Disruptive Telephony

Speaking Next Week on IPv6 and VoIP Security at 7th Real-Time Communications Conference in Chicago

If any of you will be in Chicago next week, October 4-6, 2011, for the 7th Annual Real-Time Communications Conference & Expo, I'll be there on the 5th and 6th as a speaker.

I'll be speaking twice. First on Wednesday the 5th at 4pm on "The Current State of VoIP Security", wearing my VOIPSA hat and leading off a series of talks about security. I'll be providing an overview of the main threats to VoIP and communications security in general, leading the way into the two more specific talks following mine.

I'm rather excited that my second session will be my first public appearance wearing my new Internet Society hat (if you are not aware, I've posted details about my recent move) and will of course be about IPv6... more specifically "How IPv6 Will Impact SIP And Telecom".

Due to ongoing events on the personal front, I wasn't sure that I was going to make it out there... and quite frankly there's still a chance that I won't... but I should be out there.

If you look at the conference schedule, the speakers include outstanding people involved with so many different aspects of real-time communications. It should be truly an excellent event!

P.S. You can still register if you would like to attend!

---

If you found this post interesting or useful, please consider either:

• following me on Twitter;
• adding me to a circle on Google+;
• subscribing to my email newsletter; or
• subscribing to the RSS feed

---

Skype Issues 2nd Mac 5.1 Hotfix for "Security Issues" - But What Are Those Issues?

Today, Skype issued a new Skype 5.1 for Mac "hotfix" for more "security issues". The problem?

We don't know what those "security issues" are?

We don't know, for instance:

• Are they related to the remote exploit that was publicly disclosed on Friday? Or to related attacks on the same theme? (as discussed on SecNiche today)
  
  
• What is the severity of these "security issues"? Remote compromise? Denial of service? What?
  
  
• What is the priority that we should place on getting this update in place? Is it a "UPDATE NOW!" kind of priority? or a "Update when you can"?
  
  
• What kind of mitigating circumstances are there for these security fixes?
  
  
• Are there any workarounds that could be put in place at a network layer (or any other layer) to prevent attacks on individual systems? (i.e. as a safety measure until the individual clients are all updated?)

We need to know this kind of information.

Particularly as Skype looks to try to move more into the "business" or "enterprise" market space, this level of NON-disclosure is unacceptable.

In comparison, take a look at any of the recent Microsoft security bulletins, like, oh, this one, and you can see the kind of information that a security professional is looking for. Now, sure, Skype doesn't necessarily need to go to the level of detail that Microsoft has... but something more than just "Security issues" is necessary.

Letting Us Know?

Additionally, why again is Skype issuing a "hotfix for security issues" without telling anyone about it? Just like they did back in April?

Once again the hotfix is mentioned only on Skype's Garage blog. Nothing on Twitter on either @skype or @skypesecurity. Nothing on the Mac blog (although they finally updated that blog about the issue on Friday). Nothing on the Security blog.

And once again, the "Check for Updates..." feature in Skype 5.1 does not show a new update available:

So apparently the only way we can get this hotfix for unknown "security issues" is to go to Skype's main download site and download it!

C'mon Skype! You can do better than this!

Recommendations for Skype

So rather than just rant, let me offer these suggestions to Skype for what they should do when they have a "security hotfix":

1. Provide More Info - Saying it is simply "security issues" doesn't cut it. We need to know things like:

• what is the severity of the security issue? if an attacker could compromise the Skype client, what could he or she do?
• how easy is it for an attacker to execute an attack? can the attacker be remote? do they have to be a contact?
• are there mitigating circumstances that would make an attack less likely?
• are there workarounds that could be put in place at a larger level than just the client?
• what is the potential exposure of NOT upgrading?

Skype should look seriously at tools like the Common Vulnerability Scoring System (CVSS) used by many software/hardware providers (see also the CVSS FAQ). And while perhaps the full CVSS process may be too heavy for a smaller organization like Skype, the document at least gives insight into the type of questions security professionals want.

