System and Method for Detecting Vulnerabilities in Voice Over IP Networks

• US 20070097963A1
• Filed: 11/02/2006
• Published: 05/03/2007
• Est. Priority Date: 11/02/2005
• Status: Active Grant

• Current Assignee: Panayiotis Thermos
• Original Assignee: Panayiotis Thermos
• Inventors: Thermos, Panayiotis
• Granted Patent: US 8,605,715 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

A computer system and method for discovering voice over IP networks and detecting related vulnerabilities. The user identifies target servers or a network representing several targets to scan, and the system scans the specified servers to identify which support voice over IP services. The system returns a list of servers identified, and the user can export the list to the scanner. The scanner allows the user to specify scan options and then initiate a scan against specified servers or a network. The system performs the scan based on the scan options specified by the user, and displays the scan results to the user, such as one or more vulnerabilities found on the specified servers. The user can prioritize and categorize the collected data based on configurable settings. The user can also send a particular type of message to a voice over IP network and see the result.

Claims

1. A method for detecting vulnerabilities in voice over IP networks comprising the steps of:

receiving at least one network identifier that identifies one or more target networks to scan;

using the at least one network identifier to analyze an associated network to determine whether at least one voice over IP network is present;

if at least one voice over IP network is determined to be present, then receiving one or more scan options that specify how the at least one voice over IP network should be scanned for vulnerabilities;

performing a scan of the at least one voice over IP network based upon the one or more scan options to identify if a particular one or more vulnerabilities is present; and

outputting a scan result.

2. The method of claim 1, wherein the at least one network identifier is one or more IP addresses of the one or more target networks.

3. The method of claim 1, wherein the particular one or more vulnerabilities are selected from the group consisting of security vulnerabilities and reliability vulnerabilities.

4. The method of claim 1, wherein the one or more scan options are received from a user.

5. The method of claim 1, wherein the one or more scan options are received programmatically.

6. The method of claim 1, wherein the one or more scan options include a message size that is used to construct a malformed message.

7. The method of claim 1, wherein the one or more scan options include a message type option that allows a user to indicate a type of message to send to the at least one voice over IP network.

8. The method of claim 1, wherein the vulnerabilities to be scanned for include reliability vulnerabilities that indicate if one or more voice servers on the voice over IP network are not reliable.

9. The method of claim 1, wherein the vulnerabilities to be scanned for include security vulnerabilities that indicate if a default password is being used on the voice over IP network.

10. A computer-readable medium having computer-executable instructions for causing a computer to perform the steps recited in claim 1.

11. A computer-readable medium having computer-executable instructions for causing a computer to perform steps comprising:

provide a component discovery tool, the component discovery tool being operable to receive input from a user to identify a target network, and to scan the target network to discover at least one voice over IP network present on the target network; and

provide a vulnerability scanner tool, the vulnerability scanner tool being operable to receive at least one scan setting from the user, and to use the at least one scan setting to perform a test against the at least one voice over IP network to attempt to locate at least one vulnerability.

12. The computer-readable medium of claim 11, wherein the component discovery tool is further operable to receive input from the user for the target network in the form of an IP address of the target network

13. The computer-readable medium of claim 11, wherein the vulnerability scanner tool is further operable to receive at least message size from the user.

14. The computer-readable medium of claim 11, wherein the vulnerability scanner tool is further operable to allow the user to specify a message size as one of the at least one scan settings.

15. The computer-readable medium of claim 11, wherein the vulnerability scanner tool is further operable to use the at least one scan setting specified by the user to generate at least one malformed message to send as a test to the voice over IP network.

16. The computer-readable medium of claim 11, wherein the vulnerability scanner tool is further operable to generate standard call flows and malicious call flows to test the voice over ip network for vulnerabilities.

17. The computer-readable medium of claim 11, wherein the vulnerability scanner tool is further operable to send test messages of a plurality of sizes to detect buffer overflow problems in the voice over IP network.

18. A method for mapping voice over IP networks comprising the steps of:

providing a security tool for detecting vulnerabilities in voice over IP networks;

programmatically identifying a plurality of voice over IP components using the security tool;

generating a visualization map of the plurality of voice over IP components; and

receiving input from a user to specify an importance level of at least one of the plurality of voice over IP components present on the visualization map.

19. The method of claim 18, further comprising:

using the importance level to alter at least one type of security vulnerability scan performed.

20. A computer-readable medium having computer-executable instructions for causing a computer to perform the steps recited in claim 18.