Context warns of VoIP wars at Black Hat USA

ID: 1450811
recent pressrelease next pressrelease

(businesspress24) - Fatih Ozavci from Context Information Security highlights risks of growing VoIP attack surface and threats

August 4, 2016: With more organizations turning to VoIP (Voice over Internet Protocol) and cloud-based Unified Communications (UC) systems to underpin their commercial services and corporate communications, IT response and security testing teams are struggling to keep pace with the VoIP attack surface and growing number of threats in the wild, according to Fatih Ozavci from Context Information Security, speaking at the Black Hat USA conference today.

“A lack of understanding of modern VoIP and UC security, means that many service providers and businesses are leaving themselves at risk to threat actors repurposing this exposed infrastructure for attacks such as botnets, malware distribution, vishing, DoS and toll fraud,” said Ozavci.

Ozavci points to potential vulnerabilities in major UC product suites and IMS platforms, such as bypassing security measures, injecting malicious content to messaging, caller identity spoofing and billing bypass, along with problems caused by insecure configurations. “By exploiting these vulnerabilities, attackers could gain unauthorized access to client systems or communication services such as conference and collaboration, voicemail, SIP trunks and instant messaging,” said Ozavci.

The BlackHat presentation highlights weaknesses in UC messaging, federated communications and collaboration services that could be used to gain unauthorized access to the UC environment and client systems, as well as attacking client systems using signaling protocols and messaging. “These attacks can be used to compromise the client systems connected using protocol and software vulnerabilities,” said Ozavci, adding, “Dial plans, misconfigured SIP trunks, conference and network infrastructures are also major targets for advanced attacks.”

The Context researcher has also looked at media transport protocols such as (S)RTP for voice calls, file, desktop and presentation sharing. The media transmitted may have confidential or sensitive information, which can be an object of PCI, COBIT or compliance requirements such as credit card information on calls to IVR services or customer privacy information.

“Due to insecure encryption and design issues, sensitive information in the media that’s been transmitted can be exposed and compromised,” said Ozavci.

To help raise awareness of these VoIP and UC vulnerabilities, Ozavci has developed open source tools Viproxy and Viproy that can be used for VoIP penetration testing. These are available at:

Fatih Ozavci is speaking at Black Hat USA, Thursday, August 4, 2:30pm-3:20pm

More information:

Keywords (optional):

context, black-hat, voip, usa, fatih-ozavci, security,

Company information / Profile:

PressRelease by


PressContact / Agency:

For more information for editors, please contact:
Peter Rennison / Sam Morgan
PRPR, Tel + 44 (0)1442 245030
pr(at) / sam(at)

published by: RealWire
print pressrelease  send to a friend  

Date: 08/04/2016 - 07:29
Language: English
News-ID 1450811
Character count: 2818
Firma: RealWire
Ansprechpartner: Samantha Sharp Feedback to about Pressrelease-id:
Stadt: Lincoln
Telefon: +44 (0)1522 883640

Meldungsart: bitte
Versandart: Veröffentlichung

Number of hits: 383


Direct Link to this PressRelease:

We would appreciate a link in your News-, Press- or Partner-Site.

Comments on this PressRelease

All members: 9 438
Register today: 0
Register yesterday: 0
Members online: 0
Guests online: 60

Don't have an account yet? You can create one. As registered user you have some advantages like theme manager, comments configuration and post comments with your name.