Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Any one have any experience in testing ISDN based VC systems?

What approach did you take, tools used? How did you approach fuzzing the protocol?

What resources did you read up on prior to testing?

share|improve this question
I also have some video conference systems which I would love to do some testing on. However these systems are not ISDN based, but uses xDSL/Fiber. Is there any difference you think? – Chris Dale Dec 21 '10 at 8:16
up vote 3 down vote accepted

I have had limited exposure to this - but the main attack routes I have found successful in Video and VOIP have always been misconfigured H.323 gateways - it can be very difficult to set up H.323 and the associated protocols correctly, as each vendor seems to implement things differently. Symantec had a useful list of 20 rules in this paper - well worth having a look.

share|improve this answer

More important than fuzzing the implementation, is wether the conversation itself is secure. Most VOIP implementations don't encrypt the conversation. Capture a call session with tcpdump or wireshark and run the capture through Cain & Able to see if you can extract an audio stream.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.