VoIP Hackers Shut Down Hospital Phone Lines

July 23, 2013 by Nathan Miloszewski

Is your VoIP phone system secured against attacks?

LA Times writer Paresh Dave reported that a San Diego hospital was the victim of a distributed denial-of-service attack (DDoS) when an “extortionist who, probably using not much more than a laptop and cheap software, had single-handedly generated enough calls to tie up the lines.”

For two days phone lines appeared busy to the outside world.

Who Is Affected?

David writes that according to vague mentions in law enforcement documents telecom industry insiders, there have been a range of VoIP victims including:

Hospitals, nursing homes, and medical centers
A public safety agency and an emergency operations center
A manufacturer
Wall Street firms
Schools
Media
Insurance companies

There are more but “Many of the victims want to remain anonymous out of fear of being attacked again or opening themselves up to lawsuits from customers.” And the FBI is reporting that victims have paid up to $5,000 just to get the attackers to stop.

In the case of the San Diego hospital, the attack was stopped was using a “computer firewall filter.” There are devices available like Cisco security appliances that can reducing exposure to threats and unauthorized access.

Ongoing Problem

Two years ago the ClueCon VoIP conference featured a VoIP security discussion centered around the Lulz Security threats of the time, noting that,

Right or wrong, their hacking activities have proven beyond a shadow of a doubt two important points: Security is important, and good security is hard to find.

Couple that with the fact that there are hundreds of millions of VoIP endpoints installed around the world with more every day. IP PBX’s and SIP trunks are ubiquitous.

Skype has well over half a billion users. VoIP security matters, whether you are a developer, a provider, or even simply the end user.

Now as VoIP adoption rises, so too does the threat. One Australian business lost $120,000 because of VoIP hackers.

The FCC is working on a solution, reports David, but that may be a couple years away.

Until then, you should do as much as you can to protect your networks and be aware of the threat because as Frank Artes of NSS Labs was quoted as saying, “For all the money spent on Internet security, companies often overlook protecting their telephones.”

via LA Times

Security Issues Addressed for Cisco Unified Communications Manager

July 22, 2013 by Nathan Miloszewski

Cisco has announced that certain versions of Cisco Unified Communications Manager (Cisco Unified CM) are vulnerable to remote hacker attacks such as

Blind Structured Query Language (SQL) injection
Command injection
Privilege escalation

Temporary Fix

Cisco explains how they found out about the problem through independent researchers:

On June 6, 2013, a French security firm, Lexfo, delivered a public presentation on VoIP security that included a demonstration of multiple vulnerabilities used to compromise Cisco Unified CM. During the presentation, the researchers demonstrated a multistaged attack that chained a number of vulnerabilities, which resulted in a complete compromise of the Cisco Unified CM server.

A Cisco Options Package (COP) file has been released as a temporary fix to shore up the weaknesses and can be found on the Cisco download page. Look for the file named:

cmterm-CSCuh01051-2.cop.sgn

Vulnerable Products

These versions of Cisco Unified CM are known to be vulnerable:

Cisco Unified Communications Manager 7.1(x)
Cisco Unified Communications Manager 8.5(x)
Cisco Unified Communications Manager 8.6(x)
Cisco Unified Communications Manager 9.0(x)
Cisco Unified Communications Manager 9.1(x)

These additional Cisco products might be vulnerable to the same products but, they haven’t been confirmed yet:

Cisco Emergency Responder
Cisco Unified Contact Center Express
Cisco Unified Customer Voice Portal
Cisco Unified Presence Server/Cisco IM and Presence Service
Cisco Unity Connection

Lucian Constantin at PCWorld is also reporting that Cisco has warned users of denial-of-service (DoS) attacks could affect these products:

Cisco ASA 5500-X Series Adaptive Security Appliances
Cisco IPS 4500 Series Sensors
Cisco IPS 4300 Series Sensors

Via Cisco and PCWorld

First Look: Grandstream UCM6100

July 19, 2013 by Tom Costelloe

The phrase “champagne on a beer budget” gets a bad rap in my opinion. When used it seems like there is usually a negative connotation associated with it but I don’t think that should always be the case. Sometimes it could be used to imply that you are getting more for less, which isn’t a bad thing. One example of how you could use the phrase in a positive manor is to describe the new Grandstream UCM6100 series of IP PBXs; where you get many of the features of an expensive enterprise grade IP PBX without the price tag or champagne on a beer budget.

