Tìm kiếm với Google


Showing posts with label VoIP. Show all posts
Showing posts with label VoIP. Show all posts

Thursday, March 13, 2008

SIP phone,Sip Client,Web based SIP Client

Posted by Dark Prince at 1:03:00 PM 3 comments
Labels: , , ,

Sunday, March 09, 2008

Hacking Asterisk and Rails with RAGI

Hacking Asterisk and Rails with RAGI

by Joe Heitzeberg
12/19/2005

Chances are that by now you are using Skype, Yahoo Instant Messenger with Voice, Google Talk, or one of the other PC VoIP phones that let you talk for free over the internet. You might also be a customer of Vonage, AT&T CallVantage, BroadVoice, or one of the other VoIP-based land-line replacements that give you flat-rate, unlimited calling and tons of great features like voicemail-to-email or click-to-call.

Thanks to VoIP, now anyone can talk for free; I get that. But what's next? Free calls and voicemail-to-email are just the beginning, right? You bet! Open protocols, low telephony cost, and a rapidly growing installed base of VoIP-capable PCs, phones, and networks mean a wave of innovation and opportunity, and we're just at the beginning.

In this world, hackers and entrepreneurs everywhere ought to be able to pioneer vastly new and powerful services, such as:

  • Mashing up RSS and voice to create a better kind of 411.
  • eBay virtual call centers: High-volume seller and not around to answer your inquiries? Click to provision some virtual call center agents across the globe.
  • Temporary phone numbers: Rent a temporary phone number for a week to use on Craigslist. Forward all calls to your real phone and log all messages on the Web.
  • Click and talk with other people who are viewing a given web page.
  • Learn Chinese: Fill out your profile, and we'll connect you with a qualified language instructor.

Joe Heitzeberg
Ruby on Rails with Asterisk

O'Reilly Emerging Telephony Conference
January 24-26 2006
San Francisco Airport Marriott

You might have read about Google's latest foray into "Click to Dial" advertising. There is no reason you can't build a similar service.

In this article, I'll provide a quick overview of how Asterisk, the open source PBX, can be used as a general-purpose "telephony protocol server," and can be connected to Ruby on Rails to create a rapid prototyping environment for creating next-generation VoIP applications and services.

Asterisk in 30 Seconds

Asterisk is an open source PBX. It is designed to handle all of the basic office phone services an ordinary PBX might handle and more, including call routing, conferencing, call forwarding, and three-way calling. It also speaks more than half a dozen VoIP protocols and codecs, and runs on Linux. You might use Asterisk to:

  • Start a consulting business installing 25-person office phone systems.
  • Build the best home phone system ever. Calling China? Have the phone warn you, "It is 2 A.M. in China, are you sure you want to continue this call?" Away for the day? Have all your calls forwarded to your cell phone (unless they're from your employer; then play a Ferris Bueller movie audio clip).
  • Build a banking IVR product to sell.
  • Help your local politician get elected by auto-dialing a list of phone numbers and playing a message.

Ruby on Rails in a Jiffy

If you are building web apps, then you might consider running (don't walk) to get yourself outfitted with Ruby On Rails, a great new web-application development framework by David Heinemeier Hansson and many open source contributors. Rails is framework for creating database-driven web sites that manages to cut out a lot of the grunt work typically associated with Java- or Perl-based frameworks. Rails uses the Ruby language, which will feel familiar to any Java or C# programmer, and includes tons of libraries to help with common web development tasks and with newer things like Ajax.

Bird's-Eye View

Hopefully you are starting to get the picture: hosted VoIP-enabled apps that connect to VoIP phones like Skype and real phones, and operate on the same kind of open source development stack that powers the Web. Say goodbye to proprietary and closed telephony hardware and hosted voiceXML platforms that tie you to someone else's voice platform. Plug a Linux box into the internet, grab a domain name, and get in business.

figure 1

Diagram Notes:

  • You: Your Linux server is hosted on the internet, but instead of just serving web browsers, you also connect to phones and VoIP phones to serve mobile users, phone users, and VoIP users with voice interfaces.
  • VoIP/PSTN service: Providers such as Level3 and GlobalCrossing and a multitude of smaller providers such as VoipJet, VoicePulse, and LES.net provide the capability to place and receive calls to regular phones via the internet (it's like SkypeOut, but from your server). Any mobile or land-line phone can be reached at very low cost.
  • VoIP clients: Currently, Gizmo is the most open VoIP client out there, and the others (i.e. Skype and GoogleTalk) won't accept directly connected SIP traffic. However, as a workaround, you can connect to users of SkypeIn (the dotted line), or use Jabber for a limited interaction with GoogleTalk.

http://www.oreillynet.com/lpt/a/%3C%21--CS_NEXT_REF--%3E

Rails + Asterisk = Peanut Butter + Chocolate

What could be a better way to create these new apps and services than to combine Asterisk's VoIP handling capabilities with the power and efficiency of Ruby on Rails?

