Attackers can penetrate the network from any components of your
infrastructure, so security should be enforced on all devices, like an IP
phone, software clients like Microsoft Teams application, or Cisco WebEx
application; or the call processing servers like Cisco Unified Communication
Manager server or a TFTP server that provides the configuration files to the
phones, or Microsoft Teams cloud, and anything in between the client and the
server, that is, the network that connects the client and the server must
also be secured.
And, remember, even the network has many devices in it, for example,
a switch, a router, a gateway,
and maybe a firewall. You've also got to secure each of these
devices to prevent any security breaches. Let's start with the
eavesdropping and sniffing, or snooping.
In Voice over IP,
eavesdropping and sniffing attacks could involve an attacker intercepting,
recording,
and listening to calls or stealing sensitive information
transmitted over the call without our knowledge. Eavesdropping on
phone calls reveals a wealth of confidential and valuable
information. Financial institutions, professional services firms,
and government agencies all hold valuable data. Call centers are equally
rich sources, offering confidential account information,
health records, and payment card data as a potential treasure trove.
The main objective of an eavesdropping attack is to
infiltrate an organization's network and obtain sensitive
business or financial information.
Once obtained, this information can be sold to competitors or traded for
other valuable data. To protect organizations from eavesdropping, you
must use secure protocols for communication.
For example,
Microsoft Teams uses mutual TLS (MTLS) and server‑to‑server (S2S) Oauth,
among other protocols, for server communications within Microsoft 365
and Office 365, and also uses TLS from client to the services. All
traffic on the network is encrypted,
so any eavesdropping from the client to the server and vice‑versa is secure.
This method of communication make eavesdropping very difficult or impossible
to achieve within the time period of a single conversation. TLS authenticates
all parties and encrypts all traffic.
While TLS does not prevent eavesdropping,
the attacker can't read the traffic unless the encryption is broken. In VoIP,
a spoofing attack could involve an attacker making a call that appears to be
coming from a different number with the goal of tricking the recipient into
providing sensitive and confidential information.
Another example of how spoofing can be done is when the attacker makes his
computer act like a TFTP server and sends the configuration file of the IP
phone and then gathers important network information. This information
could be utilized to connect to the internal network. Attackers can wreak
havoc on VoIP servers.
Imagine a mastermind hacker who wants to bring down a company's communication
system. This scanning hacker knows exactly how to do it, by launching a DDoS
attack on the VoIP servers. They disguise themselves as a user trying to
initiate a call and send numerous fake INVITE requests to the server. The
server, unaware of the danger, tries to authenticate each request, using up its
computational power and memory. The flood of requests continues, and before you
know it, the server is overwhelmed. No legitimate calls can go through now, and
the company is left in the dark, unable to communicate with its client.
This is what happens when an attacker uses the SIP protocol and UDP to
launch a flood of specially crafted packets at an unprotected VoIP
server. Protecting your VoIP system from malicious attacks requires a
multi‑layered defense strategy. Keep your communication secure with a
combination of access level control,
IP address learning, media packet policing, etc. You can
allow call signaling only from authorized and trusted IP
address using ACL policing.
Make sure that only trusted peers are allowed in the network with IP
address learning, and also ensure media packets match negotiated SIP
or SDP signaling with media address learning. As a VoIP engineer, you
must prioritize authenticated sources with priority‑aware packet
policing and limit bandwidth usage with application‑level call
admission control.
It's your responsibility to shield your organization's sensitive
information and keep your VoIP system functioning smoothly with these cutting‑edge security measures.