WHAT IS IT?

The Grandstream UCM6100 is a series of 4 new IP PBXs that have been targeted at Small to Medium Businesses or SMBs. The full featured UCM6100 appliances provide many of the features and functionality usually associated with more expensive and/or enterprise grade IP PBXs but without the hefty price tag or any additional licensing fees.

While the four different models in the UCM6100 series share many of the same features there is some difference in both the chassis of the appliances, port configuration and capabilities.

Grandstream UCM6102 – Wall mountable and desktop chassis design, 2 FXS and 2 FXO Ports, dual 10M/100M/1000M RJ 45 Ports, up to 30 simultaneous calls, up to 3 conference bridges with 25 simultaneous participants

Grandstream UCM6104 – Wall mountable and desktop chassis design, 2 FXS and 4 FXO Ports, dual 10M/100M/1000M RJ 45 Ports, up to 45 simultaneous calls, up to 3 conference bridges with 25 simultaneous participants

Grandstream UCM6108 – Rack mountable and desktop chassis design, 2 FXS and 8 FXO Ports, single 10M/100M/1000M RJ 45 Port, up to 60 simultaneous calls, up to 6 conference bridges with 32 simultaneous participants

Grandstream UCM6116 – Rack mountable and desktop chassis design, 2 FXS and 16 FXO Ports, single 10M/100M/1000M RJ 45 Port, up to 60 simultaneous calls, up to 6 conference bridges with 32 simultaneous participants

For all of the slight differences the four Grandstream UCM6100 models do share many of the same features and functionalities:

1GHz ARM Cortex A8 application processor, large memory (512MB DDR RAM, 4GB NAND Flash), and dedicated high performance multi-core DSP array for advanced voice processing
Hardware DSP based 128ms-tail-length carrier-grade line echo cancellation (LEC), hardware based caller ID/call progress tone and smart automated impendence matching for various countries
Flexible dial plan, call routing, site peering, call recording, central control panel for endpoints, integrated NTP server, and integrated LDAP contact directory
Strongest-possible security protection using SRTP, TLS, and HTTPS with hardware encryption accelerator
Supports for a wide range of popular voice codes (including G.711 A-law/U-law, G.722, G.723.1, G.726, G.729A/B, iLBC, GSM), video codec (including H.264, H.263, H.263+), and Fax (T.38).

For a complete overview you can read the Grandstream UCM6100 Datasheet and the user manua.

Who Is It For?

As I previously mentioned the new Grandstream UCM6100 appliances have been designed with SMBs in mind both from a design, feature capabilities and pricing aspect.

One tools that makes it such a good match for SMBs that may not have a dedicated IT person is the Zero Configuration provisioning. This tool allows users to provision phones and IP Cameras via a simple web user interface allowing for a quick set-up and easy management. While a full list of supported phones and cameras has not been released yet but it almost certain that Grandstream phones and IP Cameras will be on the list.

Pricing

The pricing for the Grandstream UCM6100 models is:

Grandstream UCM6102 – $395
Grandstream UCM6104 – $495
Grandstream UCM6108 – $899
Grandstream UCM6116 – $1,699

There are no additional licensing fees or extra costs for features, users or firmware upgrades.

How Small Businesses Save on Shipping Costs

July 18, 2013 by Nathan Miloszewski

Small business owners are always looking for ways to cut costs and one great way to help that effort is by taking a closer look at shipping processes and procedures.

