Establish a holistic security stance by learning to view your unified communications infrastructure through the eyes of the nefarious cyber-criminal. Hacking Exposed Unified Communications & VoIP, Second Edition offers thoroughly expanded coverage of today’s rampant threats alongside ready-to deploy countermeasures. Find out how to block TDoS, toll fraud, voice SPAM, voice social engineering and phishing, eavesdropping, and man-in-the-middle exploits. This comprehensive guide features all-new chapters, case studies, and examples.

The latest techniques for averting UC disaster

“This book is a must-read for any security professional responsible for VoIP or UC infrastructure. This new edition is a powerful resource that will help you keep your communications systems secure.” ―Dan York, Producer and Co-Host, Blue Box: The VoIP Security Podcast

“The original edition, Hacking Exposed: Voice over IP Secrets & Solutions, provided a valuable resource for security professionals. But since then, criminals abusing VoIP and UC have become more sophisticated and prolific, with some high-profile cases ringing up huge losses. This book is a welcome update that covers these new threats with practical examples, showing the exact tools in use by the real attackers.” ―Sandro Gauci, Penetration Tester and Security Researcher, Author of SIPVicious

Table of Contents

Part I Casing the Establishment

1 VoIP Targets, Threats, and Components

2 Footprinting a UC Network

3 Scanning a UC Network

4 Enumerating a UC Network

Part II Application Attacks

5 Toll Fraud and Service Abuse

6 Calling Number Spoofing

7 Harassing Calls and Telephony Denial of Service (TDoS)

8 Voice SPAM

9 Voice Social Engineering and Voice Phishing

Part III Exploiting the UC Network

10 UC Network Eavesdropping

11 UC Interception and Modification

12 UC Network Infrastructure Denial of Service (DoS)

13 Cisco Unifi ed Communications Manager

Part IV UC Session and Application Hacking

14 Fuzzing, Flooding, and Disruption of Service

15 Signaling Manipulation

16 Audio and Video Manipulation

17 Emerging Technologies

About the Authors

Mark Collier is the Chief Technology Officer at SecureLogix corporation, where he directs the companies Voice Over IP (VoIP) security research and development. Mark also defines and conducts VoIP security assessments for SecureLogix’s enterprise customers. Mark is actively performing research for the US Department of Defense, with a focus on developing SIP vulnerability assessment tools. Prior to SecureLogix, Mark was with Southwest Research Institute (SwRI), where he directed a group performing research and development in the areas of computer security and information warfare. Mark is a frequent speaker at major voice and security conferences. Mark has authored numerous articles and papers on VoIP security. Mark is also a founding member of the Voice Over IP Security Alliance (VoIPSA). Mark is a Magna Cum Laude graduate from St. Mary’s University, where he earned a Bachelors degree in Computer Science.

David Endler is the director of security research for 3Com's security division, TippingPoint, where he oversees product security testing, the VoIP security research center, and their vulnerability research team. While at TippingPoint, David founded an industry-wide group called the Voice over IP Security Alliance (VOIPSA) in 2005. VOIPSA’s mission is to help VoIP adoption by promoting the current state of VoIP security research, testing methodologies, best practices, and tools. David is currently the chairman of VOIPSA which boasts over 100 members from the VoIP vendor, carrier, and security space (http://www.voipsa.org). Prior to TippingPoint, David was the technical director at security services startup, iDefense, Inc. which was acquired by VeriSign. iDefense specializes in cyber security intelligence, tracking the activities of cyber-criminals and hackers, in addition to researching the latest vulnerabilities, worms, and viruses. Prior to iDefense, David spent many years in cutting edge security research roles with Xerox Corporation, the National Security Agency, and Massachusetts Institute of Technology. As an internationally recognized security expert, David is a frequent speaker at major industry conferences and has been quoted and featured in many top publications and media programs including the Wall Street Journal, USA Today, BusinessWeek, Wired Magazine, the Washington Post, CNET, Tech TV, and CNN. David has authored numerous articles and papers on computer security, and was named one of the Top 100 voices in IP Communications by IP Telephony Magazine. David is a Summa Cum Laude graduate from Tulane University where he earned a Bachelors degree and Masters degree in Computer Science.