Quick answer: VoIP and SIP penetration testing is a security service that examines, through an attacker's eyes, the flaws of an organization's voice communication system over the internet, that is its IP phones, call servers and unified communications infrastructure. The most common risks are the ability to listen to conversations because the call setup protocol is not encrypted, the ability to make calls in someone else's name by hijacking an account's registration, and call fraud over premium lines. This fraud can cause direct financial loss to the organization. DSET runs this test with its local AI engine KAOS and verifies every finding with a working proof.

Phone systems were long seen as a separate world, but today most organizations' voice communication flows over the internet, that is over the same network infrastructure. This makes the voice system an attack target just like a web application. An attacker can listen to calls, impersonate a number belonging to the organization, or run up large bills on the organization over premium lines. This article explains what VoIP and SIP penetration testing is, which flaws it targets and the DSET and KAOS approach.

What is VoIP and SIP penetration testing

VoIP and SIP penetration testing tests the flaws of IP based voice communication infrastructure through controlled attacks. The test has two main layers. The first layer is signaling, that is the protocol that sets up, routes and ends the call. The second layer is the voice stream itself, that is the traffic the conversation is carried over. The goal is to prove whether an attacker can take over one of these layers and listen to calls, impersonate an account and use the system for fraud.

Which flaws it targets

The flaws of VoIP systems often stem from leaving security to the network layer and from weak authentication.

Flaw class What it means Typical result
Unencrypted signaling The call setup protocol is plaintext Call interception, information exposure
Registration hijacking The attacker takes over an account's registration Impersonation, call redirection
Weak authentication Extensions are easily guessed Unauthorized access
Toll fraud The system is abused for external premium calls Direct financial loss
Service disruption Signaling is flooded The phone system goes down

The essence of the table is this: when VoIP security is left only to network isolation, an attacker who crosses that isolation reaches all voice communication. For this reason voice traffic must be encrypted and authentication must be strong. Because the voice system is often part of the organization's internal network, Active Directory internal network penetration testing and the lateral movement topic of pivoting and tunneling are directly related to this test.

Why toll fraud matters

A risk specific to VoIP systems that most organizations do not notice is toll fraud. When an attacker takes over a poorly protected call server, they can make thousands of calls to international or premium lines over that server. The bill for these calls goes to the organization and the damage can reach large amounts in a very short time. For this reason the test measures not only the privacy risk but also the direct financial loss risk. In this respect a VoIP test can carry as concrete a cost, in terms of business impact, as the first 24 hours of a ransomware incident.

Interception and impersonation

When signaling and voice traffic are not encrypted, an attacker who reaches the same network can record conversations. More dangerously, if authentication is weak, the attacker can impersonate an employee's number to make calls in their name or redirect incoming calls to themselves. This is both a privacy breach and a social engineering tool; indeed internal calls are often the most trusted communication channel and that trust can be abused.

When is it needed

VoIP penetration testing should be done when a new IP phone system is set up, when the system is moved to another network and at regular intervals. It is especially important for organizations that run a call center, make international calls and for which voice communication is critical to business continuity. The scope must be drawn clearly before the test, for which the penetration testing preparation and scoping guide is the reference point.

The KAOS and DSET approach

DSET runs VoIP and SIP penetration testing with its local AI engine KAOS. KAOS examines the signaling protocol for encryption and authentication, tests registration hijacking and fraud scenarios in a controlled way and reports every flaw it finds with a working proof, under the principle of proof based verification. The difference is this: it does not settle for saying a call could theoretically be intercepted, it proves in a controlled environment that the interception is actually possible. After a finding is verified, retest and remediation verification is applied to see that the fix works.

Frequently asked questions

I use a cloud based phone service, is a test still needed? Yes. In a cloud based unified communications service part of the infrastructure belongs to the provider, but your configuration, your extensions, your authentication settings and the devices connected to the system are your responsibility. Flaws like registration hijacking and weak authentication appear in this layer that is your responsibility.

How different is a VoIP test from a normal network penetration test? A VoIP test shares the methods of a network penetration test, but additionally includes attacks specific to voice protocols, for example registration hijacking, call interception and toll fraud. This extra layer stems from the unique protocols of voice signaling, so the voice system must be tested separately.

Will my phone service be interrupted during the test? In a well planned test no. Tests that could cause a service interruption, for example signaling flood attempts, are run only with prior and explicit approval and, when possible, outside working hours. Which tests will be done are set in advance by contract.

Sources

To examine your IP telephony and unified communications infrastructure with a proof based test, contact DSET. We provide VoIP and SIP penetration testing and consulting from our Ankara Hacettepe Teknokent laboratory.