Black Hat Europe Training 2005
Grand Hotel Krasnapolsky • 29-30 March 2005

Attacktecs™ Attack Techniques used to exploit network infrastructure, servers, databases and other services with the intent of stealing or destroying intellectual property and/or to deny users and clients legitimate access.

Defentecs – Defense Techniques and implementation methods used to defend against the latest Attacktecs.

This class will cover a wide variety of the publicly available exploit tools (and some we've created) and how they can be used specifically against Cisco VoIP (Voice over IP) Telephony systems. The training will cover the attack methodologies that are used against the SIP and H.323 protocols as well as VoIP network infrastructure. Significant class time will be devoted to both attack and defense techniques. This class is designed to be very hands on and lab intensive. Therefore, a certain level of VoIP experience will be expected, specifically in using Cisco Systems related products.

Students will be using a variety of VoIP gear, Cisco equipment, and open source tools. Students will be required to bring their own laptops (with appropriate caution) to attach to the lab network. Laptops will be used to run attacks against the network and to perform configuration. The labs will require all laptops to have both a serial port and Fast Ethernet NIC. Operating systems on laptops can be either Windows or Linux. The class CD will have tools for both OSs, however some of the tools are only available for certain operating systems.

Some of the topics that will be covered:

• VoIP architectural vulnerabilities
• VoIP Threat Models
• Deployment mistakes and related vulnerabilities
• Defense requirements for VoIP networks
• Operational techniques for VoIP network defense
• H.323 attacks
• SIP attacks
• VoIP implementation attacks
• Designing VoIP security infrastructure
• Requirements guidelines for secure VoIP products
• Specific attacks against Cisco Phones and Call Manger