Similarly, the Cisco Security Vulnerability Policy and associated links is worth a read. Again, it may be too heavy a system for a smaller company like Skype... but then again perhaps in all of the new hires Skype is looking to do they could hire some folks specifically to work on this process.

2. Let People Know About The Security Hotfix - Skype has a "security" blog and specific @skypesecurity Twitter account. They should be used to communicate the availability of security hotfixes. Security professionals associated with companies using Skype could then know that they need to subscribe/follow those sites to know when there are new issues needing attention.

3. Make The Security Hotfix EASY To Obtain - Make the "Check for Updates..." process work from the beginning. The blog post or other update should be able to state that Skype users can simply go up to "Check for Update..." to download/install the new version. Perhaps this means that the blog post has to be delayed until the new version is uploaded to whatever update servers Skype has... but so what? Wait a bit - or improve the internal process so that these uploads happen faster. The end result will be that MORE people will update sooner, which, I would think, should be the goal.

Those three steps would help people feel a whole lot better about Skype's concern for security - and would also make sure that Skype users are better protected. It would also help Skype's reputation, brand, etc.

And it would stop people like me from writing blog posts like this. ;-)

Seriously, Skype... security matters... and even more, communication about security matters. We all know that with any system there are security issues... no system is perfect and attackers will always try to compromise systems. We get that. It is how you react and communicate about those security issues that is so incredibly critical.

Skype's Security Communication FAIL - Why Issue a HotFix If You Don't Tell Anyone?

What is the point in issuing a hotfix that addresses a security vulnerability... if you don't tell anyone that the hotfix is available?

Tonight Skype published a blog post saying that back on April 14th they released a "hotfix" for this problem in Skype for Mac version 5.1.0.922. That's great... it's good that the fix is out there, but...

how were we Mac users supposed to know about it?

Hmmm... let's see... Could we find out about the Skype for Mac hotfix...

• ... using the "Check for Updates" feature? Nope, doesn't work for me. Maybe it works for others out there, but not for me.
  
  
• ... from the Skype for Mac Release Notes page? Nope, that page STILL hasn't been updated, three weeks later, to indicate that a new version is out. Nothing on there at all about 5.1.0.922.
  
  
• ... from Skype's Twitter account? Nope, no mention of a hotfix back on April 15th, although they did talk about the fact that Skype was mentioned twice on 30 Rock and that there was Skype call on the Rachael Ray show.
  
  
• ... from Skype's skypesecurity Twitter account? Nope, no mention.
  
  
• ... on Skype's Mac blog? Nope. Last post there was April 14th, the day before this hotfix came out.

No mention of a "hotfix" for Skype 5.1 for Mac OS X on any of those communication vehicles.

In The Garage?

Ah, but wait... Skype did mention the hotfix, over on the Skype Garage blog, which is all about "Experiments and pre-releases". Here's a screen capture of the notice:

So they posted news of this important "hotfix" on a blog for "experiments and pre-releases", didn't tweet it out, and didn't update release notes or put it anywhere regular Mac users would find it.

And a curious thing...

THERE IS NO MENTION OF A SECURITY ISSUE!

Nothing whatsoever.

I am guessing that "Minor bug fixes" must include this security issue. And maybe the fix was simply a "minor bug fix". Maybe someone forgot to do bounds checking on some part of the chat system and as a result a buffer overflow occurred. Maybe it was some simple little fix.

But labeling it in this way gives absolutely no incentive for anyone to upgrade. Even had I seen this notice, I probably wouldn't have bothered to upgrade (unless the Check for Updates had worked). There is no urgency on this.

And... call me crazy, perhaps, but I guess I don't consider a security issue where someone could send me a chat message and gain complete control of my Mac to be a "minor bug"!

Did Skype not think that at some point the security researcher would publish his findings?

