tuesday and wednesday i attended a training titled "Practical VOIP/SIP Hacking" at the premiere of the future annual security conference deepsec in vienna. official site. the organisation was pretty professional, as to be expected for the business oriented pricing. the hotels network occassionally was a bit laggy, but that's probably not too surprising considering the demands of a bunch of workshops full of hackers doing network security stuff.

i really enjoyed it a lot. klaus really knows his sip and he addressed quite a range of typical configuration problems, possible exploits and how to fix them.

small hint for starters: never put openser on the internet in its default config, unless you want people to make free calls - you may be the one to pay the bill. other software of course mostly isn't much better, but default openser is literally configured as an open relay. cisco gateways are not much better, but since they are so expensive, will only ever be operated by real experts - haha

an excellent resource if you are interested in this field is also klaus's voip link collection.

i was definetely able to profit a lot for the system i am designing at work. stay tuned for some config samples as it becomes more and more production proofed.

2007-06-02

since i am implementing a voice over ip project at work, i naturally am also investigating options at home. for now i am running an asterisk server on my webserver and use it to call out to PSTN (mostly my girlfriend to her brother who is doing his civil service in sierra leone). fellow debian hacker klaus ita recommended a call by call provider: voipcheap

they seem to live up to their name and offer really nice rates. also austrian land lines are free as in free beer. you have to download a windows client to complete the registration which really sucks, but after delaying for more than two weeks i finally got around to do it today. 5 minutes later i am successfully placing my first free call to an austrian landline after adding something like the following to my asterisks sip.conf:

[voipcheap]
realm=sip.voipcheap.com
host=sip.voipcheap.com
username=<myname>
secret= <mypassword>
type=peer
qualify=no

(instructions found on here)