Análisis de Vulnerabilidades, Investigación Forense y Política de Seguridad para Sistemas de Telefonía IP Basados en Asterisk

Abstract

The use of open source IP telephony platforms offers great advantages over proprietary solutions such as reduced costs, flexibility and ease of integration. However, despite all these benefits, open source applications have suffered from different types of vulnerabilities. In this work, we analyze vulnerabilities on Asterisk based IP telephony systems, with the aim of providing technical information to help improve their secure. In addition, we present a reliable setup guide to protect these systems against known vulnerabilities. Asterisk based IP telephony systems are assessed through two prototypes: a local one and a public one. The local prototype offers a controlled environment to test some of the most known vulnerabilities, while the public prototype is arbitrarily exposed on the Internet to let us know the impact of attackers over vulnerable systems. Finally, a forensics methodology is proposed for Asterisk based IP telephony systems in order to provide usable digital evidence.