Any one have any experience in testing ISDN based VC systems?
What approach did you take, tools used? How did you approach fuzzing the protocol?
What resources did you read up on prior to testing?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityAny one have any experience in testing ISDN based VC systems?
What approach did you take, tools used? How did you approach fuzzing the protocol?
What resources did you read up on prior to testing?
I have had limited exposure to this - but the main attack routes I have found successful in Video and VOIP have always been misconfigured H.323 gateways - it can be very difficult to set up H.323 and the associated protocols correctly, as each vendor seems to implement things differently. Symantec had a useful list of 20 rules in this paper - well worth having a look.
More important than fuzzing the implementation, is wether the conversation itself is secure. Most VOIP implementations don't encrypt the conversation. Capture a call session with tcpdump or wireshark and run the capture through Cain & Able to see if you can extract an audio stream.