Danger Over the Phone:
Researchers Find Security Flaws In VoIP Telephones

Hackers can access sensitive data and services also via telephone devices: Most companies use VoIP telephones that are integrated into the company network. Security researchers at the Fraunhofer Institute for Secure Information Technology have found a total of 40 partly serious vulnerabilities in these VoIP telephones. Attackers can misuse these gaps to intercept calls, deactivate the telephone or gain further access to the company network via weak points in the device. The VoIP telephones producers have by now closed these vulnerabilities. Users are strongly recommended to install the appropriate updates of the device’s firmware. The researchers presented the results of their investigations at DEFCON, one of the world’s largest hacker conferences.

Researchers at Fraunhofer SIT find serious security flaws in VoIP telephones. “obs/Fraunhofer-Institut für Sichere Informationstechnologie SIT/Fraunhofer-Institut SIT”

The security experts at Fraunhofer SIT tested a total of 33 VoIP telephone devices from 25 different manufacturers for flaws and vulnerabilities. For this purpose, they examined the devices’ web-based user interfaces, which administrators can use to configure
the phones. Even the security experts were surprised by the results: “We didn’t expect to find so many critical gaps, because these devices have been on the market for a long time and they should have been tested and secure,” explains Stephan Huber, one of the researchers involved in the study.

One type of vulnerability was so severe that the security researchers
were able to gain complete administrative control over the VoIP phone. “This is a total security failure”, says scientist Philipp Roskosch, who was involved in the investigation as well. Attackers could also use this to manipulate other devices in the same network, such as other VoIP telephones, computers or production machines. This
attack was possible with seven devices. Another attack scenario was a
denial of service attack that took VoIP phones out of action. This can damage the business of customer hotlines, e.g. banks or insurance
companies.

The security researchers informed all the manufacturers of the VoIP telephones investigated about the vulnerabilities found; they all reacted and closed the gaps. The Fraunhofer SIT experts therefore advise all users to keep their own devices up to date and to pay attention to updates for the device firmware.