Surprise: Major VoIP Providers Are Insecure

A Texas company claims that people using Vonage, Globe7, and Grandstream for VoIP service are vulnerable to several different types of attacks, including having their phone accounts hijacked.

According to Sipera Systems, "the Vonage VoIP Motorola Phone Adapter (VT 2142-VD) and Vonage service implementations leave users vulnerable to a form of VoIP identity theft, allowing hackers to take over a user's phone service with a registration replay attack, then make and receive calls while impersonating the victim." Exacerbating the problem are the lack of encryption for VoIP calls when using Vonage, the ability to launch DoS attacks using "SIP INVITE" control messages, and the ability of intruders to send voice spam to Vonage customers.

Sipera also found security problems with Globe7's online account access. Intruders could gain access to customer names, passwords, and account data. Intruders could also impersonate legitimate Globe7 users to make and receive calls.

Grandstream's PSTN adapter is vulnerable to buffer overflows and fragmented packet attacks, which could allow intruders to create a DoS attack that disconnects service to Grandstream users.

"These vulnerabilities create serious privacy and service availability issues for users," said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. "Vonage, Globe7 and Grandstream customers can no longer assume that their VoIP providers are automatically securing their services, but they should demand best security practices be followed as a condition of becoming a customer."