Customer Reviews

Hacking VoIP: Protocols, Attacks, and Countermeasures

5 star:		(1)
4 star:		(1)
3 star:		(1)
2 star:		(1)
1 star:		(0)

 

 

Eureka! What a pleasant surprise. This is the best Hacking book I have ever read. as matter of fact the book scared me so much that if asked I would classify it as "non-fictional horror".

According to Himanshu Dwivedi "Hacking VoIP is a security book written primarily for VoIP administrators"; This statement is in the introduction of the book, that is the only thing I did not find to be true, I like to change that statement to read something like " .....a security book written primarily for Information Security and Auditors it can also be used by VoIP administrators.....".

I accidentally started reading this book, and I just got hooked. The book is devided into 4 sections;
1-Introduction VoIP Security
2-VoIP Protocols
3-Security treats
4-Securing and Auditing VoIP
The 4 sections are contained in very well organized 10 Chapters. Each chapter, no each line of each chapter is a list of ingredients needed to break in to a VoIP phone, switch or a server.

The author goes at great lengths creating a VoIP lab, following his step by step recommendations and downloading the programs listed, I actually created the exact same lab, I have no idea why. Than downloaded the hacking tools, which should go in the blacklisted application database of every business, once again following the steps outlined in the book I could actually break into conversations, change caller ID (you can really play sick tricks with this feature), and realize that the 6 character password I have for my voice mail is actually crackable in less than 10 minutes.

OK!, Where is the beef? You may ask, how can I use this book? Well! Up to Chapter 9 you learn what a malicious person is or may try to do. Chapter 10 you learn to identify weaknesses and block the attempts, integrating this with a well planned Information Security Management System such as ISO 27001, and creating an audit plan based on recommendations, you can rest assured that your VoIP is secured, you probable need to read about implementing 802.1x, this is also a recommendation in the book.
Best Fishes and thanks for reading.

Voice over IP (VoIP) communications are a core component of the next wave of communications. Consumers and enterprises both are beginning to grasp the benefits of VoIP communications and making the switch from traditional voice communications to VoIP.

VoIP can be a double-edged sword as well though. It provides cost savings. It adds flexibility and extensibility that isn't possible with traditional telephone communications. It enables a whole new scope of applications to interact with and leverage voice communications in whole new ways.

However, with all of those benefits, it also merges voice data onto the standard data network and exposes what was a relatively secure system to a wide variety of attacks and exploits. Traditional voice attacks like eavesdropping or wiretapping are still issues, but on a grander scale. And now voice communications can also be subjected to denial-of-service (DoS) and man-in-the-middle (MiTM) and other attacks that have traditionally been reserved for data networks.

With Hacking VoIP: Protocols, Attacks, and Countermeasures from No Starch Press, Himanshu Dwivedi explores the security issues inherent with VoIP communications and how to protect your VoIP system against them.

Dwivedi opens the book by walking through how to build a VoIP lab environment to use as you read through the book to get first-hand experience and understanding of the VoIP attacks and exploits and the countermeasures to use against them. This hands-on experience helps the reader to see the attacks in action rather than just reading about them.

The book provides a good background on the VoIP protocols themselves, and Dwivedi does an excellent job of explaining the weaknesses and exploits. VoIP admins should read this book and follow Dwivedi's advice to protect their VoIP environments.

The opening of this book clearly explains that this book is for people who are system administrators. I would like to add that this book seems to be for system administrators who are just too busy with everything else to care about technicalities of the security and don't know much about security in general.

However, when I saw No Starch Press released this book, I was not expecting the contents to be so tame. The bulk of the book is how man in the middle attacks effect the different protocols and the multitudes of denial of service attacks using legitimate VoIP commands. However, the details are mostly just glossed over and a very general overview is given for the attack and then a tool is provided. How to use tools and the exact switches are perhaps half of the explanations in the book. For those who understand man in the middle, how there is no trust in UDP, and how to read RFC's, you will find little in this book that is interesting. This is the reason why I gave the book a 3 despite it being exactly what the title says.

Not all of the book was bad. Chapter 7 is on unconventional VoIP attacks and gives the reader some interesting ideas on how VoIP attacks can be used. The first half of Chapter 6 shows client configuration abuses and is the type of material I was expecting from this book.

If you are a system administrator who doesn't know much about security and would like to read some quick overview of VoIP insecurities without technicalities, this is the perfect book for you. If you were looking for a technical guide on VoIP security, then look elsewhere.

The books contains very little VOIP information and most of the attack vectors described are generic "attacker on the LAN" scenarios.

On many occasions the same type of attacked is explained again and again almost copy/paste stile. There are entire sections repeated with just the type of message replaced.

The book contains a cursory review of VOIP which may be useful to people that never had any exposure to those technologies.

The book also spends a lot of content on tools to the point where it gives click-by-click instructions one how to use basic tools instead of drilling down in the technology behind it.

Over all it's a quick read that takes less than 3-4 hours due to the huge amount of redundancy. It has very little technical value but it would be a great asset to a script kiddie.