Sipera: Vonage, Globe7, Grandstream not secure

VoIP Security firm Sipera has claimed Vonage, Globe7 and Grandstream users are vulnerable to identity theft, eavesdropping and other exploits from hackers. The Texas-based security lab said among other threats, unwitting VoIP users face eavesdropping, spam, spoofing and denial-of-service (DoS) attacks. Vonage is the largest pure play VoIP operator in the U.S. with more than 2.5 million customers. Globe7 is London based, and claims to be the top global VoIP operator. Grandstream operates mostly in the North American market.

"Sipera VIPER Lab determined the Vonage VoIP Motorola Phone Adapter (VT 2142-VD) and Vonage service implementations leave users vulnerable to a form of VoIP identity theft, allowing hackers to take over a user's phone service with a "registration replay attack," then make and receive calls while impersonating the victim. Incomplete security practices, such as not encrypting traffic, open Vonage users to eavesdropping on private voice and video communications," Sipera said. Hackers can also send multiple SIP invite messages to a user, an Internet version of "ringing the phone off the hook" which creates a DoS attack. Leveraging these vulnerabilities, remote attackers can also send malicious messages directly to Vonage users, subjecting them to spam, social engineering and VoIP scams.  "These vulnerabilities create serious privacy and service availability issues for users," said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab.

Vonage spokesperson Charlie Sahner suggested to FierceVoIP that Sipera's report was commercially motivated: "Sipera appears to be in the business of providing a VoIP "security solution," and has previously attempted to sell their products to our company. Vonage is not a customer of Sipera's products." No response was received from Globe7 or Grandstream.

For More:
- Full details of the Sipera report [1]

Related Articles:
VoIP vulnerable to attack Report [2]
Verizon claims Vonage breached patent Report [3]