When I came across a blog on Huffington Post that called Asterisk out on the security of their open source VoIP platform I just had to know, is this true?

So I asked Asterisk (after I said “asked Asterisk” five times fast) and got this detailed response from David Duffet, Director of Worldwide Asterisk Community.

Duffett (@dduffett) explains that protecting your network is a not whole lot unlike fortifying your house against break-ins.

VoIP Supply: Who is the Asterisk VoIP platform designed for?

David Duffet: The Asterisk IP communications engine is for anyone that wants to create a flexible and powerful communications solution. Asterisk configuration is performed through a number of ascii text files, and this is why a number of pre-packaged IP PBX solutions based on Asterisk have become available that allow configuration via a web GUI.

VS: Why open source?

DD: When Mark Spencer (the creator of Asterisk and CTO of Digium) decided to make Asterisk an open source project, he did this in part to liberate the stodgy, closed world of telecoms, but also to allow (and encourage) contributions to Asterisk from people all over the world that are particularly keen to see Asterisk enhanced in specific directions (like conferencing and contact centre applications).

VS: In this blog post on Huffington Post, 6 Keys to a Successful VoIP Implementation, the writer, Jason Volmut (@javolmut), CEO of CPUrx, states that:

“VoIP systems built on the open-source telephone platform Asterisk are routinely subject to hacking attempts, and should be avoided. “

What VoIP security measures can Asterisk take to secure their systems from hackers?

DD: Although there are a number of places within Asterisk that could be configured to enhance security, I would like to make some more general points:

The mention of only Asterisk in point 5, regarding security, is extremely misleading.
To set the scene, PBXs, even before the advent of IP communications, have always been subject to attacks of one sort or another – all the way from people trying to hack into voicemail boxes to full scale toll fraud through PRIs or even analog lines.

*ANY* SIP IP PBX that has an open connection to the internet (i.e., not within a VPN, or not tied down to a specific IP address, or addresses) will be subject to hacking attempts.

” Just like any type of system – it’s all in the implementation. If that is done in a sloppy way, it could lead to trouble.”
– David Duffett, Asterisk

Asterisk is certainly the most popular and established open source communications engine in the world, with millions of Asterisk-based IP PBXs out there – but they are by no means particularly prone to issues of this nature. Just like any type of system – it’s all in the implementation. If that is done in a sloppy way, it could lead to trouble.

There is lots of information around on the internet about certain brands of proprietary IP PBXs and potential vulnerabilities, but to focus on the PBX is to miss the main point about securing IP systems – and that is to ensure proper measures are taken at the network level, before thinking of applications running in the network like a PBX or a CRM system.

If you found a robber in your kitchen, you know that he would have broken into your house through the front door, back door or a window. The best thing to do would be to improve the security on the exterior of your house so as not to let the robber in! And so it is with your network… Stop the bad guys getting into your network in the first place!

Anything you can do in a given appliance or application like an IP PBX or a CRM system should be seen as a secondary line of defence.

Due to the power and flexibility of Asterisk, there are actually more things you can do on an Asterisk PBX to detect and prevent any form of compromise than there are on any other PBX solution. Of course, they must be implemented and adjusted by people that know what they are doing.

Michael Graves, his dog, and 100+ lb. pumpkin. Photo Courtesy: Michael Graves (www.mgraves.org)

Office technology is supposed to make our working lives easier but the overwhelming amount of options makes it difficult just choosing the right device.

So where do you turn and who do you trust when you want to know who’s used this stuff before, what works and what doesn’t, and how much hair will I pull out trying to install this thing?

This is when you seek the guidance of a VoIP blogger like Michael Graves (@mjgraves) who runs the site Graves on SOHO Technology. He tests products geared for the small office / home office (SOHO) user and offers you, the reader, a wealth of detailed product reviews, guides and how-to articles, and great hands-on advice.

Graves explained to us that products under review spend a considerable amount of time in use on his desk before he even thinks about writing about them, so you know you’re getting quality insight. Which is great, but we wanted to know, “Why?” So we asked him a few questions about how it came to be that he created his site with all these great resources and what he thinks about the future of VoIP.

VoIP Supply: Tell us a little bit about who you are and what Graves on SOHO Technology aims to provide for your audience.

Michael Graves: My professional background includes working as a video editor and graphic designer. I also spent a long while on the technology end of the broadcast business for an English company that builds specialty graphics equipment. That work, mostly system integration and technical support, gave me the opportunity to travel extensively, which was great exposure to a variety of corporate IT infrastructures and strategies.

Early in my career I took a bit of time away from television production to write for a magazine. That exercise gave me the confidence that I could go beyond design and layout to actually write content. It was much later that I started the blog as a way to share the experience gained over years of working from my home office.

VS: How did you get started in VoIP?

