Fuzzing

• Tools:

• • Sulley Fuzzer
  • • http://www.fuzzing.org
  • PROTOS Suite - SIP, HTTP, SNMP
  • • http://www.ee.oulu.fi/research/ouspg/protos/
  • ohrwurm - RTP
  • • http://mazzoo.de/blog/2006/08/25#ohrwurm
  • Fuzzy Packet - RTP, built-in ARP poisoner
  • • http://libresource.inria.fr/projects/VoIP_Security/fuzzypacket
  • Other tools
  • • http://www.threatmind.net/secwiki/FuzzingTools

• Mitigation:

• • Use open-source soft-phones and hard-phone firmware
  • Demand resilient devices from your device vendor
  • Ask about and review your vendor’s QA processes