Danger over the phone / Researchers at Fraunhofer SIT find serious security flaws in VoIP telephones (FOTO)

Darmstadt (ots) -

Hackers can access sensitive data and services also via telephone
devices: Most companies use VoIP telephones that are integrated into
the company network. Security researchers at the Fraunhofer Institute
for Secure Information Technology have found a total of 40 partly
serious vulnerabilities in these VoIP telephones. Attackers can
misuse these gaps to intercept calls, deactivate the telephone or
gain further access to the company network via weak points in the
device. The VoIP telephones producers have by now closed these
vulnerabilities. Users are strongly recommended to install the
appropriate updates of the device's firmware. Further technical
details on the vulnerabilities can be found at
www.sit.fraunhofer.de/cve. The researchers presented the results of
their investigations at DEFCON, one of the world's largest hacker
conferences.

The security experts at Fraunhofer SIT tested a total of 33 VoIP
telephone devices from 25 different manufacturers for flaws and
vulnerabilities. For this purpose, they examined the devices'
web-based user interfaces , which administrators can use to configure
the phones. Even the security experts were surprised by the results:
"We didn't expect to find so many critical gaps, because these
devices have been on the market for a long time and they should have
been tested and secure," explains Stephan Huber, one of the
researchers involved in the study.

One type of vulnerability was so severe that the security
researchers were able to gain complete administrative control over
the VoIP phone. "This is a total security failure", says scientist
Philipp Roskosch, who was involved in the investigation as well.
Attackers could also use this to manipulate other devices in the same
network, such as other VoIP telephones, computers or production
machines. This attack was possible with seven devices. Another attack
scenario was a denial of service attack that took VoIP phones out of
action. This can damage the business of customer hotlines, e.g. banks
or insurance companies.

The security researchers informed all the manufacturers of the
VoIP telephones investigated about the vulnerabilities found; they
all reacted and closed the gaps. The Fraunhofer SIT experts therefore
advise all users to keep their own devices up to date and to pay
attention to updates for the device firmware. Further technical
details on the VoIP telephones investigated and the gaps can be found
on the Internet at www.sit.fraunhofer.de/cve.

Contact:
Oliver Küch
presse@sit.fraunhofer.de
+49-6151-869-213

Original-Content von: Fraunhofer-Institut für Sichere Informationstechnologie SIT, übermittelt durch news aktuell