1

I have VOIP service from PhonePower...

They give their users an MTA device to connect to their network, however their instructions are that the user must turn on DMZ-Hosting for this device, to allow their service to work.

The problem I see with that is the warning message associated with this setting in my router's firmware. The following warning is given:

[ WARNING! Using a computer in DMZ mode opens the computer to outside intrusion, thus creating a security risk. ]

Additionally, my VOIP service with PhonePower seems to work fine right now without turning DMZ-Hosting on to recognize the mac-address of the MTA PhonePower device. So my logical conclusion thus far is---why should I turn on DMZ-Hosting, if my VOIP service seems to work fine without it?

When I pressed PhonePower for an explanation, they acknowledged that my overall security would be lowered with the router and their device if DMZ-Hosting is turned on and said its up to me how I choose to configure it, however they still maintained that it really should be on for their service to work. I responded by saying, "So, could that mean that even though my VOIP works now with DMZ off, that it might stop working again?" The response from PhonePower was, "Yes." I then asked if the reason for this is because my VOIP uses a separate network, to which they said yes.

Given the implicit warning I encountered in my router's firmware configuration, it still makes me scratch my head that a feature like DMZ would be required, especially since it would lower my overall security, as PhonePower indeed confirmed for me.

If I run into further problems down the road yet I still want to keep my VOIP service active, I guess I would have no choice but to turn DMZ-Hosting back on as suggested by PhonePower, but if my service works right now without it, I feel like it just makes more sense to keep DMZ off.

Any technical and objective insight into this matter would be greatly appreciated...

1

No. Its not a security issue itself since the DMZ hosting would only apply to the VOIP device, not your computer - eg you enter the IP of the device to open all ports for. However, if the VOIP device would have security vulnerabilitys, the VOIP device could be used as a hop to reach your computers.

A better idea is to ask your VOIP provider which incoming ports the service provider uses, and manually opening these in port forward.

The reason they ask you to DMZ it is to keep it simple for newbies.

The reason the service works, is because outgoing calls use outgoing traffic. Also the device "probe" the VOIP service with regular intervals. This keeps the UDP ports open so incoming calls work. But sometimes, it can happen that the Connection in the state table would timeout, and then you wouldn't be able to receive calls until the next probe or the next time you make a outgoing call.

NAT devices can also cause "one-way" audio problems with VOIP, where one party does hear the other party, but the other party does not hear one party.

Keep DMZ closed, but if you get reports on people not being able to call you (eg friends that say that it was difficult to reach you) or one-way audio problems, they hear you but you dont hear them, or the opposite, you should manually open the indivual ports the VOIP service uses instead.

  • Yes it is a security issue in itself. The VoIP device becomes a target for VoIP based toll fraud. Most internet facing VoIP devices tend to have subpar usernames and passwords. Being the device would have no security on it, bruteforcing an account using sipvicous would be a breeze allowing an attacker to place calls through that device, or registering a rogue device with the same credentials and calling high rate numbers. – munkeyoto Oct 24 '14 at 15:22
  • This security issue would be present even if you open the single VOIP ports only, because if you manage to hack the password, you would often be able to register through that device as a SIP Proxy and thus call high rate numbers anyways. So basically, as soon as the VOIP device works, its possible that it can be hacked. Adding the IPs of the VOIP service provider in the port forwards as "source IP" may work, but many VOIP providers do load balancing and thus change IP adresses very often. – sebastian nielsen Oct 24 '14 at 16:16
  • You're confusing two issues here. 1) For an attacker to place calls he'd need credentials. That can only be had compromising his provider, or his device. His device makes an easier target. 2) His device being a target, it makes more sense for an attacker to attack through his device (since it doesn't log) versus having to register a SIP account which would show his provider where the attacker is registering from. – munkeyoto Oct 24 '14 at 21:25
  • With "registering" I mean the action "SIP register" and not registering at the provider. Eg, you could connect to the SIP device through the standard 5060 port, and then using compromised DEVICE credentials (eg default admin/admin password or a vulnerability) to ask the SIP device to act as a Proxy to "SIP register" with the operator using the device-programmed credentials. So basically, lets say you open the SIP port to the SIP device behind router. Credentials to device: admin/admin. Credentials to operator: user/xxxxx. Attacker sends SIP Proxy register to SIP device at port 5060 using admin – sebastian nielsen Oct 24 '14 at 23:52
  • /admin. The device now registers at operator with credentials user/xxxxx. Now the attacker is using the SIP device as a Proxy to Place expensive calls. Do you understand now? What I want to say, is that if the device is compromisable, it will be in many cases compromisable over the SIP port that you HAVE to open to get working telephony. – sebastian nielsen Oct 24 '14 at 23:53
1