For that purpose, we have RAGI: Ruby Asterisk Gateway Interface. RAGI is a simple API and set of helper classes that facilitate programmable phone logic, or IVR, from a Ruby environment by implementing the Asterisk AGI protocol. In Rails apps, RAGI makes handling phone call interaction something similar to rendering a web page. From a systems point of view, it allows you to attach your Asterisk server to your Rails server something like this:

figure 2

Diagram Notes:

  • Phone calls come in to your Asterisk server, and control over how to handle the call (ask the user a question, play a sound) is handed to your web application server.
  • Ruby on Rails is configured to load up RAGI when it starts, so that your calls have access to your entire set of classes defined in your web application (whatever you've built for user registration, data feeds, tagging objects, etc., will be available inside of the phone call session).
  • A CallHandler subclass is created for every type of call session you might need (user checking account balance, checking voice mail, etc.).
  • You can write services that handle incoming calls or place outgoing calls. Your only limit to capacity is bandwidth and CPU.

Programming with RAGI

With RAGI, you spend most of your time focusing on application logic and you get full access to the objects and services you've already defined for the rest of your web application. Spend less time hacking low-level Asterisk and VoIP configurations, and more time on user experience!

Let's take a look at the body of a call handler to get a sense of what this looks like:

 
module MyCallHandler
  class CallHandler <>
 
# when someone calls the number, 
# the call routes to this "dialup" method
def dialup
  answer()
      
    # Who is calling?  Read the caller id
    user_phone_number = @params[RAGI::CALLERID]
    
    # Look up the user in the db using Rails.
    # Since the db has a "phone_number" field, Rails
    # automatically provides a "find_by_phone_number" method
    # on the User class -- gotta love Rails!
    user = User.find_by_phone_number(user_phone_number)
    
    # Service logic here...
    #    if (user.account_balance <= 0) --> hangUp
    #    else --> speak "hello" + user.first_name
    #    Play their voice mail
    #    Ask for key presses
    #    Connect this call to conference call
    #    Etc.
    hangUp()
  end
end

RAGI exposes most of the major functions and capabilities of Asterisk itself. And if what's already there is not enough, you can add and contribute back, since RAGI is open source. The major API functions are:

  • Play sounds.
  • Record sounds.
  • Place a call (can be processed through RAGI when answered).
  • Forward a caller to another number by placing a call.
  • Listen for key presses (DTMF signals).
  • Send key presses (DTMF signals).
  • Text to speech.

Summary

VoIP connectivity has quickly become ubiquitous. Its openness and low cost means that it can be combined with traditional web infrastructure to create powerful new communications applications and services. In this article, I've sketched out what those new services may look like, and illustrated an approach to developing such applications using open source software such as Asterisk and Ruby on Rails.

Would you like to learn more?

I'll be doing a workshop on RAGI at the O'Reilly Emerging Telephony conference, January 24 to 26 in San Francisco. Also, in the new year, look for a complete tutorial on O'Reilly about using RAGI. In the meantime, please feel free to get started on your own by visiting the RAGI developer pages.

Posted by Dark Prince at 10:29:00 PM 1 comments
Labels: , ,

Wednesday, February 27, 2008

VoIP Security

McGrawHill Hacking Exposed VoIP Voice.Over.IP Security Secrets Solutions eBook
McGrawHill Hacking...
Hosted by eSnips

Syngress How to Cheat at VolP Security (2007)
Syngress How to Ch...
Hosted by eSnips

Asterisk Stability And Security
Asterisk Stability...
Hosted by eSnips

Voice over IP (VoIP) has finally come of age and is being rapidly embraced across most markets as an alternative to the traditional public-switched telephone network (PSTN). VoIP is a broad term, describing many different types of applications (hard phones, softphones, proxy servers, Instant Messaging clients, peer-to-peer clients, and so on), installed on a wide variety of platforms (Linux, Windows, VxWorks, mobile devices, PCs, and so on), and using a wide variety of both proprietary and open protocols (SIP, RTP, H.323, MGCP, SCCP, Unistim, SRTP, ZRTP, and so on) that depend heavily on your preexisting data network's infrastructure and services (routers, switches, DNS, TFTP, DHCP, VPNs, VLANs and so on). Correspondingly, VoIP security is just as broad a subject thanks to the heterogeneous nature of these environments found in the consumer, enterprise, carrier, and small/medium–sized business markets.


