Security of IP Telephony in Ecuador: Online Analysis

Authors

  • José Estrada Escuela Politécnica Nacional
  • Mayra Calva Escuela Politécnica Nacional
  • Ana Rodríguez Escuela Politécnica Nacional
  • Christian Tipantuña Escuela Politécnica Nacional

DOI:

https://doi.org/10.29019/enfoqueute.v7n2.93

Keywords:

IP telephony, security, Ecuador, Asterisk, vulnerabilities, threats

Abstract

Telephony is a global service and thus telephone networks have been a coveted target for criminals. Now that voice can be transported over IP and that multiple services are integrated in a convergent model through Internet, there are more incentives to attack and more attackers. Moreover, the development of open source telephone applications has encouraged the massive use of IP telephony, but not an increased awareness about embedded security risks. Due to the current and intensive adoption of IP telephony systems in Ecuador, we conducted an exploration based on public information to obtain statistics about telephone systems connected to Internet in Ecuador. Additionally, using a deliberately vulnerable IP telephony system, we collected more data to do a preliminary analysis of threats to such systems. We found that hundreds of telephone systems were publicly available on the Internet and using outdated versions of Asterisk-based applications. We also found thousands of malicious interactions on the IP telephony system we deployed on the Internet.

Metrics

Downloads

Download data is not yet available.

References

Allen, L. (2012). Advanced Penetration Testing for Highly-Secured Environments: The Ultimate Security Guide. Packt Publishing Ltd.
Androulidakis, I. I. (2016). VoIP and PBX Security and Forensics: A Practical Approach.
Bryant, R., Madsen, L., & Van Meggelen, J. (2013). Asterisk: The definitive guide. " O'Reilly Media, Inc.".
Corporación Nacional de Telecomunicaciones. (2016). Troncal Telefónica IP - Telefonía | Corporación Nacional de Telecomunicaciones. [en línea] Disponible en: https://www.cnt.gob.ec/telefonia/plan-corporativo/troncal-telefonica-ip-2/ [Visitado 12 Ene. 2016].
Dassouki, K., Safa, H., & Hijazi, A. (2014, March). End to End Mechanism to Protect Sip from Signaling Attacks. In New Technologies, Mobility and Security (NTMS), 2014 6th International Conference on (pp. 1-5). IEEE.
El Comercio. (2015). Las llamadas por WhatsApp no pueden ser restringidas en Ecuador, según el Gobierno. [en línea] Disponible en: http://www.elcomercio.com/actualidad/llamadas-whatsapp-restringidas-ecuador-gobierno.html [Visitado 12 Ene. 2016].
El Universo. (2016). Skype reporta que algunos usuarios tienen problemas para realizar llamadas. [en línea] Disponible en: http://www.eluniverso.com/vida-estilo/2015/09/21/nota/5140421/skype-reporta-que-algunos-usuarios-tienen-problemas-realizar [Visitado 12 Ene. 2016].
EnableSecurity. (2012). SIPVicious. [en línea] Disponible en: http://blog.sipvicious.org/ [Visitado 1 Ene. 2016].
Exploit Database. (2010, Septiembre 24). FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution. Disponible en: https://www.exploit-db.com/exploits/15098/ [Visitado 31 Ene. 2016].
Exploit Database. (2014, Marzo 12). FreePBX 2.11.0 - Remote Command Execution. Disponible en: https://www.exploit-db.com/exploits/32214/ [Visitado 30 Ene. 2016].
Exploit Database. (2015, Marzo 7). Elastix 2.x - Blind SQL Injection Vulnerability [en línea] Disponible en: https://www.exploit-db.com/exploits/36305/ [Visitado 1 Ene. 2016].
Instituto Nacional de Compras Públicas. (2016). Ingreso al Sistema - Compras Públicas. [en línea] Disponible en: https://www.compraspublicas.gob.ec/ProcesoContratacion/compras/ [Visitado 1 Ene. 2016].
Ip2location. (2016). Block Visitors by Country | IP2Location.com. [en línea] Disponible en: http://www.ip2location.com/blockvisitorsbycountry.aspx [Visitado 1 Ene. 2016].
Puente, G. B. (2015). Elastix Unified Communications Server Cookbook. Packt Publishing Ltd.
Sangoma. (2014). FreePBX. [en línea] Disponible en: https://www.freepbx.org/ [Visitado 1 Ene. 2016].
Terán, F. (2012). Nuevas fallas de seguridad Zero Day descubiertas en Asterisk 1.6.2, 1.8 y Asterisk 10. [en línea] Sinologic :: Tu web favorita sobre VoIP. Disponible en: https://www.sinologic.net/blog/2012-04/nuevas-fallas-de-seguridad-zero-day-descubiertas-en-asterisk-1-6-2-1-8-y-asterisk-10.html [Visitado 1 Ene. 2016].

Published

2016-06-30

How to Cite

Estrada, J., Calva, M., Rodríguez, A., & Tipantuña, C. (2016). Security of IP Telephony in Ecuador: Online Analysis. Enfoque UTE, 7(2), pp. 25 - 40. https://doi.org/10.29019/enfoqueute.v7n2.93

Issue

Vol. 7 No. 2 (2016)

Section

Miscellaneous

The articles and research published by the UTE University are carried out under the Open Access regime in electronic format. By submitting an article to any of the scientific journals of the UTE University, the author or authors accept these conditions.

The UTE applies the Creative Commons Attribution (CC-BY) license to articles in its scientific journals. Under this open access license, as an author you agree that anyone may reuse your article in whole or in part for any purpose, free of charge, including commercial purposes. Anyone can copy, distribute or reuse the content as long as the author and original source are correctly cited. This facilitates freedom of reuse and also ensures that content can be extracted without barriers for research needs.

 

This work is licensed under a Creative Commons Attribution 3.0 International (CC BY 3.0).

 

In addition, the journal Enfoque UTE guarantees and declares that authors always retain all copyrights to the original published works without restrictions [© The Author(s)]. Acknowledgment (BY): Any exploitation of the work is allowed, including a commercial purpose, as well as the creation of derivative works, the distribution of which is also allowed without any restriction.