Source: www.voip-news.com

Sipera System’s Sipera IPCS security appliances  now have advance security for SIP trunking. Sipera VIPER Engine also has upgraded security as well.

“Many enterprises today are embracing Unified Communications because they see it playing a key role in increasing the productivity of their organization. What some overlook, however, are the security issues that arise any time an enterprise application is connected to the Internet,” said Matthias Machowinski, Infonetics Research Directing Analyst, Enterprise Voice & Data. “In order to realize the benefits of UC without increasing security risks, enterprises need to add security to their infrastructure that protects against threats in real-time.”

Sipera execs agree.

“As companies extend Unified Communications beyond the enterprise perimeter to allow SIP trunking and mobility solutions, they require sophisticated and comprehensive security from a dedicated UC security provider,” said Eric Winsborrow, Chief Marketing Officer for Sipera Systems. “Sipera’s comprehensive UC security provides threat protection, policy enforcement, access control, and privacy measures, along with the ability to simplify the deployment of SIP trunks and mobile workspaces. Sipera IPCS threat protection is backed by the expertise of and ongoing signature updates from Sipera VIPER Lab to ensure complete protection in real-time.”

Source: www.voip-news.com

Sipera Systems is hoping their recent appointment of John Lochow as president and CEO is going to do for that company what it did for his previous company, Syndesis Limited. Under Lochow’s leadership, Syndesis revenues grew tenfold from $6 million to $60 million. Lochow has experience in both small and large enterprise  and service provider technology solutions companies.

Sipera is growing and expanding its VoIP/UC security solutions business, which is crucial to the security of enterprise VoIP.

“With the growing awareness in the marketplace of the need for comprehensive VoIP/UC security, now is the time for Sipera to bring its VoIP security leadership to a new level.  John is the person to help Sipera accelerate its momentum,” said Ben Scott, chairman of the board for Sipera Systems.

Lochow said he’s excited to join the organization.

“Sipera is at an inflection point with the demand for comprehensive VoIP/UC security solutions expanding as enterprises and service providers seek to protect and control real-time unified communications,” said Lochow.

Source: snapvoip.blogspot.com

Sipera, the VoIP security firm that I saw first at BlackHat 2007 has warned VoIP firms before disclosing the vulnerabilities. There are multiple vulnerabilities, advisories and they are listed here.

The tests focused specifically of residential and SMB VoIP service and equipment. I was surprised to find strong authentication, signaling security, and media encryption were lacking, looks like everybody is following Microsoft. Get it Out there first and then we fix it as troubles jump up.

So what does these vulnerabilities do to users? spoofing, eavesdropping, and remote exploits are some of the possibilities.

I will write later today about what you should be looking in VoIP Security.

Following is the news release by Sipera;

Richardson, TX, October 23, 2007 – Sipera VIPER™ Lab, operated by Sipera Systems, the leader in comprehensive VoIP/UC security solutions, today disclosed multiple threat advisories for users of VoIP services and equipment from Vonage, Globe7 and Grandstream. Among other threats, unwitting VoIP users face eavesdropping, spam, spoofing and denial-of-service (DoS) attacks. Full details on these vulnerabilities are posted as an educational security service to Sipera’s customers and the general public at http://www.sipera.com/viper.

Sipera VIPER Lab determined the Vonage VoIP Motorola Phone Adapter (VT 2142-VD) and Vonage service implementations leave users vulnerable to a form of VoIP identity theft, allowing hackers to take over a user’s phone service with a “registration replay attack,” then make and receive calls while impersonating the victim. Incomplete security practices, such as not encrypting traffic, open Vonage users to eavesdropping on private voice and video communications. Hackers can also send multiple SIP INVITE messages to a user, an Internet version of “ringing the phone off the hook” which creates a DoS attack. Leveraging these vulnerabilities, remote attackers can also send malicious messages directly to Vonage users, subjecting them to spam, social engineering and VoIP scams.

“These vulnerabilities create serious privacy and service availability issues for users,” said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. “Vonage, Globe7 and Grandstream customers can no longer assume that their VoIP providers are automatically securing their services, but they should demand best security practices be followed as a condition of becoming a customer. Sipera VIPER Lab will continue to proactively identify VoIP threats and assist VoIP providers to implement best security practices before attacks occur.”

Sipera VIPER Lab also found issues with European provider Globe7’s online account access, as a result of utilizing unsecured connections and employing a weak encryption scheme. This allows hackers to access confidential name, password and account balance data, as well as steal VoIP service to make and receive calls, masked as a legitimate Globe7 user. Likewise, Sipera VIPER Lab established the Grandstream HandyTone-488 PSTN-to-VoIP adapter is vulnerable to buffer overflows and fragmented packet attacks. By sending a specially crafted SIP INVITE message to public IP addresses, attackers can disconnect legitimate Grandstream users.

Sipera VIPER Lab is comprised of experienced VoIP security researchers operating globally 24/7/365. Since its inception in 2003, Sipera VIPER Lab has identified thousands of vulnerabilities and security threats which include fuzzing, floods and distributed floods, spoofing, stealth attacks and spam. VIPER Lab research is used to continuously improve the Sipera IPCS products that protect, control and enable real-time unified communications for enterprises and service providers. Sipera VIPER Lab also recently launched a blog to discuss ongoing VoIP attacks and VoIP/UC vulnerabilities at http://www.sipera.com/viper/blog.