How the Book is Organized

This book is split into five completely different parts. Each part can be read without even touching the remaining four—so if the reader is interested only in the issues described in the selected part, he or she may consult only that part.

Part I. "Casing the Establishment"

The first part is introductory and describes how an attacker would first scan the whole network and then pick up specific targets and enumerate them with great precision in order to proceed with further advanced attacks through or from the hacked VoIP devices.

Chapter 1. "Footprinting a VoIP Network"

We begin the book by describing how a hacker first profiles the target organization by performing passive reconnaissance using tools such as Google, DNS, and WHOIS records, as well as the target's own website.

Chapter 2. "Scanning a VoIP Network"

A logical continuation of the previous chapter, this chapter provides a review of various remote scanning techniques in order to identify potentially active VoIP devices on the network. We cover the traditional UDP, TCP, SNMP, and ICMP scanning techniques as applied to VoIP devices.

Chapter 3. "Enumerating a VoIP Network"

Here, we show active methods of enumeration of various standalone VoIP devices, from softphones, hard phones, proxies, and other general SIP-enabled devices. Plenty of examples are provided, along with a demonstration of SIPScan, a SIP directory scanning tool we wrote.

Part II. "'Exploiting the VoIP Network"

This part of the book is focused on exploiting the supporting network infrastructure on which your VoIP applications depend. We begin with typical network denial-of-service attacks and eventually lead up to VoIP conversation eavesdropping. While many of the demonstrated techniques originate from the traditional data security world, we applied them against VoIP devices and supporting network services.

Chapter 4. "VoIP Network Infrastructure Denial of Service (DoS)"

In this chapter, we introduce quality of service and how to objectively measure the quality of a VoIP conversation on the network using various free and commercial tools. Next, we discuss various flooding and denial of service attacks on VoIP devices and supporting services such as DNS and DHCP.

Chapter 5. "VoIP Network Eavesdropping"

This section is very much focused on the types of VoIP privacy attacks an attacker can perform with the appropriate network access to sniff traffic. Techniques such as number harvesting, call pattern tracking, TFTP file snooping, and actual conversation eavesdropping are demonstrated.

Chapter 6. "VoIP Interception and Modification"

The methods described in this chapter detail how to perform man-in-the-middle attacks in order to intercept and alter an active VoIP session and conversation. We demonstrate some man-in-the-middle methods of ARP poisoning and present a new tool called sip_rogue that can sit in between two calling parties and monitor or alter their session and conversation.

Part III. "Exploiting Specific VoIP Platforms"

In this part of the book, we shift our attention to attacking specific vendor platforms where each has unique security weaknesses and countermeasures. We demonstrate some of the attacks covered in the last few chapters in order to detail the vendor-specific best practices for mitigating them.

Chapter 7. "Cisco Unified CallManager"

We installed Cisco CallManager 4.x with Cisco hard phones in a fully homogenous Cisco-switched environment in order to perform many of the attacks we've already detailed.

We also cover the various best practices to apply to the Cisco switching gear to mitigate most of the network attacks covered in Part II.

Chapter 8. "Avaya Communication Manager"

Similarly, we installed a full Avaya Communication Manager along with Avaya hard phones to detail some of the specific attacks we covered in Part I and Part II.

Chapter 9. "Asterisk"

We targeted our SIP test bed running Asterisk with the similar attacks detailed in Part I and Part II. We also performed some basic platform testing on a subset of the SIP phones in our test bed.

Chapter 10. "Emerging Softphone Technologies"

In this chapter, we discuss some security issues with the emerging softphone services, such as Skype, Gizmo, and others. While these services have not yet dominantly emerged into the enterprise space, they are poised to do so through some interesting partnerships under way.

Part IV. "VoIP Session and Application Hacking"

In this part of the book, we shift our attention from attacking the network and device to attacking the protocol. The fine art of protocol exploitation can hand intruders full control over the VoIP application traffic without any direct access and reconfiguration of the hosts or phones deployed.

