This "hack" is about on par with forging an email. VoIP standards (e.g. RFC 3261, or SIP) provide for end-to-end and hop-by-hop authentication methods which eliminate this problem if those methods are enabled. I think it's safe to say we'll see this kind of security turned on in typical deployments long before we see anything equivalent with email.

I think SecurityFocus would do well to step back and aim for a little more balance in its reporting. I wouldn't characterize the article as totally wrong but, without more balance, you run the risk of spreading FUD.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/9061/27368#27368