System and method for detecting vulnerabilities in voice over IP networks

• US 8,605,715 B2
• Filed: 11/02/2006
• Issued: 12/10/2013
• Est. Priority Date: 11/02/2005
• Status: Active Grant

• Current Assignee: Panayiotis Thermos
• Original Assignee: Panayiotis Thermos
• Inventors: Thermos, Panayiotis
• Primary Examiner(s): Zhou, Yong
• Application Number:
  US11/556,146
• Publication Number:
  US 20070097963A1
• Time in Patent Office: 2,595 Days
• Field of Search: None
• US Class Current: 370/356
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

A computer system and method for discovering voice over IP networks and detecting related vulnerabilities. The user identifies target servers or a network representing several targets to scan, and the system scans the specified servers to identify which support voice over IP services. The system returns a list of servers identified, and the user can export the list to the scanner. The scanner allows the user to specify scan options and then initiate a scan against specified servers or a network. The system performs the scan based on the scan options specified by the user, and displays the scan results to the user, such as one or more vulnerabilities found on the specified servers. The user can prioritize and categorize the collected data based on configurable settings. The user can also send a particular type of message to a voice over IP network and see the result.

Claims

1. A computer-implemented method, comprising the steps of:

scanning at least two target systems;

identifying at least one target system that is voice-over IP enabled;

receiving at least one scan option, the scan option receives input from a user in which the user specifies parameters for crafting at least one individual message to be sent to the at least one target system, the at least one individual message being used for identifying specific security vulnerabilities within the at least one target system;

generating the at least one individual message based on the at least scan option;

sending the at least one individual message through the at least one target system;

analyzing how the at least one individual message was handled by the at least one target system; and

identifying the specific security vulnerabilities for at least one target system based on results of the analyzing step.

2. The computer-implemented method of claim 1 wherein the user-defined parameters include a size and type of message.

3. The computer-implemented method of claim 1 further comprising the steps of:

generating a malformed message of a user-defined size and type; and

sending the malformed message to the target system as a test for the target system.

4. The computer-implemented method of claim 1 further comprising the steps of:

generating messages of a plurality of sizes; and

sending the messages to the target system to detect buffer overflow problems in the target system.

5. The computer-implemented method of claim 1 further comprising the steps of:

generating a message having SIP, SDP and/or RTP content; and

sending the message to the target system to test specific issues with at least one SIP component.

6. The computer-implemented method of claim 1 further comprising the steps of:

generating a message having SIP, SDP and/or RTP content; and

sending the message to the target system to generate various attacks on the target system.

7. The computer-implemented method of claim 1 wherein the scan option includes one of method checks, security control checks, vulnerability checks, the ability to check user information, protocol checks, logging options, authentication of SIP messages, registration checks and encryption capabilities.

8. The computer-implemented method of claim 1 further comprising the step of:

using attack vectors and security framework to perform a test against the target system.

9. The computer-implemented method of claim 1 further comprising the step of:

identifying a plurality of voice over IP components;

generating a visualization map of the plurality of voice over IP components; and

receiving input from a user to specify an importance level of at least one of the plurality of voice over IP components present on the visualization map.

10. A system comprising:

one or more processors;

one or more computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including;

scanning at least two target systems;

identifying at least one target system that is voice-over IP enabled;

receiving at least one scan option, the scan option receives input from a user in which the user specifies parameters for crafting at least one individual message to be sent to the at least one target system, the at least one individual message being used for identifying specific security vulnerabilities within the at least one target system;

generating at least one individual message based on the at least scan option;

sending the at least one individual message through the at least one target system;

analyzing how the at least one individual message was handled by the at least one target system; and

identifying the specific security vulnerabilities for at least one target system based on results of the analyzing step.

11. The system of claim 10 wherein the user-defined parameters include a size and type of message.

12. The system of claim 10 further comprising the operations of:

generating a malformed message of a user-defined size and type; and

sending the malformed message to the target system as a test for the target system.

13. The system of claim 10 further comprising the operations of:

generating messages of a plurality of sizes; and

sending the messages to the target system to detect buffer overflow problems in the target system.

14. The system of claim 10 further comprising the operation of:

using attack vectors and security framework to perform a test against the target system.

15. The system of claim 10 further comprising the operations of:

identifying a plurality of voice over IP components;

generating a visualization map of the plurality of voice over IP components; and

receiving input from a user to specify an importance level of at least one of the plurality of voice over IP components present on the visualization map.

16. A computer-program product, the product tangibly embodied in a machine-readable non-transitory storage medium, including instructions configured to cause a data processing apparatus to:

scan at least two target systems;

identify at least one target system that is voice-over IP enabled;

receive at least one scan option, the scan option receives input from a user in which the user specifies parameters for crafting at least one individual message to be sent to the at least one target system, the at least one individual message being used for identifying specific security vulnerabilities within the at least one target system;

generate at least individual one message based on the at least scan option;

send the at least one individual message through the at least one target system;

analyze how the at least one individual message was handled by the at least one target system; and

identify the specific security vulnerabilities for at least one target system based on results of the analyzing step.

17. The computer-program product of claim 16 wherein the user-defined parameters include a size and type of message.

18. The computer-program product of claim 16 further including instructions configured to cause a data processing apparatus to:

generate a malformed message of a user-defined size and type; and

send the malformed message to the target system as a test for the target system.

19. The computer-program product of claim 16 further including instructions configured to cause a data processing apparatus to:

generate messages of a plurality of sizes; and

send the messages to the target system to detect buffer overflow problems in the target system.

20. The computer-program product of claim 16 further including instructions configured to cause a data processing apparatus to:

identify a plurality of voice over IP components;

generate a visualization map of the plurality of voice over IP components; and

receive input from a user to specify an importance level of at least one of the plurality of voice over IP components present on the visualization map.