can be targeted.

"VoIP attacks, just like any other attacks against network infrastructure, would have different impacts on the business depending on the service that were being targeted," the report explains.

Nettitude found attackers were very active out of office hours, with analysis revealing 88% of attacks occurred during downtime.

"It is a fact that many companies cannot afford security analysts for 24/7 services. The need of dedicated services is then required to ensure that appropriate responses and actions are taken when attacks are identified.

Nettitude says a well thought out strategy should be in place for ensuring that VoIP services are not disrupted.

"Statistics show that attackers operate when IT staff are likely to be away from their services," the report explains. "It is therefore important to have 24/7 monitoring system that will allow attacks to be detected and mitigated in real time.

Further to an efficient monitoring system, Nettitude has gathered and continues to gather intelligence about VoIP malicious users, their respective tools and techniques. "Such intelligence will be invaluable in protecting against know offenders and their techniques, whilst putting in place mitigation strategies for unknown factors," Nettitude explains.

"Before applying any security, understanding the VoIP environment is paramount. This will help to understand the nature of the environment and its specific threats.