Information has been obtained by McGraw-Hill from sources believed to be reliable. However, because of the possibility of human or mechanical error by our sources, McGraw-Hill, or others, McGraw-Hill does not guarantee the accuracy, adequacy, or completeness of any information and is not responsible for any errors or omissions or the results obtained from the use of such information.

For Mom, Dad, Sally, and Sarah.
Dave

For my wife Gerri, and two daughters, Kristen and Kerri.
Mark

About the Authors

David Endler

David Endler is the director of security research for 3Com's security division, TippingPoint, where he oversees product security testing, the VoIP security research center, and their vulnerability research team. While at TippingPoint, David founded an industry-wide group called the Voice over IP Security Alliance (VoIPSA) in 2005. VoIPSA's mission is to help VoIP adoption by promoting the current state of VoIP security research, testing methodologies, best practices, and tools. David is currently the chairman of VoIPSA, which boasts over 100 members from the VoIP vendor, carrier, and security space (http://www.voipsa.org).

Prior to TippingPoint, David was the technical director at a security services startup, iDefense, Inc., which was acquired by VeriSign. iDefense specializes in cybersecurity intelligence, tracking the activities of cybercriminals and hackers, in addition to researching the latest vulnerabilities, worms, and viruses. Prior to iDefense, David spent many years in cutting-edge security research roles with Xerox Corporation, the National Security Agency, and the Massachusetts Institute of Technology.

As an internationally recognized security expert, David is a frequent speaker at major industry conferences and has been quoted and featured in many top publications and media programs, including the Wall Street Journal , USA Today , BusinessWeek, Wired Magazine, the Washington Post , CNET, Tech TV, and CNN. David has authored numerous articles and papers on computer security and was named one of the Top 100 Voices in IP Communications by IP Telephony Magazine.

David graduated summa cum laude from Tulane University where he earned a bachelor's and master's degree in computer science.

Mark Collier

Mark Collier is the chief technology officer at SecureLogix corporation, where he directs the company's VoIP security research and development. Mark also defines and conducts VoIP security assessments for SecureLogix's enterprise customers. Mark is actively performing research for the U.S. Department of Defense, with a focus on developing SIP vulnerability assessment tools.

Prior to SecureLogix, Mark was with Southwest Research Institute (SwRI), where he directed a group performing research and development in the areas of computer security and information warfare .

Mark is a frequent speaker at major VoIP and security conferences. He has authored numerous articles and papers on VoIP security and is also a founding member of the Voice over IP Security Alliance (VoIPSA).

Mark graduated magna cum laude from St. Mary's University, where he earned a bachelor's degree in computer science.

About the Technical Editor

Ofir Arkin is the CTO of Insightix, leading the development of the next generation of IT infrastructure discovery and monitoring systems for enterprise networks. He has more than ten years of experience in data security research and management. Prior to cofounding Insightix, he served as the CISO of a leading Israeli international telephone carrier. In addition, Ofir has consulted and worked for multinational companies in the financial, pharmaceutical , and telecommunication sectors.

Ofir is the author of a number of influential papers on information warfare, VoIP security, and network discovery, and lectures regularly at security conferences. He is chair of the security research committee of the Voice over IP Security Alliance (VoIPSA) and the founder of the Sys-Security Group (http://www.sys-security.com), a computer security research group.

Acknowledgments

First, we would like to thank our families for supporting us through this writing and research effort. Next, we would especially like to acknowledge our respective work colleagues at TippingPoint and SecureLogix for their input, suggestions, and guidance through this process. A special thanks to Mark O'Brien with SecureLogix for his research and assistance with attack tool development. Thanks also to the great discussions by the growing VoIP security industry reflected on the VoIPSEC mailing list (http://www.voipsa.org/VOIPSEC/) and also through Dan York and Jonathan Zar's Blue Box Podcast (http://www.blueboxpodcast.com).

A word of thanks also to the security and VoIP teams at Skype, Avaya, Cisco, and Asterisk for working with us on this book in the sections where we targeted their products.

Finally, we're especially grateful to the McGraw-Hill team who helped make this book a reality, including Jane Brownlow, Jenni Housh, LeeAnn Pickrell, Peter Hancik, and Lyssa Wald.