And why in the world didn't Skype communicate with this security researcher to tell him that they had fixed the bug he found and would be issuing (in fact had issued a fix)? Now maybe they thought they did... but whatever the situation was, he didn't know and out of frustration published his post today.

It Didn't Have To Be This Way

In other words...

... everything that happened today was COMPLETELY PREVENTABLE had Skype only communicated more.

Skype would not have had the negative coverage in ZDNet, CNet, ComputerWorld, Mashable, TheNextWeb, my own blog ... and many other sites, let alone all the tweeting and retweeting.

Instead of having all this negative activity, they could have jointly come out with a statement with the security researcher or at least crediting the researcher. It would have shown that Skype was serious about security and protecting us - and also serious about working with the security community.

And even after the story broke early today, Skype could have tweeted out a response... or posted the blog post earlier... they could have cut off all the discussions and concerns simply by being more transparent and providing some information - or even just communicating that they were in the process of getting an answer.

Instead, there is only one word to summarize Skype's communications:

FAIL!

The thing that kills me is that Skype employs a ton of truly brilliant engineers. They have on their payroll a couple of the leading SIP/VoIP security researchers that are out there. And these guys know how the security community works.

Knowing some of those folks personally, I have to think that the process broke down somewhere in the external communications side of the house. Because of the IPO and the "silent period", I know that people at Skype are ultra-cautious about saying anything. And maybe that's part of it, but in this case, it truly failed them.

Too bad... because none of all this communication today had to happen.

---

If you found this post interesting or useful, please consider either:

• subscribing to my email newsletter;
• following me on Twitter; or
• subscribing to the RSS feed

---

UPDATED: Skype for Mac Has Dangerous Security Vulnerability... and There's No Public Word From Skype

UPDATE: Skype has now published a blog post indicating that a Skype 5.1 update is available for download. As I noted separately, the auto-update process is NOT working for me. It appears that I will need to download the new version directly from Skype's website.

Separately, Skype PR indicated to me that version 2.8 is not vulnerable - although I note that this information is not in Skype's security blog post. (Skype has now confirmed in a tweet that Skype 2.x is not vulnerable.)

It's great that Skype claims they fixed this in mid-April... but if they didn't tell anyone - including, apparently, the security researcher who reported the issue - what value is it that they fixed the issue?

I have a longer piece that I need to write on this... but I'll leave that for another post.

Meanwhile, we finally do have some information and a fix - many hours after it would have been helpful to have had it.

The original post remains below...

---

From the Can-We-Please-Communicate-Better Department... there is apparently an open vulnerability in the Skype for Mac client that lets an attacker send a message to a Skype user and gain remote access. As reported today by Gordon Maddern on the PureHacking blog:

The long and the short of it is that an attacker needs only to send a victim a message and they can gain remote control of the victims Mac. It is extremely wormable and dangerous.

Given that I basically live inside of Skype for Mac and use it extensively every day, this is obviously extremely concerning. Particularly because I do let anyone on Skype send me messages... and my Skype ID is easily found on my websites and many other locations (and since is rather obvious - "danyork"). I also tend to leave Skype running on a Mac in my home office that is online all the time. Mostly this provides a way to quickly catch up on chats as I have all the messages already there on that system (rather than waiting for Skype to sync up after it is launched).

Maddern indicates that he contacted Skype over a month ago about this and no fix has come out yet. In his post, he says:

Pure Hacking wont give specifics on how to perform this attack untill a patch from skype is released. However we will give a full disclosure after skype takes action or a resonable responsible disclosure time.

Which is great... except that now attackers will be out there trying to figure out what kind of "payload" he sent that created this condition. There is always the chance that someone may discover the attack.

Where is Skype's Statement?

ZDNet UK covered the story today and received this update from Skype:

Skype has just sent ZDNet UK a statement promising a fix next week. The statement reads: "We are aware of this and will release a fix early next week to resolve the issue. We take our users privacy very seriously and are working quickly to protect Skype users from this vulnerability."

