Exploiting VoIP softphone vulnerabilities to disable host computers: Attacks and mitigation

As increasing numbers of people run VoIP softphones on their laptops and smartphones, vulnerabilities in VoIP protocols and systems introduce new threats to the computer systems that run VoIP softphones. This paper investigates key threats that target VoIP hosts and techniques for mitigating the threats. In particular, this paper shows that crafted SIP traffic can disable a Windows XP host that runs a Vonage VoIP softphone or a Linphone by consuming almost all the free memory within minutes. While this “noisy attack” can be effectively mitigated by threshold-based filtering, the paper demonstrates that a “stealthy attack” can be launched to defeat threshold-based filtering and disable the host computer without ever ringing the softphone. To mitigate the stealthy attack, the paper describes a limited context aware filtering approach that leverages the context and SIP protocol information to ascertain the intentions of a SIP message on behalf of the client. Experiments demonstrate that limited context aware filtering can effectively defeat a stealthy attack while allowing legitimate VoIP traffic and calls to go through.