S

Saint scanner, 69, 71

satellite imaging tools, 1213

scanning, 2953

ACM, 264287

ARP pings , 3839

Asterisk, 327338

CCM, 224236

described, 30

host/device discovery, 3243

host/device identification, 4753

ICMP ping sweeps , 3337

INVITE, 7883, 9093, 95

MAC addresses, 171172

Nessus scanner, 69

NeWT scanner, 69

OPTIONS, 8495

port, 4347

REGISTER, 9093, 95

Retina scanner, 69, 70

Saint scanner, 69, 71

service discovery, 4347

SIP environment, 3031

SiVuS. See SiVuS

SNMP scans , 4143

SNMP sweeps, 4143

stack fingerprinting, 4853

TCP ping scans, 3941

TCP pings, 3941

TCP SYN scans, 4447

UDP scans, 35, 4447, 265287

VDP scans, 4447

SCCP (Skinny Client Control Protocol), 210217

SCCP call trace, 212217

Scholz, Hendrick, 68

SDP (Session Description Protocol) message, 66

search engines, 23. See also Google

Secunia database, 68

Secure Real-time Transport Protocol (SRTP), 164165

Secure RTP (SRTP), 479

SecureLogix, 95

security

Asterisk, 346349

Cisco Security Agent, 244245

Cisco switches, 183

CSI/FBI Computer Crime and Security Survey, 10

dependencies, 11

infrastructure, 10

insider abuse, 10

passwords. See passwords

port, 183

SecurityFocus database, 17, 68

social threats. See social threats

Transport Layer Security, 184, 433434, 465

VoIP security pyramid, 810

security bugs , 370, 385. See also fuzzing

security researchers, 372, 385

SecurityFocus database, 17, 68

servers

Avaya, 296308

Cisco Unity Server, 224230

DHCP, 141145, 224

DNS, 27, 146

hardening, 136

IIS web, 245

location, 57

media, 253254, 313

proxy, 57

redirect, 57

registrar, 57

TFTP. See TFTP servers

service discovery, 4347

Session Description Protocol (SDP) message, 66

session encryption, 184

Session Initiation Protocol. See SIP

SFTF (SIP Forum Test Framework), 383

Sherman, Troy, 206

signaling attacks, 168, 196. See also SIP signaling attacks

Simple Network Management Protocol. See SNMP

Simple Traversal of the UDP Network (STUN), 355

SIP (Session Initiation Protocol)