VoIP Supply was recently featured in this Launch Grow Joy article by Andreea Ayers that includes the advice from over 30 other entrepreneurs who shared their experiences on how to save on shipping.

Here’s how VoIP Supply works to keep costs low:

Make your packing materials work for you. VoIP Supply reuses or recycles every box that comes in. Boxes in good shape get shipped back out and all the others are taken by a recycling company that pays us to pick them up so, we save on the cost of a cardboard dumpster. We haven’t purchased peanuts or bubble wrap in 5 years because they’re easily reused and paper void-fill is also very cost effective. Also, work on your box size versus product size because express shipping will charge based on dimensional weight (DIM) so, it’s a good idea to have a variety of box sizes on hand to reduce that cost.

Via Launch Grow Joy

New Digium G-Series Gateways Available for Pre-Order

July 16, 2013 by Nathan Miloszewski

Digium Webinar, Tuesday, July 16th at 3 pm EST

The popular line of Digium G-Series VoIP Gateways has two new friends, the G400 and the G800. And you can learn about both of them today, Tuesday, July 16th, by registering for Digium’s webinar which will help you learn about your VoIP connectivity options.

The Digium G400 and Digium G800 gateways are expected to ship sometime this quarter but, you can pre-order them now. The new gateways are similar to the previous models, the G100 and G200, with a few differences such as:

Dual RJ45 Connectors for Ethernet
4 x 10/100/1000Base-T Ethernet Connections (G400)
8 x 10/100/1000Base-T Ethernet Connections (G800)
120 concurrent calls (G400)
240 concurrent calls (G800)

Digium Gateways run on the Asterisk® platform, offer a simplified setup, and will help you transition legacy T1/E1/PRI phone systems to a SIP-based solution.

A Digium Extended Warranty is also available for 3 or 5 years for the G Series Gateways. Just choose one from the drop-down menu under “Options”:

Digium Extended Warranty Available on All G-Series Gateways

Contact a VoIP Expert today if you have any questions.

Click here to register for today’s webinar, Overview of the Digium G400 and G800 Gateways.

How To Customize Your Own MOBOTIX T24 at VoIP Supply

by Taylor Hamp

The T24 Door Station from MOBOTIX is more than just a doorbell, security camera, intercom system, keyless entry…well, it’s more than you might think it is. If you thought the T24 Door Station was all of this and more, then, OK, it’s exactly what you think it is.

The MOBOTIX T24 IP Video Door Station is an incredible addition to the safety and security of any residence, business, or warehouse. Now available at VoIP Supply, you can custom create your very own T24 Door Station to whatever your needs may demand. However, all those parts can be incredibly daunting and the part numbers tend to be confusing to someone looking at it for the first time, so we’ve created this in-depth guide to T24 door stations in order to help you feel better about what you’re getting into and how it’s going to fit your needs.

Colors

The MOBOTIX T24 comes in five colors that are coded as such:

PW – White

AM – Amber

BL – Black

DG – Dark Gray

SV – Silver

You’ll see these two lettered codes throughout part numbers, so using this guide you can make certain you’re choosing the correct color you want. Not all parts come in different colors, such as the in-wall housing units and DoorMaster, so no need to worry when you don’t see these color codes in them.

T24-CamCore Day Hemispheric Camera with LEDs

This little unit is where all the beauty begins. To call it just a camera would be an understatement. Think of it more as a smart computer. The T24-CamCore (part number MX-T24M-Sec-D11- for day cameras and MX-T24M-Sec-N11- for night) has no blind spots with a 180 degree wide angle lens that can see wall to wall and floor to ceiling. Or ground to sky, if you like; the T24-CamCore is IP65-rated for outdoor weather. Following minimalist modernism, the hemispheric camera module has a discreet and yet powerful microphone, a light button, a speaker/LED orientation light combo, and a doorbell button. The charm of the T24-CamCore is that it’s based on IP technology. Once the doorbell is rung, a direct connection is made between the Door Station and any VoIP Phone, computer, or smartphone with VoIP software. If you have an iPhone or iPad it’s a whole other story.