What is concerning, though, is that there is no other public comment on this from Skype...

• ... nothing on Skype's blogs, particularly their Security blog
• ... nothing on Skype's Twitter account
• ... nothing on Skype's SECURITY Twitter account

It's Friday afternoon here in the US... people are about to leave their offices and some % of those who use Macs may in fact leave their computers on and leave Skype running. Are those machines vulnerable? Can someone really just send someone a message and gain control of their Mac?

Which version of Skype for Mac is vulnerable? Is this only in the newer 5.x client? Or does this impact the older 2.8 client?

We need answers, Skype! I can understand that a fix may take some time, but in the meantime we need to understand what the risk is. Are there mitigating circumstances? Or actions we can take in the meantime?

How To (Maybe) Protect Yourself

So what are we to do until there is either a fix or a helpful statement?

1. QUIT OUT OF SKYPE - Obviously this is one option (and one I might pursue on that computer in my office). But that may not be practical for folks... and isn't for me in my work context.

2. CHANGE PRIVACY SETTINGS - It seems to be the biggest change we can make is to only allow chat messages from people in our contact list. This would mean that a random attacker out on the Internet couldn't just send you a message and take over your Mac. You will only get chat messages from your contacts, not random people.

In Skype 5.x for the Mac, you go to the Skype menu and then Preferences and then make sure that the settings are that only Contacts can contact you:

On the Skype 2.8 for Mac client, the layout is a bit different but the choices are similar:

Now, in these images I'm only suggesting you restrict chat messages. In the blog post about the attack, it is very clear that the attack vector is a chat message, so in theory you should only need to change the one privacy option for chat messages. Whether or not you also want to restrict calls to be from your contacts is up to you. Absent a clear statement about the vulnerability from Skype, we have very limited information to go on... but again the blog post was very clear that the attack was through a chat message with a particular payload.

Will that protect your system? I don't know... I'm guessing along with you all.

Now, depending upon how paranoid your mind operates, there is, of course, the case that an attacker could take over a Mac operated by one of your contacts, and then potentially use the Skype client on that machine to then contact you. Maybe that's possible, maybe that's not.

3. RUN AN OLDER SKYPE VERSION - Does this only affect the newer Skype 5.x for MacOS X? Could we be protected by reverting to the older 2.8 client? (which I'm still running on one of my systems)

I don't know... and I wouldn't use this as my only protection mechanism.

Give us a clue, Skype!

We don't know... and that's not a good space to be in.

What can you tell us who are Mac users, Skype?

---

UPDATE #1 - The Register also covered the story and pointed out that perhaps the attacking chat message could cause other chat messages to be sent out. Again... possible... but we just don't know.

Also, someone pointed out that Skype did have a "public statement", so my title is not accurate. Sure... they gave a statement to ZDNet UK and perhaps other media outlets... but where is that on Skype's public presence? Why not on one of their blogs or on Twitter?

---

If you found this post interesting or useful, please consider either:

• subscribing to my email newsletter;
• following me on Twitter; or
• subscribing to the RSS feed

---

I'll be in Miami next week speaking at ITEXPO, Cloud Communications Summit, etc.

If any of you will be in South Beach, Miami, next week I'll be there speaking as part of the Cloud Communications Summit and SIP Trunking Workshops. I've got a page up on Voxeo's site that shows my schedule at:

http://blogs.voxeo.com/events/itexpo-east-2011/

I know a good number of other folks from the VoIP/UC/Cloud Telecom/Voice Mashups/SIP/etc. world are all going to be down there, so I'm looking forward to catching up with some folks there.

If you are down in Miami for ITEXPO, the Cloud Communications Summit, Digium/Asterisk World or any of the other events, please do stop by and say hello... or find me down at one of the sessions I'm in (my schedule is online). You can always email me or ping me on Twitter.

