Broadvox SIP Trunking Certified With UM Labs Enhanced SIP Security Controller

Broadvox SIP Trunking Certified with UM Labs Enhanced SIP Security Controller http://snapvoip.blogspot.com/

Broadvox and UM Labs announced today interoperability certification between Broadvox GO! SIP Trunking and UM Labs’ family of enhanced SIP security controllers. Broadvox as you may know is a premier ITSP Internet Telephony Service Provider since 2001, and UM Labs, is a leader in SIP security and SIP connectivity

“Interoperability certification provides resellers and customers with confidence that Broadvox’s growing ecosystem of technology partners can support their specific PBX environment and provide enhanced cost effective connectivity and security solutions,  We welcome UM Labs as a technology interop partner.” said Isaac Parampottil, Director of Product Management at Broadvox.
“We are very pleased to work with Broadvox, an industry leader in SIP Trunking, to provide their customers with additional proven solutions for SIP connectivity, security and voice encryption.”  concurred  Peter Cox, CEO of UM Labs.

The interoperability certification covers the entire range of Broadvox SIP Trunking services and UM Labs RC-2100 Small Business and EC-4200 Enterprise product lines.
Press Release

VoIP Security, Asterisk, SIP, Brute Force Attacks, Explained By John Todd Of Digium.

VoIP Security snapvoip.blogspot.com
My thoughts when I read the article saying  “Asterisk attacks are endemic” were ????*&^ and I also knew that John Todd knew what he is doing. So I let the article pass as I was certain it was not the case.
Today Todd has posted an article explaining the misinterpretation of his thoughts and the verbalization of the same.

My comment in the article was not that “Asterisk attacks are endemic”, but that SIP-based brute force attacks are endemic.  Every SIP system that is open to the “public” Internet is seeing large numbers of brute-force attacks.  Sites that have weak username and weak password control will be compromised – this is little different than email accounts being taken over by password-guessing systems and used for sending floods of email.  The significant difference is that when someone takes over a SIP platform to make outbound calls, there is usually a direct monetary cost, which gets people’s attention very quickly.

We all know that Asterisk is used world over and is the favorite SIP based telephony platform is likely to attract people who are interested in hacking or attacking the system. But we also have seen security measures taken by Asterisk as well. Just like the one released day before yesterday, AST-2009-07, where the advisory and the fix was released simultaneously.
But what Todd wrote makes sense and as Asterisk, Broadsoft, Cisco, Kamailio, OpenSER, FreeSwitch, Avaya are all vulnerable to brute force attacks and every bit of  information will help. Whether it is news worthy or not.
Asterisk and SIP Security Redux

SIP Security, A New Book From Wiley

SIP and SIP Security
The big guns at Fraunhofer Institute Fokus,who brought us the SIP Express Router (SER), has written a very good book on SIP Security.
Authors, Dr. Dorgham Sisalem, Dr. John Floroiu, Jiri Kuthan, Ulrich Abend, and Prof. Henning Schulzrinne are pioneers in SIP technology and have vested interest and knowledge of the subject SIP and SIP Security. If you need further assuarence, you can read a forward by security guru Phil Zimmerman on the site which is linked below.
SIP Accounts are used by many now for day to day communications and all major IP Telephony and VoIP carriers are deploying or already have deployed SIP Back Bones. I learned my SIP from SER, when most people were wondering what VoIP was.
I cant comment much on the book itself as I have not read it yet but I will assure you, it is something you need to have near by, if you are involved in Communications.
The authors have a website to provide information on the book.

You can read an excerpt of the book here.

Tags: SIP, SIP Security, SER

IC3, Asterisk And SIP Security

http://snapvoip.blogspot.com/
If you followed the recent security saga about the Asterisk and caller ID spoofing and Vishing attacks, Digium has issued a very explanatory post on their website, SIP Security and Asterisk
This should clear any doubts about Asterisk's security measures and bugs. Also how the SIP Security should be addressed. But as always security is a continuous challenge and continue to be vigilant.
It is must read and once you are done with it you may also want to read the new IC3 warning with the update.
You should get to know IC3.GOV in any case, if you are an Internet user.

Tags: IC3, Asterisk, SIP Security, didgium