MOBOTIX App

It’s entirely possible to run a mobile remote station with any iPhone or iPad with the MOBOTIX App. By connecting to the internet this free, full feature application gives you incredible control over your Door Station without being local. From it you can see who is at the door, speak to them in real time with the 2-way communication, and choose to either let them in or not. The App makes it possible to receive alerts, mailbox messages, live images and recordings from not only your T24 Door Station, but any and all incorporated MOBOTIX cameras. Control buttons, zoom, positions, search and a control wheel give you all kinds of ability to interact with your surveillance system whether you’re at the office or on the other side of the world. You can download this app at no cost from the App Store.

T24-KeypadRFID Access Module

While the T24-CamCore is a (gentle) beast by itself, the Keypad (part number MX-Keypad1-EXT-) can turn the Door Station into a keyless entry station. By combining it with the T24-DoorMaster the Keypad can unlock access doors with the correct PIN or RFID card. The Keypad also caters to messaging: when someone comes to visit and rings the doorbell and no one answers (why didn’t you have your phone near you?) the visitor can leave a message by holding down the blue letter button during the entire message recording. This messaging technology also works the other way: you can record a message to be played anytime someone rings the doorbell button on the T24-CamCore. This is perfect for small offices when the only employee has to make appointments out of the office. Personal messages can also be left to play when the a specific PIN number is entered or an RFID card is swiped identifying someone.

T24-Info

This is a backlit module that is perfect for displaying the address number, residence name, or anything else that will identify the premises. The energy saving LEDs use up very little power for display (part number MX-Info1-EXT-).

T24-Info2Wire+ Two Wire Network Module

If you’re working with an existing doorbell or door intercom systems, this is the module you want (part number MX-2wirePlus-Info1-EXT-). It has a T24-Info display for an address number, name, or what have you, but it also includes an indoor module that takes that 2-wire cable and acts as a sort of midspan on the way to the PoE Switch or Injector (IEEE 802.3at is recommended). This way you can update any older building without having to tear out walls to lay new cable.

T24 Complete Set

In-Wall Unit Sockets

Well…you can tear out walls if you want to. The in-wall unit sockets house the components of the T24 in either 1 unit sockets (MX-OPT-Box-1-EXT-IN), 2 unit sockets (MX-OPT-Box-2-EXT-IN), or 3 unit sockets (MX-OPT-Box-3-EXT-IN). Since it’s not going to be seen by anyone, the units only come in blue. It attaches to any subsurface, brickwork, or hollow space and lets the unit lay relatively flush with the surface. It won’t be completely flush, but it won’t protrude as much as using the….

On-Wall Unit Sockets

Instead of digging into the wall to mount your Door Station, you can install it in this metal-reinforced housing unit. Since the unit is visible, it comes in colors to match the T24-CamCore, the T24-Keypad, and the T24-Info/T24-Info2wire+ modules (part numbers: MX-OPT-Box-1-EXT-ON-, MX-OPT-Box-2-EXT-ON-, MX-OPT-Box-3-EXT-ON-).

T24 Frame

Complete the look while you secure your T24 with a frame that has integrated electromagnetic anti-theft protection and a special key for module unlocking. These frames can be used with either in-wall or on-wall unit sockets in 5 different colors (part numbers: MX-OPT-Frame-1-EXT-, MX-OPT-Frame-2-EXT-, MX-OPT-Frame-3-EXT-), and it gives the unit a nice finished look.

T24 Optional Accessories

The T24-DoorMaster (MX-Door1-INT-PW) falls into this category: it’s an indoor security door opener. It works by connecting the Door Station to the door lock switch and door contact. It pulls both power and data through the T24 Door Station via a MxBus cable so it cues when to let someone in on your command.