---

If you found this post interesting or useful, please consider either:

• subscribing to my email newsletter;
• following me on Twitter; or
• subscribing to the RSS feed

---

Speaking at Voice Biometrics Conf next Tues, Weds, May 4-5, in NY

If any of you will be at the Voice Biometrics Conference next week (May 4-5) in the New York area (Jersey City, actually), I'll be there speaking on Wednesday about 'Seeding the Cloud - Authentication as a Service'. I'm arriving Monday evening and will be there through early Thursday morning.

"Voice Bio Con", as it is called, is a rather comprehensive gathering of the major players in the voice biometrics / voice authentication / voice verification space. Great agenda with some excellent speakers (and yeah, I'm on that list, too). I wrote over on the VOIPSA blog about the number of case studies and real world deployments that will be discussed.

It should be a great event... I'm on that panel and will also be talking about Voxeo's voice biometric partner program where you can try out voice biometric solutions for free using our hosted platform and the hosted services from four of the major voice biometric vendors. I'm looking forward to meeting up with some friends there and undoubtedly having some great conversations and learning a good bit.

If you are at the event, please do say hello! If you want to go and haven't registered yet, there's a discount code you can use to save $200.

See (some of) you in the Big Apple...

P.S. And yes, you can safely assume that I'll be tweeting (probably both @danyork and @voxeo) and blogging from the event...

---

If you found this post interesting or useful, please consider either subscribing to the RSS feed, following me on Twitter or subscribing to my email newsletter.

---

Brief interview in 101st Telecom Junkies podcast episode to update VoIP Fraud/Hacker case

Earlier this week I had a fun moment joining a cast of characters to help the Telecom Junkies podcast celebrate crossing over 100 episodes. In the 101st episode, now available for listening, host Jessica Gdowski invited 7 of her previous guests back to give brief updates. So I joined Martha Buyer, Mark Fletcher, Hank Levine, John Lyon, Dave Spofford, and Allan Sulkin for the ~20 minute show.

In my case, I've been a guest on the show three times previously, most notably in August 2007 with "Interview with a VoIP Hacker" where we interviewed Robert Moore shortly before he was heading to prison.

Moore was part of the VoIP fraud case masterminded by Edwin Pena and discussed on another Telecom Junkies episode back in July 2006. I was also on another Junkies episode in November 2007 about VLAN Hopping.

In this 101st episode recorded this week I gave a brief update on the Pena/Moore case (Pena recently pled guilty) and then talked about VoIP and Unified Communication security issues. It was literally just a few minutes, but I was glad to join briefly and help Telecom Junkies celebrate. 100 podcast episodes is indeed a milestone to celebrate! Congrats!

---

If you found this post interesting or useful, please consider either subscribing to the RSS feed or following me on Twitter or identi.ca.

---

I'll be out at ITEXPO this week in L.A.

If any of you are heading out to ITEXPO tomorrow through Thursday in Los Angeles, I'll be there on Wednesday. As I note on a Voxeo events page, I'll be speaking twice, pretty much back to back:

9:30 – 10:15am, Exploring Applications in the Cloud

11:00 – 11:45am, SIP Trunking and Security

The first is a panel discussion that should be quite interesting. The second is another version of the VOIP / SIP Security talk that I've been giving at Ingate's SIP Trunking Seminars for the past few years (and that always seems to be popular). More details and session abstracts on the events page I set up.

I'm looking forward to catching up with many friends at the show, including Andy Abramson, who I haven't seen for a while.

If you will be out there, please do say hello.

---

If you found this post interesting or useful, please consider either subscribing to the RSS feed or following me on Twitter or identi.ca.

---

Heading down to ITEXPO in Miami on Feb 2-4...

Will you be down in Miami at ITEXPO February 2-4? If so, please feel free to drop me a note and perhaps we can connect somewhere there.

