Sipera Systems, a company that provides VoIP security solutions, has released a series of 4 security advisories related to the security of the beleaguered Vonage. Three of the four vulnerabilities are related to a particular model of analog terminal adapter they shipped to some customers. The fourth vulnerability, however, is completely and utterly their fault.



The errors related to the device could likely be mitigated by either updating the firmware or change some of their settings in the device. I am not familiar with the settings available in the Motorola devices, but I know that in the Linksys devices, it's quite possible to mitigate many of these issues by configuration.

The replay attack with Vonage's SIP proxy, well that's just dumb. It's what I call "kindergarten mistakes." It's the kind of thing I expect the small mom-and-pop shop to make, but not the industry leader. Clearly the industry leader has no clue how their technology works, else they wouldn't be running afoul of patents or best practices.

Via