architecture elements, 57

basics, 5663

port scanning, 43

resources, 63

typical call flow, 6063

user /extension enumeration, 7395

SIP environment, 3031

SIP firewalls

audio insertion/mixing attacks, 480

DoS and, 414, 426

registration removal, 435

session teardowns, 466

SIP Forum Test Framework (SFTF), 383

SIP hashes, 174177

SIP phones. See also phones

adding new contacts for, 436437

attacks on, 414427

BYE requests , 460466

configuration files for, 45

dropping calls, 453

invalid requests, 403404

INVITE floods, 420427

MITM attacks, 455

nonexistent, 399400

passwords, 186

phishing attacks, 454

rebooting, 466469

reconfiguring, 186

registration addition, 435438

registration hijacking, 438456

registration removal, 430435

ringing continually, 423424

sending all inbound calls, 454

session teardown , 460466

swapping inbound calls, 453454

TCP and, 465

UDP floods, 414419

using SIPSCAN against, 9395

SIP proxies

attacks against, 393395

authentication, 407409, 466, 470471

breaking authentication, 440445

compromising , 151152

invalid domain name , 402403

invalid IP domain address, 400402

invalid SIP phone requests, 403404

INVITE floods, 395414

registration removal, 430435

rogue applications, 186191

rogue SIP proxies, 197199

sending all signaling through, 460

targeting with nonexistent SIP phone, 399400

teardowns through, 460466

UDP floods, 393395

SIP requests, 57, 58, 6063

SIP responses, 5863

SIP rogue applications, 186199

SIP signaling attacks, 429480.  See also signaling attacks

additional tools for, 480

redirection attacks, 456460

references, 481

registration addition, 435438

registration hijacking, 438456

registration removal, 430435

RTP inserting/mixing, 471480

session teardowns, 460466

SIP phone reboot, 466469

spoofing caller ID, 470471

SIP systems

authentication, 434, 479

encryption, 479

signaling attacks. See SIP

signaling attacks

TCP/IP for, 425

VLANs, 434, 466, 479480

SIP UDP port, 189

SIP URIs, 57

SIP users, 7395

SIP Vulnerability Scanner. See SiVuS

SipCrack tool, 480

Sipera, 95

sip_rogue tool, 186198, 455

sipsak tool, 8790, 480

SIPSCAN tool, 9094

Sipura phones, 21

SiVuS (SIP Vulnerability Scanner)

banner grabbing , 68, 69

INVITE floods, 409410, 411

INVITE username enumeration, 7880

registration addition with, 437, 438

registration removal, 432, 433

SIP phone reboot, 468, 469

targeting SIP phones with, 422423

Skinny Client Control Protocol.     See SCCP

Skora.net VoIP Tools, 480

Skype, 354357

SkypeKiller, 356357

smap tool, 6869

smurf attacks, 133

sniffers

Cain and Abel, 160163, 171177

dsniff, 182183

ettercap, 178182

network, 126129

sniffing attacks

CDP, 221224

TFTP configuration files, 148, 157158

Wi-finetworks, 149150

wired hubs, 149150

SNMP (Simple Network Management Protocol)

controlling access to, 295

disabling, 295

overview, 4142

secure versions of, 295

SNMP community strings, 42, 288, 295

SNMP enumeration, 101113

ACM, 288295

Asterisk, 339

CCM, 237239

countermeasures, 113, 237239

tools for, 101102

SNMP MIB Browser, 108113

SNMP ports, 42

SNMP Sweep tool, 42

SNMP sweeps, 4143

SNMP v1 protocol, 42, 113

SNMP v2 protocol, 42, 113

SNMP v3 protocol, 42, 113, 237

snmp-audit tool, 42

snmpenum tool, 42

SNMPSweep tool, 101

snmpwalk tool, 42, 101107, 288295

Snom phones, 2122, 151, 334335

SNScan tool, 42, 43

social threats

countermeasures, 514515

email phishing, 505516

email SPAM, 484, 488

IVR systems, 510512

obtaining 800 numbers , 510513

references, 516

SPIT. See SPIT

voice phishing, 505516

softphones, 351363. See also phones

Cisco, 210

Gizmo projects, 357359

instant messaging clients , 359362

overview, 352353

references, 363

security of, 353, 355357

Skype software, 354357

SolarWinds DNS Analyzer, 2527

SolarWinds Ping Sweep tool, 3536

Solution Reference Network Design (SRND), 217219

Song, Dug, 152153

SonicWall, 358

SPAM. See also SPIT

email, 484, 488

voice, 484, 487504

vs. SPIT, 490491

SPAM over Internet Telephony.     See SPIT

Spanning Tree Algorithm (STA), 155156

Spanning Tree Protocol (STP), 155156

Spencer, Mark, 324

SPIT (SPAM over Internet Telephony), 487504

authenticated identity, 501

case study, 484485

countermeasures, 501503

future problems with, 492500

generation of, 492500

legal measures against, 502

overview, 488490

resources, 503504

vs. SPAM, 490491

SPIT filters, 502503

spitter tool, 492500

splitter tool, 485

spoofing

ARP, 182, 184, 247

caller ID, 470471

DHCP, 246

IP addresses, 133

VLANS and, 184

SRND (Solution Reference Network Design), 217219

SRTP (Secure RTP), 479

SSRC field, 65

STA (Spanning Tree Algorithm), 155156

stack fingerprinting, 4853

static OS mappings, 183

STP (Spanning Tree Protocol), 155156

STUN (Simple Traversal of the UDP Network), 355

SUBSCRIBE requests, 58, 466467

supernodes, 355

SuperScan tool, 35, 37

switch ports, 154

switches

ACM, 259

Asterisk, 326

Cisco. See Cisco switches

compromising, 151

failure to open , 152154

LAN, 413, 426

layer 2, 155

layer 3, 155

SYN flag, 39

SYN flood attacks, 10, 132133, 146

SYN packets, 3941