Voice of Warning: Button Up Your Communications SecurityVoice of Warning: Button Up Your Communications Security

From urban schools to national power grids, organizations of all types need to take stock of how hackers can use or abuse voice and real-time communications systems.

A news story out of Boston last week caught our attention here at No Jitter and Enterprise Connect as a real-life example of one of the various ways criminal hackers can use phone systems to perpetrate their malicious attacks. As reported by Boston.com, several high schools in the area received bomb threats on Monday morning, with some of those arriving via automated phone call, which is not the first time something like this has happened.

We heard about such potential exploits during the Security Summit at last month's Enterprise Connect conference, where Weston Hecker, a network/security engineer and hacker with High Point Networks, described some of the various ways enterprise voice threats are evolving. Regular No Jitter blogger Andrew Prokop, a SIP expert with Arrow SI, has picked up on the theme in his recent two-part blog series on hacking as a service (HaaS), and in fact described just this sort of scenario in his first piece:

As daunting as these types of attacks are, they almost seem child's play compared to some of the cyberattack scenarios I heard about last week during an Oracle Industry Connect (OIC) keynote by Richard Clarke, cybersecurity expert and the nation's first-ever counterterrorism czar. Lots of Clarke's examples didn't relate to the voice infrastructure, but the late December 2015 cyberattack on a Ukraine power grid sure did.

In this incident, hackers finessed their way into the power grid's operation center and "threw the breakers" on one subnet after the next, Clarke said. A hapless system administrator could do nothing but watch as his mouse, now out of his control, pointed and clicked its way to a power shutdown that affected some 225,000 customers, he continued.

Then, "just because they could" -- and here's where the phone system comes into play -- the attackers launched a denial-of-service (DoS) attack against the VoIP system and brought that down, too. And with that, the power company couldn't coordinate its response by phone, either.

I'm sure that many enterprises, especially those in sensitive businesses like financial services and healthcare, are taking this stuff pretty seriously. I heard one example while speaking about real-time communications use cases with Iago Soto, CMO and co-founder of Quobis, a Spain-based WebRTC solutions provider that primarily serves Western Europe and South America. One of Quobis's bank customers wanted to use click-to-video call functionality as part of a campaign aimed at making it super quick and easy for potential customers to sign up for accounts. But, of course, the IT security team had something to say about that.

The big fear, Soto said, was that the click button would become the target of a DoS attack and disrupt the bank's ability to provide service. To address the concern, Quobis incorporated a few security rules into its WebRTC software implementation. Should clicks on the video call button originate more than three times in one minute from the same IP address, for example, the software disallows the connection.

But to hear Clarke tell it, neither the private nor public sectors are doing nearly enough -- especially given the holey legacy infrastructure put in place when such attacks weren't possible, but which is not going away any time soon. And then there's the infinite volume of connected devices coming online with the Internet of Things. "Think of the security problem that comes with that," he said.

Whether companies realize it or not, hackers have already penetrated so many networks and are but biding their time. "The task now isn't to keep them out. The task is to limit what they can do," Clarke said.

He gave a few quick suggestions on how enterprises could do more. First, encrypt end to end (note to Congress: No backdoors allowed). Second, hire a managed security services provider rather than going it alone; and third, "put more stuff in the cloud," where security and management at scale are easier.

Follow Beth Schultz and No Jitter on Twitter and Google+!
@nojitter
@Beth_Schultz
Beth Schultz on Google+