Many ITSPs (Internet Telephone Service Providers) request that client's place VoIP based devices on DMZs because many routers are firewall performing network address translation (NAT) mangle packets, and cause one way audio (client can hear, caller can't and vice versa). VoIP based devices work like via SIP messages:

Caller --> SS7 switch --> voip --> provider --> your device (SIP)

A message will usually look like this:

   MESSAGE sip:2125551212@yourprovider.com SIP/2.0
   Via: SIP/2.0/TCP ss7-2-voip.yourprovider.com;branch=1337
   Max-Forwards: 70
   From: sip:2125551212@yourprovider.com;tag=1337
   To: sip:YOURTELEPHONENUMBER@yourprovider.com
   CSeq: 1 MESSAGE
   Content-Type: text/plain
   Content-Length: 18

This is done via SIP on port 5060. If your device was behind a firewall, a simple one to one rule allowing 5060 to connect would suffice to make your phone ring, but when a conversation begins, things get interesting. Inside of the SIP message, there is an RTP port. RTP is how audio takes flight, and this is a random port between 20000-30000 in most cases. Which means, you'd have to punch even more holes in your firewall to allow these through.

For providers, it's easier for them to say: Place this outside of your DMZ, than it is to say: Ok, you need to open ports 5060, and also, 20000-30000 because there WILL BE times when someone is going to come back (not understanding networking) and say: "Oh there is no way I am opening that many ports! An attacker will kill me!"

On the NAT side of the equation, many firewalls will change the addressing information (this is what NAT does), but they are not capable of modifying the IP addressing information INSIDE of the SIP message. So what occurs is this:

ORIGINAL SIP PACKET

   MESSAGE sip:2125551212@yourprovider.com SIP/2.0
   Via: SIP/2.0/TCP ss7-2-voip.yourprovider.com;branch=1337
   Max-Forwards: 70
   From: sip:2125551212@yourprovider.com;tag=1337
   To: sip:YOURTELEPHONENUMBER@yourprovider.com <---- TAKE NOTE

MODIFIED NAT PACKET

   MESSAGE sip:2125551212@yourprovider.com SIP/2.0
   Via: SIP/2.0/TCP ss7-2-voip.yourprovider.com;branch=1337
   Max-Forwards: 70
   From: sip:2125551212@yourprovider.com;tag=1337
   To: sip:YOURTELEPHONENUMBER@192.168.0.1:23456 <--- NAT REWRITE PORT TUPLE

Best best to overcome the fear, is make a one to one rule to and from your provider. If something happens via your provider, they are to blame.

0

Doing a DMZ on a voip telephone adapter doesn't cause harm to your network.

The right way to do a DMZ is to assign a DMZ Host on your router and assign the same IP for your VTA, this will result in your VTA being exposed to the Internet; the other devices connected to your router (computers, phones, etc) will still remain protected behind the routers firewall.

A VoIP telephone adapter (like the Grandstream HT802) cannot be hacked because it doesn't have anything to hack into (no Operating System, logical processor or a local storage) the only damage they can do to such a device is corrupt its firmware and make it non operational but it cannot steal info from your computer (it doesn't have the hardware to do so), it cant communicate back to a computer, and also because your computer is still protected with the firewall, it's like a dummy box which logs on to your service providers ISP server and transmits the conversation through the analog telephone connected to it.

The difference with a device that can be hacked is that the VoIP Telephone Adapter does not have anything to hack into, but a normal server does.

  • 1
    Please try to avoid 'wall of text' answers. This is not really easy to read. – MiaoHatola Apr 6 '17 at 7:35
-5

Yes it is a security issue in itself. The VoIP device becomes a target for VoIP based toll fraud. Most internet facing VoIP devices tend to have usernames and passwords.

  • 1
    I really appreciate that you disclose that you are a vendor! Unfortunately, this answer doesn't really address the question, and your post comes across as marketing and not a solution to the expressed problem of the OP. – schroeder Mar 25 '15 at 18:34
  • 1
    James - I have edited this question to remove the spam, but if you do it again you'll be suspended or removed entirely. We don't permit spam here. – Rory Alsop Mar 25 '15 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.