Pretty good article on VoIP vulnerabilities

I just want to add some (maybe) answers and notes:

1. Insufficient verification of data
- Can be handled with different Secure VoIP solution:
- SRTP, SSIP, TLS, IPSEC, ...

2. Execution flaws
- This is not just the VoIP topic, this is general
- I think developers do care about SQL queries and stuff.

3. String/array/pointer manipulation flaws
- This it again not just the VoIP topic. The same applies when you are using for example an Internet Banking application.

4. Low resources
- Not anymore, plus the VoIP processing is pretty lightweight (if you don't use compression, encryption, ..., but anyway the signaling is lightweight)

5. Low bandwidth
- Looks like you are talking about BW at the provider's side. Answer: Load balancing

6. File/resource manipulation flaws
- I don't think so.

7. Password management
- The same applies to your bank account - anyone who has access to the servers in your bank may have access to your account.
- Some implementations of VoIP are using PKI instead of username/password.

8. Permissions and privileges
- True.

9. Crypto and randomness
- This is an issue if you are providing a service for different endpoints from different vendors. The problem is that some VoIP clients may support encryption, some don't, some in one way, other in other way :-/
- But this is more a problem of standardization.
- In one vendor solution it is not an issue.

10. Authentication and certificate errors
- Yeah the theory is right, but usually VoIP applications are now protected against this issue.

11. Error handling
- Again the Internet banking ... brute force may work with almost anything. The question is if you have enough power and time :)

12. Homogeneous network
- Having a homogeneous network is usually preferred - you are managing only one kind of devices, one vendor, ...
- It's true that if there is a 0-day exploit - yeah, your entire network may be down in some minutes. But usually if you are following some security best practices - it's not a problem.

13. Lacking fallback system
- SIP SRV for example
- Cisco UCM Cluster
- ...

14. Physical connection quality and packet collision
- Yeah, this is a real problem :-(
- In some ways can be handled by using QoS techniques

At the end, I think VoIP is ready to be deployed. We should not be afraid of using new technologies. Every new technology may bring new challenges, but it's up to us if we will overcome those challenges, or we will invent something new, hopefully better ;-)

And one joke (but real) at the end (I just wrote this into my personal blog maybe 3 or 4 days ago but it is about this topic):
What's the difference between calling using a PSTN or cell phone and VoIP?

Well, if you use a PSTN or cell phone, then usually you start your conversation by saying "Hi, how are you? ..."

If you are using a VoIP, you ususally start your conversation by saying "Can you hear me? No, still no? Hallloooo, do you hear me? Oh, finally, So Hi, how are you? ..."

Click to read the article this is in response to.