German security agency warns of VoIP security risks

IDG News Service - Germany's Federal Office for Security in Information Technology (BSI) is warning businesses of potential security risks with voice-over-IP (VoIP) technology, in a study presented at the Systems IT exhibition and conference in Munich.
The VoIPSec report, released Monday at the opening of Systems, appeared one day before Skype Technologies SA, one of the world's largest providers of VoIP service, acknowledged critical flaws in its software and urged users to upgrade to the latest version.
In its report, the BSI warned that although no spectacular attacks in the business world have been reported yet, it's only a matter of time before problems emerge.
The report lists 19 varieties of attacks on VoIP systems that can lead to a number of security threats, such as identity theft, data manipulation, transmission errors and incorrect billing. Also, VoIP opens the door to the various forms of malicious software that can spread wildly in data networks, such as viruses, worms and Trojan horses, according to the report.
Authors of the VoIPSec study are urging companies to analyze where they plan to implement VoIP, how crucial secure communication is to that particular business process and what level of security can be ensured. And although one of the biggest sales pitches of companies supplying VoIP systems is the convergence of voice and data networks, the authors are recommending a separation of IP voice and IP data networks."
The study is available online in German.
In a panel discussion at the Systems conference, Manfred Fink, president of Manfred Fink Security Consulting, urged businesses to be aware of the hype surrounding VoIP. "Manufacturers are telling businesses how they can save money by converging their voice and data networks," he said. "But IT managers should be aware that the money they may save in combining their IP voice and data networks could be offset by the money they will need to spend to make these networks secure."
Detlev Henze, a security expert in the IT security unit of the safety control agency TUV Rheinland Group, urged users to move "very carefully" in deploying VoIP technology, especially on a global basis. "It's best to start in small, closed user groups and to work closely with security experts who are aware of the many potential risks involved in VoIP," he said. "This is a moving target."
The Systems event runs through Friday.