Sipera VIPER Lab Identifies SIP Vulnerabilities That Threaten VoIP Networks and Users

Threat Advisories Published for Specific WiFi/Dual-Mode Phone Handsets

Richardson, TX, March 27, 2007 – Sipera VIPER Lab, operated by Sipera Systems, the leader in pure security for VoIP, mobile and multimedia communications, today disclosed nine threat advisories for WiFi/dual mode telephones from vendors including RIM, HTC, Samsung, Dell and D-Link. These threat advisories are in addition to the new SIP vulnerabilities published by Sipera VIPER Lab.

Sipera proactively identifies VoIP threats through its Sipera VIPER Lab, which is comprised of experienced VoIP application developers, architects, and engineers, operating 24/7/365 from Richardson, Texas, and Hyderabad, India. Every day, the dedicated VIPER Lab researchers identify new vulnerabilities and potential exploits in VoIP protocols, VoIP equipment and phones. They also scan web sites, blogs, discussion groups, and media outlets for evidence of known, suspected and new VoIP vulnerabilities and attacks.

These vulnerabilities are posted at http://www.sipera.com/viper as a service to Sipera’s customers and the general public. Sipera VIPER Lab follows a disclosure policy which notifies equipment vendors, in advance, of the potential vulnerabilities and works with each of these vendors to publish a response/fix or identify other solutions to these security issues.

“VoIP security is just beginning to get more attention now that VoIP adoption has reached a tipping point in the last year. It is refreshing to see Sipera’s launch of VIPER Lab that will assuredly help promote and advance the state of VoIP security research and help raise the overall awareness of VoIP threats and corresponding best practices,” said David Endler, chairman of the Voice over IP Security Alliance (VOIPSA), an industry consortium created to drive adoption of VoIP by promoting the current state of VoIP security research, VoIP security education and awareness, and free VoIP testing methodologies and tools.

Dual-mode phones are used to automatically switch between WiFi and cellular networks, thus providing lower costs, improved connectivity and a rich set of converged services utilizing protocols including SIP. However, these protocols also expose enterprise and service provider networks to new VoIP security issues. Left unchecked, these can be exploited by hackers, malicious users and spammers.

The major threat advisories issued today that affect WiFi/dual-mode phones include:

• A format string vulnerability in RIM Blackberry 7270 SIP stack may allow a remote attacker to disable the phone’s calling features (VIPER-2007-023).

• HTC HyTN using AGEPhone is vulnerable to malformed SIP messages sent over WLAN connections, which may cause active calls to disconnect (VIPER-2007-0026).

• A buffer overflow vulnerability in Samsung SCH-i730 phones running SJPhone SIP Client may allow an attacker to disable the phone and slow down the operating system (VIPER-2007-0029).

• Dell Axim running SJPhone SIP soft phone is vulnerable to denial of service attacks, which can freeze the phone and drain the battery (VIPER-2007-0030).

• A vulnerability in the SDP parsing module of D-Link DPH-540/DPH-541 WiFi phones may allow remote attackers to disable the phone’s calling features (VIPER-2007-031).

For additional details on these vulnerabilities or to see the complete list, visit http://www.sipera.com/viper.

Since its inception in 2005, Sipera VIPER Lab has identified thousands of potential security threats and vulnerabilities. The most common network threats include fuzzing, reconnaissance, floods and distributed floods, while end users are most often targeted for misuse/spoofing, stealth attacks and spam. VIPER Lab research is used to continuously improve the Sipera IPCS product line that protects enterprises, service providers, and end users from Internet-based threats. These Sipera IPCS devices combine virtual private network (VPN), firewall/session border controller (SBC), intrusion prevention, anti-spam, compliance and troubleshooting functionality for VoIP, IM and other IP communications applications, in a single device.

“Voice over WiFi using dual-mode phones is a compelling new service for both consumers and enterprises but the threat advisories just published show that these devices and networks are open to a variety of attacks,” said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. “These threats are a sample of the many vulnerabilities diagnosed and catalogued by Sipera VIPER Lab as part of its ongoing research efforts. Sipera uses this information to proactively build protection techniques that are the foundation of the Sipera IPCS product line, which can be deployed by enterprises and service providers for zero-day protection against these emerging threats.”

For more information on Sipera VIPER Lab and to see a listing of all the vulnerabilities and threat advisories published today along with the details, visit http://www.sipera.com/viper.

About Sipera Systems
Sipera Systems provides enterprises and service providers with comprehensive VoIP security solutions that protect, control and manage real-time unified communications. The Sipera IPCS™ products combine VPN, Firewall/SBC, Intrusion Prevention, Anti-Spam, Compliance and Troubleshooting functionality for VoIP systems in a single device. This securely enables IP PBXs, VoIP remote users, SIP trunks, data/voice VLANs, hosted VoIP services and IMS or UMA-based networks. Comprised of top vulnerability research experts, the Sipera VIPER™ Lab concentrates its efforts towards identifying VoIP vulnerabilities, while Sipera LAVA™ tools verify networks’ readiness to resist attacks. Founded in 2003, Sipera is headquartered in Richardson, TX. Visit http://www.sipera.com.

Sipera, Sipera logo, Sipera IPCS, Sipera IPCS 210, Sipera IPCS 310, Sipera IPCS 410, Sipera IPCS 510, Sipera IPCS 520, Sipera LAVA and Sipera VIPER are trademarks of Sipera Systems, Inc. All other companies and products listed herein are trademarks or registered trademarks of their respective holders.

Media Contacts:

Larry Bouchie, KMC Partners Public Relations, 617-758-4192, larry@kmcpartners.com

Brendan Ziolo, Sipera Systems, 214-606-1080, bziolo@sipera.com