I'll be arriving Monday afternoon and then on Tuesday, February 3rd, I'll be donning my VOIPSA VoIP Security hat to participate in a SIP Trunking Workshop sponsored by Ingate Systems on "SIP Trunking And Security". These workshops are always fun to do and as they are free to anyone attending ITEXPO (even just with an exhibit pass), they are usually well-attended. I'll be bringing my recording gear, too, and the talk will eventually go out in my Blue Box Podcast feed so you will be able to hear it later.

Speaking of recording... I'll have my video gear, too, and so if you have some new product or service in the "emerging communications" space that you think I might be interested in recording for my "Emerging Tech Talk" video podcast... well... pitch me. :-) I know I'll be recording a number of videos down there and I would certainly consider doing some more.

Wednesday evening I'll be driving back to Orlando and in Voxeo's office on Thursday and Friday so if you're in the Orlando area, please feel free to let me know as well.

---

If you found this post interesting or useful, please consider either subscribing to the RSS feed or following me on Twitter or identi.ca.

---

Technorati Tags: danyork, itexpo, miami, orlando, voxeo

"Discover Best Practices for Secure Unified Communications" - a webinar I'll be giving tomorrow

Cross-posted from Voice of VoIPSA:

---

What are you doing tomorrow, Tuesday, October 28, 2008, at 1pm US Eastern time? If you are around, you are welcome to join a free webinar I'll be giving on "Best Practices for Secure Unified Communications".

From time-to-time, you'll notice that those of us working with VOIPSA will take part in seminars/webinars offered by members of VOIPSA and we definitely enjoy doing so. For instance, as readers of the blog know, I've been speaking at Ingate's SIP Trunking seminars for quite some time now. We're generally open to speaking at anyone's event or webinar - as long as they understand that there is no endorsement of the company/vendors's products/services and that we are there to provide an industry-neutral point-of-view.

So tomorrow at 1pm US Eastern I'll be speaking as part of Mitel's "Discovery Series" where they invite in guest speakers from the industry. You can join the webinar for free at Mitel's site. They asked me to speak about the threats/risks to voice over IP and unified communications and talk about best practices for protecting them. Here's the abstract:

Discover Best Practices for Secure Unified Communications

Presented by: Dan York, Voice Over IP Security Alliance (VOIPSA) October 28, 2008, 1:00 PM EDT / 10:00 AM PDT / 5:00PM GMT

With the emergence of Voice-over-IP and Unified Communications, companies now have incredible opportunities to provide a rich communication experience to employees located in a single location or distributed globally. But how does a company do this in a secure manner? How is the confidentiality and integrity of corporate conversations protected? How can a company be sure that its IP phone systems and IP trunks will always be available for usage? What are the issues around protecting SIP trunks or using hosted services?

In this webinar, VoIP Security Alliance Best Practices Chair Dan York will discuss the threats and risks to Voice-over-IP, the tools that are out to test (or attack) VoIP system and solutions and best practices for protecting your systems. He'll also address concerns around SIP trunking, Spam for Internet Telephony (SPIT) and the move to push voice out into hosted/cloud computing environments and the associated concerns. Come prepared to learn about securing your VoIP system, to ask questions about your deployments and to leave with tips and resources to protect and defend your systems.

The webinar will be recorded and posted for later viewing as well. I'll note that they also have a nice companion webinar to the one I'll be giving tomorrow in one that HP representatives recently have on network security as it relates to VoIP.

Anyway, if you are available tomorrow (Oct 28th) at 1pm please do feel free to join into the webinar. I'll post a note on this site, too, when it is available for later listening.

P.S. And yes, as a couple of people have asked, I do obviously have a closer association with this webinar than I do with some of the other vendors given that I worked at Mitel for 6 years and was their point person on VoIP security issues for much of that time. It will be fun to be speaking with them again.

Technorati Tags: voip, voip security, security, voice, voice security, mitel, voipsa, danyork, dan york, unified communications