The Ethernet Terminal Board (MX-OPT-IO2) is an IO module Ethernet connection board for the secure connection of the Door Station via an RJ45 plus with the 8 wires of the network cable.

The Extended Terminal Board (MX-OPT-IO1) is an IO module that provides 8 additional inputs and 3 additional outputs to connect external devices to your Door Stations.

Also available:

Admin RFID access card (MX-AdminCard1) is exactly what it sounds like. To be paired with the Keypad Module, this is the decision maker’s access card.

User RFID access card (MX-UserCard1) is also what it sounds like. It doesn’t have as much flexibility for working the Door Station, but it’s a means of identification to allow people in and/or cue personal messages to play.

T24-DoorMaster Battery (MX-Door2-BAT) is a replacement battery.

And that’s it! All the bits and pieces have been explained, and hopefully in understandable terms. As you can tell, there is a lot that goes into this Door Station that makes it an incredibly functional unit for all sorts of scenarios. Each piece comes with instructions, and VoIP Supply offers documentation on our website as well (available for download under the ‘Technical Specs’ tab of the specific product page), which makes installing each piece a little bit easier. The literature is explained in a step-by-step process and the images make it incredibly easy to follow along and know you’re doing it right. If you feel comfortable playing with technology and hooking equipment up, this IP Video Door Station is for you. It will take some time setting up, especially if you want to hook up all your options and use it to it’s fullest potential, but you will love doing it. It looks great, it’s a solid quality product, and it lasts for years; you’ll be really happy playing around with it. If you’re the type of person who needs help setting up their home printer, then maybe you want to find a local MOBOTIX Partner integrator to install the unit, program it, and walk you through how to use your Door Station. The good news is you’ll only need to be shown once and you should have it from there!

MOBOTIX also considered that you would just take their word for pre-assembled options (I’m using the term ‘pre-assembled’ loosely, by the way). There are a few Door Station Sets available from MOBOTIX and you can check out the differences on each link: MOBOTIX IP Door Station T24 Complete Set 1 (the most basic set), MOBOTIX IP Door Station T24 Complete Set 3 (a happy medium between sets 1 and 2), and MOBOTIX IP Door Station T24 Complete Set 4 (a different happy medium between sets 1 and 2). These links are to United States Part Numbers, which are only available in white. If you’re across the pond in Europe, the sets are available in other colors (lucky blokes). Should you be stateside and would like these sets in colors, VoIP Supply can help out with that; just give us a call and we’ll help you piece them together from scratch, which you might actually prefer a little more anyways. 😉

Free Slurpee Day

July 11, 2013 by Nathan Miloszewski

What are you doing here? Go get your free Slurpee®.

It’s July 11th, (7/11) and 7-11 is giving away free drinks from 11 am to 7 pm. Was that enough sevens and elevens in once sentence?

This really would have come in handy a few days ago when the humidity was outpacing the temperature. It’s cooled off considerably today, at least in the Buffalo area.

Am I really complaining about getting something for free? It appears that I am, and no, I don’t know what’s wrong with me.

There’s even more sweet promotions from other chains this week.

Enjoy your summer.

New 3CX VoIP App for Android and iPhone

July 9, 2013 by Nathan Miloszewski

Need a VoIP app for your Android or iPhone?

3CX has released Version 12 of 3CXPhone so you can make VoIP calls from anywhere with the smartphone of your choice.

What Is It?

3CXPhone is the app for the software-based 3CX IP PBX phone system for Windows. This app uses push technology so that you don’t have to have it running all the time – you’re notified as soon as a call or message comes in, just like you would with your regular cell phone service.

3CXPhone for Android and iPhone also has these Unified Communications (UC) features:

Conference calling, call hold, call transfers (blind and attended), office voicemail
View co-worker line presence and set your personal away or available status
Multi-line feature to manage several calls at once
Corporate instant messaging
Call forwarding
Call history
Configure via email in seconds
Phonebook management
Play back and call recording

Why Do I Need It?