“I was one of the earliest people clamoring for an embedded Asterisk appliance. That’s what started me writing about VoIP. “

MG: Working as I did for a UK based firm, with limited US presence, I was based in my home office in Houston. I wasn’t just occasionally working from home as is more commonplace. I was and remain, 100% home office based. That means that I had to come up with my own IT strategies, including telephony. We had four analog phone lines, and watched as the cost went up while their capabilities were flat-lined.

Eventually, I thought that I needed to be able to do more with the funds. That drove me to look at Asterisk in it’s pre-v1.0 days. After some experimentation, I used a small Asterisk installation with some Polycom and snom phones to replace the small Panasonic KSU that was providing our home and office phones.

I was one of the earliest people clamoring for an embedded Asterisk appliance. That’s what started me writing about VoIP. I documented the process of building an Embedded Asterisk server using a Soekris single board PC and the then fledgling Astlinux embedded distribution. I wrote that for Tom’s Hardware (which later became Small Net Builder) late in 2005.

Since I had analog lines I needed FXO interfaces. My experience with early FXO cards was pretty horrible. Even the new Sipura SPA-3000 (I was in the beta program) was less than wonderful. I eventually ported my numbers to an ITSP, putting all of our voice calling over a DSL circuit.

Back then DSL was pretty slow. It took patience to select and tune a router to ensure good voice quality over DSL. The whole process or moving to Asterisk using voice-over-DSL is what drove me to start the blog. I was answering questions in various forums. It seemed like the same handful of questions kept being asked all the time, so I thought I’d carefully write down my experience in a place that I could use as a reference.

VS: What are your favorite things about VoIP, or some of the creative ways you’ve seen people use the technology?

MG: I think it’s wonderful that we can take standards compliant hardware and software to build solutions to real problems. Sometimes it’s driven by saving money, but for me it’s more often driven by the desire to solve a problem in a new and interesting manner.

People have done all kinds of fun and interesting things with VoIP tools. My former employer had to exhibit at a major trade show in Las Vegas every spring. They paid handsomely for the privilege of internet access at the booth in the exhibit hall. Then they paid again to have a voice line dropped into the booth. Then they paid a third time for calling to the UK head office where their team of engineers were busily trying to finish the code that was to be used for the show. It was silly, bit it was the way of the world.

Once they were familiar with what I had done in my home office they asked me to bring a small PC and a couple of SIP phones to the show. We never again had the convention center install the voice circuit. Better yet, we could have multiple simultaneous calls ongoing over the SIP service, including calls from staff in the UK who had a few of their own snom hard phones by then. We had better calls using G.722 based wideband audio, and we paid less. That’s win-win.

Looking to the present-day and forward, I really like that both HDVoice and video are coming into more widespread use. It’s been about to happen for many years, but it’s really picking up momentum now. Even the US mobile carriers are now supporting HDVoice in limited ways.

Graves answers and shares a readers question.

VS: What trends are you seeing now and any predictions for the future?

MG: I expect to see growing use of hosted PBXs by small businesses. That’s what I use myself. There’s a chance that Microsoft could step into this space with a new hosted Lync offer.

I don’t think that the desk phone is going away just yet, at least not in the world that I inhabit. I still need to be on the phone even as my desktop reboots.

More use of video. We see it already with Hangouts and various other services. WebRTC has yet to really make a dent into anyone’s business, but it’s a tidal wave that’s going shake things up a lot.

On the other hand, I’m not that enthusiastic about the more costly video conferencing end-points. I think that their days may be numbered. Low-cost end-point psuedo-appliances like Chromebox for Meetings may do well, but it’s too early to tell as yet.

I hope that we see more use of encryption in all aspects of telecom. WebRTC may be a big step forward in that direction.

VS: Writers read a lot. What’s on your reading list; websites you love or books you’d highly recommend?

MG: It was pain making the switch from Google Reader when it was shuttered. These days I meet my morning using Feedly to catch up on the news of the day. While I have a couple hundred feeds collected there, I’d recommend Light Reading, No Jitter and UC Strategies for telecom topics. Also, Dave Michels who also writes at www.talkingpointz.com is someone I really admire. Avaya’s Andrew Prokop has some great insights into technical matters at SIP Adventures.

As for books, right now I’m trying to stay focussed on the Certified Specialist of Wine Study Guide. I’ve just completed a class and I’d like to take the test some time in the next month or two. It’s a grueling test, requiring 75% correct to pass. I’m told that only one-in-three people pass on their first attempt. Everyone needs a hobby, right?

There are two books I read that I’d recommend to anyone; “Exploding the Phone: The Untold Story of the Teenagers and Outlaws who Hacked Ma Bell” by Phil Lapsely and “Perfecting Sound Forever: An Aural History of Recorded Music” by Greg Milner. Both are excellent accounts of the lengthy history of something that most people take for granted.