HSL SECURITY SOLUTION FORVoIP PHONES PROTECTION

V o I P P h o n e s P r o t e c t i o n

1

....Reasons to attack VoIP phones

• VoIP phones are everywhere - even in the most classified offices and meeting rooms.

V o I P P h o n e s P r o t e c t i o n

2

....Reasons to attack VoIP phones

• VoIP phones are NOT perceived as a security threat although being exposed to the outside world through networks that have internet access.

V o I P P h o n e s P r o t e c t i o n

3

....Reasons to attack VoIP phones

• VoIP phones are vulnerable to computer attacks as they run all-purpose computer hardware and have limited (if any) hardware and software protection.

Network Card

Flash Storage

RAM

CPU

V o I P P h o n e s P r o t e c t i o n

4

The Threat:Eavesdropping• A remote attacker can activate

the phone’s microphones from remote to eavesdrop conversations taking place at the vicinity of the phone.

• Users and administrators are often unaware of eavesdropping threats as there is no evidence of the phone being tampered.

VoIP Phone

V o I P P h o n e s P r o t e c t i o n

5

The Threat:Breaching Air Gapped Networks• Isolating (air-gapping) critical computer networks from the internet

is used to protect IT assets and increase data security.

• Researches show that breaching air-gapped networks can be achieved by compromising a computer to transcode and transmit confidential data over-the-air as audio.

• A compromised VoIP phone can intercept/generate audio signals to communicate with an air-gapped- computer and thus breach the network.

Internet Connected Network

TOP SECRET NETW

OR

KCO

N

FI D E N T I A

L

Top Secret

V o I P P h o n e s P r o t e c t i o n

6

HSL Security Solution for

VoIP Phones Protection

V o I P P h o n e s P r o t e c t i o n

7

HSL Secure VoIP Implant

• The HSL Secure VoIP Implant is securely embedded inside a standard VoIP telephone.

• It is designed to mitigate eavesdropping and prevent a remote attacker from exploiting the phone to listen to surrounding classified conversations.

• The implant allows normal phone operation without any negative effect on performance or user experience.

• Audio and visual notifications provide clear and simple user indications of the phone’s secure state.

Inbound

Outbound

V o I P P h o n e s P r o t e c t i o n

8

TOP SECRET NETW

OR

KCO

N

FI D E N T I A

L

Top Secret

Protect against

Air-gap breaching

HSL Secure VoIP Implant

V o I P P h o n e s P r o t e c t i o n

9

Protect against

Eavesdropping

HSL Secure VoIP Implant

V o I P P h o n e s P r o t e c t i o n

10

Security Risks Mitigated by the HSL VoIP ImplantRisk Mitigated by HSL VoIP Implant

Phone microphones will be used to pick up surrounding audio while not in active call.

Implant shorts all phone microphones to the ground while not in active call.

Phone speakers will be used to pick up surrounding audio while not in active call.

Implant shorts all phone speakers to the ground while not in active call.

Phone firmware will be tampered to eavesdrop conversations taking place at the vicinity of the phone.

Implant shorts all phone microphones and speakers unless the handset is off-hook.

Audio will be used as a transport layer to send/receive data between the phone and nearby air-gapped computers.

Implant shorts all phone microphones and speakers at all times except when the user is actively participating in a call.

User fails/forgets to put the handset on-hook after a call is terminated.

Implant generating audio warnings (beeps) after few seconds to warn the user;Audio is disconnected by implant when there is no active call.

Phone security will be tampered by anyone having physical access to it (supply-chain/untrusted people).

Special holographic tampering evident labels on the product’s enclosure provide a clear visual indication if the product has been opened or compromised.

V o I P P h o n e s P r o t e c t i o n

11

Frequently asked questions

• How does the VoIP Implant secures the phone from eavesdropping?By default, all audio channels are blocked by the VoIP Implant. An attacker cannot activate the phone’s microphones and speakers since user interaction is required in order to enable the phone’s audio devices.

• In what circumstances the VoIP Implant blocks incoming and outgoing audio?All audio channels are blocked unless a valid call takes place or an incoming call is detected.

• What are the conditions that qualify a call as a valid call?The VoIP implant requires the phone’s handset to be off-hook and a VoIP call to take place in order to qualify a call as valid.

• What happens if a call is started / received while the handset is on-hook?The VoIP Implant blocks all audio channels until the handset is taken off-hook.

V o I P P h o n e s P r o t e c t i o n

12

Frequently asked questions (Con.)

• Can the phone’s speaker/headset be used during a call?Yes, the phone’s speaker/headset can be used during a call – as long as the handset is taken off-hook as well.

• What happens when calling out or receiving an incoming call by pressing the speaker/headset button?A VoIP call will start but no audio will be sent/received by the phone until the handset is taken off-hook.

• What happens if the user forgets to place the handset on-hook at the end of a call?The VoIP Implant generating audio warnings (beeps) after a few seconds to warn the user; Audio is disconnected by the Implant when there is no active call.

• Does the VoIP Implant effect user experience?The VoIP Implant allows normal phone operation without any negative effect on performance or user experience. The only user requirement is to take the handset of the hook while making a call.

THANK YOU!

For more information, please visit www.highseclabs.com