1An Analysis of Security Threats and Tools in SIP-Based VoIP Systems

Security tools such as protocol analyzers, vulnerability assessment utilities and security monitoring utilities are among the common tools in a security professional’s arsenal. Such tools have reached a high level of dependence among security professionals for evaluating potential vulnerabilities in such areas as operating systems, device configuration, networking protocols and applications. However, these tools have their limitations, such as (1) where they are applied, (2) how they are implemented and (3) how they are maintained and updated. Furthermore, while such tools are fairly robust for more mature technology, it remains difficult to develop comprehensive security tools for emerging technology. Voice over Internet Protocol is an example of such an emerging technology. This paper explores the known VoIP-related vulnerabilities and tests several of the more popular open source and commercial VoIP security tools with the intention of demonstrating the gap that exists between vulnerability and detection. Understanding this gap will help to identify what issues need to be addressed in the future development of VoIP security tools