Description
You think you know what VoIP really is, and moreover you can say what the real security risks are and how to mitigate them ? Then this course isn't for you :)
We'll first go through the basics: signaling protocols (SIP, H.323, MGCP, H.248), the media stream side (RTP, CODECs, etc) and how voice really works on the telco side.
Then we'll discuss what a full VoIP architecture looks like (on the carrier and the entreprise side): devices it's made of, protocols, operating systems and applications, etc. This will provide the students with the basics on the IMS core, Session Border Controllers, VoIP firewalls, Applications Servers and web front-ends.
Once the scene is set, we'll discuss the architecture's security: attack vs defense, what's exposed and at risk, how to secure it (is encryption of signaling and/or media really the answer ?), etc. How do Skype, ZRTP, and other protocols fit into the overall picture. What problem do they solve and which risks do they introduce ?
On the practical side of things, we'll play with a sniffer, listen into signaling and media, analyze the exchanges, etc. i.e. learn how VoIP "really" works. We will also use some of the VoIP "hacking" tools, to show you what they are good at and what kind of vulnerabilities they really expose.
Prerequisites
Laptop with an Ethernet NIC and working network
Either Win32 or Linux (or MacOS, but don't expect me to help if something isn't working properly :)
Wireshark (Ethereal), version 0.99.4 or higher
Counterpath X-Lite Free, version 3.0 or higher
A headset (without mike is fine if you have one integrated)
Nico Fischbach
Nico is a Senior Manager, in charge of the European Network Security Engineering team at COLT Telecom, a leading pan-European provider of end-to-end business communications services.
He holds an Engineer degree in Networking and Distributed Computing and is a recognized authority on Service Provider infrastructure security and denial-of-service attacks mitigation.
Nicolas is co-founder of Sécurité.Org a French speaking portal on computer and network security, of eXperts and mystique, an informal security research group and think tank, and of the French chapter of the Honeynet project.
He has presented at numerous technical and security conferences, teaches networking and security courses at various universities and engineering schools, and is a regular contributor to the french security magazine MISC. More details and contact information on his homepage.