Date: 2008-02-14 15:33 Subject: Mobile World Congress - Barcelona Security: Public Tags: 3gsm, bluebox, fring, iotum, maxroam, mippin, mobile world congress, segala, spinvox, truphone, voipsa

I just returned from two days in Barcelona at the Mobile World Congress (formerly known as 3GSM).  That really is a big show now, and the sheer breadth of the mobile industry is quite amazing.  Everything was there from different wireless technologies to content providers, operators, handsets, service delivery software, security.  Just staggering.  For my money 3GSM was a cooler name for the show, but there you go.

As ever, though, the people make the event.  I finally got to meet Jonathan Zar of the Bluebox podcast, and also outreach chair at VOIPSA.  I've been collaborating with Jonathan at a distance for a couple of years, but this is the first time we were ever in the same place at the same time.  I've failed to meet him in America, in Asia and in Europe, and now finally we got to spend some time together.  Weird in our modern social-media connected world, that when we met in person we discovered that we were already friends.  Great to meet you Jonathan!

Other notable folks were James Tagg, James Body and Ali Khan of mobile operator Truphone, Alec Saunders of iotum, the irrepressible Pat Phelan of Maxroam, Paul Walsh of Segala (who by fortune was on the same plane on the way out), James Whatley of Spinvox, Prashant Agarwal of Mippin, Avi Schechter of Fring, and mobile journalist extraordinaire Markus Goebel.

Date: 2007-04-16 14:29 Subject: The Phone Goes Clunk Security: Public Tags: blue box, bluebox, phones, podcast, shawn merdinger, voip, voip security, voipsa

On the way to work this morning I listened to the latest episode of Blue Box: The VoIP Security Podcast, as usual a great show from Dan & Jonathan. Listening to the news about phone vulnerabilities,it occurred to me that there are a lot of very fragile VoIP phone products out there, and I have one at work that is remarkably easy to crash. Thankfully, it's only a VoIP test phone, rather than one that I rely on for communication. I did a test some weeks ago, trying to see what UDP services might be available on the phone by doing a portscan. I found that if I scanned all the ports rapidly (I later narrowed this down to a range of some 100's of ports), then the phone would make a 'clunk' noise and reboot. Perfect for a denial-of-service attack to take a company's whole phone system down. I won't name the phone vendor, but it wasn't one of the phones named in the Blue Box report. Surprising that such simple attacks can succeed on commercially available products.

It's well worth checking out some of the stuff that Shawn Merdinger has been writing recently on the topic of phone vulnerabilities on the VoIPSA website.

Date: 2007-04-03 07:30 Subject: Voice SPAM and VoIP SEAL Security: Public Tags: 3gsm, bluebox, dan york, dialogic, martyn davies, media gateway, microsoft, nec, ocs, pbx, podcast, pstn, saverio niccolini, spam, spit, um, voip, voip seal

Back in February I went to the 3GSM Congress in Barcelona where my employer, Dialogic, were exhibiting. 3GSM is a trade show and conference, and it has really taken over in the last few years as the event for everything to do with wireless.

While I was there I visited NEC, and that visit paid a double dividend. Firstly, NEC Philips have their own range of PBX and Unified Messaging (UM) solutions, and provide a messaging solution that connects their PBXes with the Microsoft Office Connect Server (OCS) that has been making so much news in the UM space in the last few months. The NEC Philips solution uses some of Dialogic's Media Gateway products as the glue to connect between PBX and OCS, in order to allow the hand-off of VoIP calls to the PSTN.

Secondly, I met Saverio Niccolini, senior researcher at NEC, who I saw last speaking at the VoIP Security Workshop in Berlin last year. Saverio was demonstrating VoIP SEAL (SEcure Application Layer gateway), a technology to fight SPIT or VoIP SPAM. I managed to get an interview with him, where he explains how this works and when it will be productized. My friend Dan York has now put this interview up as a Bluebox special edition podcast, so do check that out.