VoIP Monitoring Software’s Critical Security Flaws Discovered

There’s no question that VoIP (Voice over Internet Protocol) is revolutionizing how businesses communicate, but there are growing pains like all new technologies. One of the significant issues with VoIP is that it can be challenging to detect and diagnose problems. That’s where VoIP monitoring comes in.

VoIP monitoring is the process of keeping track of voice traffic and identifying issues with call quality. VoIPmonitor is a popular monitoring software that allows users to listen to and record VoIP calls. It includes call analysis, quality measurement, and media analysis features. A PENETRATION-TESTING & vulnerability research firm, Kerbit, detected new vulnerabilities in VoIPmonitoring, and issued a warning about the flaws and how hackers could exploit the scenario.

What is VoIPmonitor?

VoIPmonitor is an open-source network packet sniffer for SIP RTP and RTCP VoIP protocols that runs on Linux and allows users to monitor and troubleshoot conversation quality and decode, play, and archive calls in a CDR database.

The software involves the measurement of jitter, latency, and packet loss, all of which impact the quality of a VoIP call. Simply described, it’s the monitoring of VoIP conversations’ quality of service (QoS), which includes both fault and performance management. Monitoring metrics from the source to the destination and vice versa and the mean opinion score (MOS) and round trip time (RTT) will ensure that everything is under control throughout the communication and connection.

What are the flaws identified by Kerbit?

Kerbit detected three vulnerabilities, which are listed below:

• CVE-2022-24259 (CVSS score: 9.8) – An authentication bypass problem in the GUI’s “cdr.php” component allows an unauthenticated attacker to elevate privileges via an exceptionally crafted request.
• CVE-2022-24260 (CVSS score: 9.8) – An SQL injection vulnerability exists in the GUI’s “api.php” and “utilities.php” components, allowing attackers to elevate privileges to administrator and retrieve sensitive data.
• CVE-2022-24262 (CVSS score 7.8) – A remote command execution via the GUI’s configuration restore capabilities due to a missing check for archive file types, which allows a bad actor to execute arbitrary instructions via a forged file.

The vulnerability allows users to upload any file extension they want and can get them to run, essentially giving hackers admin privileges. The flaws could have been used to crash applications, but bulk-uploading extensions and overwhelming the network.

Unauthenticated attackers could elevate privileges to the administrator level and execute arbitrary commands if critical security vulnerabilities in VoIPmonitor software are successfully exploited.

Other Types of VOIP Attacks?

VoIP technology is just as reliable and secure as a traditional telephone, if not more so than a cellular connection. Every network must be appropriately set up and fortified to be completely hacker-proof.

Most VoIP cyber assaults are caused by administrators failing to implement adequate security measures, resulting in VoIP security attacks and, in particular, SIP hacking. SIP servers, after all, are at the heart of both internal IP telephony and commercial services, as seen in the diagram:

It’s vital to keep your SIP servers safe. The following are four types of SIP-based VoIP hacks that have gained popularity in the telecom business in recent years:

1. SIP Amplification Attack – DDoS
   As this protocol has become widely employed in VoIP systems, SIP hacking remains one of the most prevalent security concerns in the telecom space. The following is a typical scenario for a SIP amplification attack:
   A hacker uses DDoS to launch a mass application layer attack on the SIP protocol to disrupt it. For example, an attacker might compromise SIP servers and send many (10+) faults to the victim, allowing them to send IP Spoofed packets and repeated Responses.
2. SIP Trust Relationships Hack
   SIP gateways rely on SIP Trunks for call initiation and CDR/invoice management, making them easy targets for VoIP attacks. SIP trunks frequently lack passwords or employ IP-based filters for trunk authentication. Most SIP trunks also have Direct INVITE privilege without REGISTER, making them vulnerable to assaults.
3. SIP Authentication Hack

SIP 2.0 uses the MD5 message-digest technique to hash the UAC password to offer extra security to VoIP networks.
The issue with such an authentication method is that it isn’t completely safe. When UAC requests authentication from a UAS, the latter generates and sends a digest challenge to the UAC. The most basic authentication challenge consists of the following:

• a Realm – required to identify credentials within a SIP message.
• a Nonce – a unique MD5 string produced by the UAC for each registration request; A Nonce has a timestamp and a secret, a non-reusable phrase that ensures it has a finite lifespan.

On the other hand, Hashed passwords are no longer sufficient to defend VoIP systems from sophisticated authentication assaults. With a Network Analyzer or a brute-force attack, hackers may now crack MD5 cash and gain access to a SIP authentication header.

4. Creating a Fake Caller ID/ Spoofing

In SIP, caller ID isn’t adequately protected, and hackers have lots of tools for spoofing the SIP INVITE Request Message from the header. This is a prevalent method of voice fraud used to attack PBX systems. As a result, you must also protect that endpoint to avoid roaming fraud or call hijacking.

What can we do?

By including VoIP in your portfolio, you may improve your commercial offering by having IP-based voice features that bring value to both data and video. It also allows you to compete with over-the-top (OTT) service providers who cannot guarantee service quality (QoS). After all, quality and security are the fundamental differentials that customers are most likely to notice regarding voice service. Delivering faultless VoIP call quality involves real-time customer experience management, including total visibility of the traffic running through your IP network.

The VoIP monitoring market is heating up as businesses search for the right solution that fits their needs. Companies are always concerned about security when giving their staff or contractors unfettered access to internet and phone services in remote environments because of the inherent risk of not being in a secure network. However, many remote users still want access to secure phone and internet lines to stay connected without worrying about data costs.

Protected Phones by Protected Harbor is a cloud-based unified VoIP solution that provides businesses with the security and flexibility they need to enable remote work and 24×7 live support with a dedicated system. To learn more about our solution and how we can partner with you, please visit our website or contact us today.