Look, even Dave Chappelle uses 3CXPhone.

Use 3CXPhone to save money by making mobile VoIP calls through your office’s 3CX phone system. Now, when work takes you away from your desk you won’t have to miss anything important.

Like when you missed that call from your overbearing client who then called every other number in your office, sent a fax, emailed you, direct messaged you on Twitter and Facebook, and then released a carrier pigeon to deliver the message.

If that sounds familiar then you’ll appreciate that your cell phone number stays private when you make calls using 3CXPhone because the caller ID displays your office phone number.

So, there’s at least one way to create a boundary between work and life.

How Can I Get It?

First: You need to make sure that your office is running 3CX Phone System V12.

Second: Simply download 3CXPhone from either the Google Play store or iTunes.

Third: Enjoy!

Via 3CX

Polycom Microsoft WPC 2013 Announcements

by Tom Costelloe

With Microsoft WPC 2013 in full swing this week in Houston, Texas it wouldn’t be surprising to see quite a few Lync product announcements coming out and Polycom has duly obliged. Today Polycom announced the release of two new Lync video conferencing units and Lync qualification for their VVX Business Media phones.

According to the press release the new Polycom CX5500 and Polycom CX5100 are “the industry’s first 360-degree, panoramic 1080p HD video collaboration solutions custom-built for Microsoft Lync 2013.” Additionally each model supports 30 frames per second, Polycom HD Voice and USB connectivity allowing them to be connected to a computer. The main difference between the two models so far seems to be the ability of the CX5500 to double as a SIP conference phone.

The 360 degree panoramic ability of these two new Polycom models allows them to be placed in the center of a table helping to enable “natural conversation that addresses the need to collaborate and engage simultaneously with those in the room (around the table) and other participants who are remote.”

While Polycom already has the CX5000, which offers 360-degree panoramic view, it only offers 720p HD and was not designed specifically for Lync 2013. The new models are being positioned as the successors to the CX5000 and fall more in line with the styling that has been seen with the Polycom SoundStation Connect and the Polycom Group Series.

Pricing hasn’t been announced for either model but should be available shortly seeing that the Polycom CX5100 is scheduled to be released in September and the Polycom CX5500 to follow sometime in Q4.

In addition to the release of the new models Polycom also announced that it had earned Lync 2013 qualifications for the Polycom VVX 300, VVX 310, VVX 400 and VVX410. Announced in Q1 of this year, these Polycom VVX models were positioned as the entry and mid-range models in the VVX line. Through a software update, Polycom UC Software v 5.0, these and other VVX Business media phones will have “new features including improved call management such as call park or call transfer; and the ability to search address book contacts” in Lync environments.

Polycom UC Software v 5.0 is currently slated for an August release.

How To Protect Your eCommerce Site From Hackers

July 5, 2013 by Nathan Miloszewski

Hackers and fraud got you down?

Don’t let all the hard work you put into your eCommerce site be derailed.

Take some precautions by taking the advice of these 15 Ways to Protect Your Ecommerce Site From Hacking and Fraud from IT pros.

Jennifer Schiff, CIO.com writer, shares expert tips to reduce credit card fraud and maintain the trust of your customers.

VoIP Supply’s stellar Software Development Manager, Shawn Hess, chimes in with the suggestion to choose a secure eCommerce platform:

“Put your ecommerce site on a platform that uses a sophisticated object-orientated programming language,” says Shawn Hess, software development manager, VoIP Supply.

“We’ve used plenty of different open source ecommerce platforms in the past and the one we’re using now is by far the most secure,” Hess says. “Our administration panel is inaccessible to attackers because it’s only available on our internal network and completely removed from our public facing servers. Additionally, it has a secondary authentication that authenticates users with our internal Windows network.”

Via CIO.com