System and method for detecting security exposures of VOIP devices

Patent metadata

Field	Value
Publication number	US-9736176-B2
Application number	US-201514789844-A
Country	US
Kind code	B2
Filing date	Jul 1, 2015
Priority date	Mar 31, 2014
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for detecting security exposures of Voice over Internet Protocol (VOIP) devices. One of the methods includes obtaining data identifying a source Internet Protocol (IP) address associated with a communication device that has been provisioned with configuration files for VOIP services; determining that a VOIP phone configuration interface is exposed over an untrusted network at the source IP address; and determining that the communication device associated with the source IP address has a security exposure based at least in part on determining that the VOIP phone configuration interface is exposed over the untrusted network at the source IP address.

First claim

What is claimed is:

1. A method for determining if a communication device that has been provisioned with configuration files for Voice Over IP (VOIP) services has a security exposure, the method comprising:
obtaining data identifying a source Internet Protocol (IP) address associated with the communication device;
submitting a request to the source IP address over an untrusted network;
determining that a user interface is provided in response to the request submitted to the source IP address over the untrusted network;
determining that a VOIP phone configuration interface is exposed over the untrusted network at the source IP address based at least in part on determining that the user interface is provided in response to the request submitted to the source IP address over the untrusted network; and
determining that the communication device associated with the source IP address has a security exposure based at least in part on determining that the VOIP phone configuration interface is exposed over the untrusted network at the source IP address.

2. The method of claim 1 , wherein the untrusted network is the Internet.

3. The method of claim 1 , further comprising:
in response to determining that the communication device associated with the source IP address has a security exposure, triggering an update to configuration data for the communication device.

4. The method of claim 3 , further comprising:
determining that the user interface provided in response to the request is not password protected, wherein the update to the configuration data for the communication device adds password protection for the interface.

5. The method of claim 3 , further comprising:
determining that the user interface provided in response to the request is password protected with a default password, wherein the update to the configuration data for the communication device changes the default password to a temporary password that is stronger than the default password.

6. The method of claim 1 , wherein determining that a VOIP phone configuration interface is exposed over an untrusted network at the source IP address further comprises:
determining that the user interface is a VOIP phone configuration interface used to configure operation of the communication device associated with the source IP address.

7. The method of claim 6 , wherein determining that the user interface is a VOIP phone configuration interface comprises:
identifying one or more heuristics associated with VOIP phone configuration interfaces;
comparing the user interface to the one or more heuristics; and
determining that the user interface satisfies the one or more heuristics.

8. The method of claim 7 , wherein the one or more heuristics include a presence of more than a threshold number of keywords indicative of a VOIP phone configuration interface.

9. The method of claim 8 , wherein the keywords are specific to a type of the communication device.

10. A system comprising one or more computers and one or more storage devices storing instructions that when executed by the one or more computers cause the one or more computers to perform operations for determining if a communication device that has been provisioned with configuration files for Voice Over IP (VOIP) services has a security exposure, the operations comprising:
obtaining data identifying a source Internet Protocol (IP) address associated with the communication device;
submitting a request to the source IP address over an untrusted network;
determining that a user interface is provided in response to the request submitted to the source IP address over the untrusted network;
determining that a VOIP phone configuration interface is exposed over the untrusted network at the source IP address based at least in part on determining that the user interface is provided in response to the request submitted to the source IP address over the untrusted network; and
determining that the communication device associated with the source IP address has a security exposure based at least in part on determining that the VOIP phone configuration interface is exposed over the untrusted network at the source IP address.

11. The system of claim 10 , wherein the untrusted network is the Internet.

12. The system of claim 10 , the operations further comprising:
in response to determining that the communication device associated with the source IP address has a security exposure, triggering an update to configuration data for the communication device.

13. The system of claim 12 , the operations further comprising:
determining that the user interface provided in response to the request is not password protected, wherein the update to the configuration data for the communication device adds password protection for the interface.

14. The system of claim 12 , the operations further comprising:
determining that the user interface provided in response to the request is password protected with a default password, wherein the update to the configuration data for the communication device changes the default password to a temporary password that is stronger than the default password.

15. The system of claim 10 , wherein determining that a VOIP phone configuration interface is exposed over an untrusted network at the source IP address further comprises:
determining that the user interface is a VOIP phone configuration interface used to configure operation of the communication device associated with the source IP address.

16. The system of claim 15 , wherein determining that the user interface is a VOIP phone configuration interface comprises:
identifying one or more heuristics associated with VOIP phone configuration interfaces;
comparing the user interface to the one or more heuristics; and
determining that the user interface satisfies the one or more heuristics.

17. The system of claim 16 , wherein the one or more heuristics include a presence of more than a threshold number of keywords indicative of a VOIP phone configuration interface.

18. The system of claim 17 , wherein the keywords are specific to a type of the communication device.

19. A computer program product encoded on one or more non-transitory computer storage media, the computer program comprising instructions that when executed by one or more computers cause the one or more computers to perform operations for determining if a communication device that has been provisioned with configuration files for Voice Over IP (VOIP) services has a security exposure, the operations comprising:
obtaining data identifying a source Internet Protocol (IP) address associated with the communication device;
submitting a request to the source IP address over an untrusted network;
determining that a user interface is provided in response to the request submitted to the source IP address over the untrusted network;
determining that a VOIP phone configuration interface is exposed over the untrusted network at the source IP address based at least in part on determining that the user interface is provided in response to the request submitted to the source IP address over the untrusted network; and
determining that the communication device associated with the source IP address has a security exposure based at least in part on determining that the VOIP phone configuration interface is exposed over the untrusted network at the source IP address.

20. The computer program product of claim 19 , wherein determining that a VOIP phone configuration interface is exposed over an untrus

Assignees

• Ringcentral Inc

Inventors

• Machado Michael
• Savory James
• Bogdanov Andrey

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L65/1069

  Session establishment or de-establishment · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L65/1059

  End-user terminal functionalities specially adapted for real-time communication · CPC title