In regards to the mitigation techniques: -

- Enable MAC Address Filtering - This does not improve the security. The IP Phones MAC address can be easily discovered by connecting the IP Phone to the attacker's laptop and sniffing the traffic. Alternatively the MAC address is probably labelled on t...

[ more ]  [ reply ]

Great Article. I used the Voiphopper tool along with some other tools to perform the same attack. I will have a video up and running shortly. Great work Jason!!...

[ more ]  [ reply ]

How about security assessment of other areas related to VoIP? besides VLAN and route? Do you have any recommendation? http://sbin.cn/blog...

[ more ]  [ reply ]

Well, it's interesting. This is what we've been doing by hand since 1996, to show that VLAN's aren't the panacea for Security segregation.

I guess now someone has given it a name... we just called it VLAN testing. I guess we should make a tool for other VLAN's, and call it Network Hopping....

[ more ]  [ reply ]

Good summary, really nothing new here though. The vulnerabilities you are describing are more related to a switch port with dynamic trunking. This is far more serious then merely gaining access to the voice VLAN. The VLAN identifier being part of the CDP packet is a matter of convenience....

[ more ]  [ reply ]

There really isn't much here would stop a determined intruder. The vlan info might be able to be found on the phone itself, no sniffing required. Access-lists for voice traffic still leave a wide number of ports open as the protocols have dynamic destinations. These ACL?s should be in place, but it ...

[ more ]  [ reply ]