Chapter 11. "Fuzzing VoIP"

The practice of fuzzing, otherwise known as robustness testing or functional protocol testing, has been around for a while in the security community. The practice has proven itself to be pretty effective at automating vulnerability discovery in applications and devices that support a target protocol. In this chapter, we demonstrate some tools and techniques for fuzzing your VoIP applications.

Chapter 12. "Flood-Based Disruption of Service"

In this chapter, we cover additional attacks that disrupt SIP proxies and phones by flooding them with various types of VoIP protocol and session-specific messages. These types of attacks partially or totally disrupt service for a SIP proxy or phone while the attack is under way. Some of the attacks actually cause the target to go out of service, requiring a restart.

Chapter 13. "Signaling and Media Manipulation"

In this chapter, we cover other attacks in which an attacker manipulates SIP signaling or RTP media to hijack, terminate, or otherwise manipulate calls. We introduce no less than ten new tools to demonstrate these attacks. As with other attacks we have covered, these attacks are simple to execute and quite lethal.

Part V. "Social Threats"

In the same way that the traditional email realm has been inundated with spam and phishing, so too are we starting to see the evolution of these social nuisances into the VoIP world. This chapter focuses on how advertisers and scam artists will likely target VoIP users and how to help counter their advance.

Chapter 14. "SPAM over Internet Telephony (SPIT)"

Voice SPAM or SPAM over Internet Telephony (SPIT) is a similar problem that will affect VoIP. SPIT, in this context, refers to bulk, automatically generated, unsolicited calls. SPIT is like telemarketing on steroids. You can expect SPIT to occur with a frequency similar to email SPAM. This chapter describes how you can use the Asterisk IP PBX and a new tool called spitter to generate your own SPIT. This chapter also details how you can detect and mitigate SPIT.

Chapter 15. "Voice Phishing"

Voice phishing relies on the effective gullibility of a victim trusting a phone number much more than an email link. Also, for a fraction of the cost, an attacker can set up an interactive voice response system through a VoIP provider that is harder to trace than a compromised web server. Also, the nature of VoIP makes this type of attack even more feasible because most VoIP services grant their customers an unlimited number of calls for a monthly fee. This chapter details how these attacks are performed and how to detect them at their various stages.

Posted by Dark Prince at 9:41:00 PM 0 comments
Labels: , , , , , , , ,

Tuesday, February 26, 2008

Fax Over IP (Part II)

FoIP Software Architecture
The facsimile interface unit (FIU) is the software module that resides within a
FoIP IWF. It demodulates voiceband signals from an analog interface and
converts them to a digital format suitable for transport over a packet network. It
also remodulates data received from the packet network and transmits it to the
analog interface. In doing so, the FIU performs protocol conversion between
Group-3 facsimile protocols and the digital facsimile protocol employed over the
packet network.
The FIU, shown in Figure 10, consists of the following three units:
fax-modem unit (FM)—This processes PCM samples based on the current
modulation mode and supports the following functions:
• V.21 Channel 2 (300 bps) binary signaling modulation and
demodulation
• high-level data link control (HDLC) framing (0 bit insertion/removal,
cyclic redundancy check (CRC) generation/checking)
• V.27 ter (2400/4800 bps) high-speed data modulation and
demodulation
• V.29 (7200/9600 bps) high-speed data modulation and demodulation
• V.17 (7200/9600/12000/14400 bps) high-speed data modulation and
demodulation
• V.33 (12000/14400 bps) high-speed modulation and demodulation
• CED detection and generation
• CNG detection and generation
• V.21 Channel-2 detection

Posted by Dark Prince at 12:21:00 AM 0 comments
Labels: , , , ,

Thursday, February 21, 2008

Installing Asterisk

Compiling Asterisk on most Linux distributions


Accomplish this by opening the folder in which the source codes were extracted (if you are using tarball files), or go to the /usr/src/asterisk folder (if using CVS server) to get the required packages.

To go to this directory, see example:

#cd /usr/src/asterisk


Once here, the final step is to compile:

Important: Follow this installation order: libpri, zaptel, asterisk

-Installing libpri

#cd /usr/src/asterisk/libpri
#make clean
#make
#make install


-Installing zaptel

#cd /usr/src/asterisk/zaptel
#make clean

Note: If you are using kernel 2.6 enter the following command '#make linux26', before doing '#make install'.

#make install


-Installing asterisk

#cd /usr/src/asterisk/asterisk
#make clean

Note: If you want to use a mp3 files for music-on-hold enter the following command '#make mpg123', before doing '#make install'.

#make install

If this is your first installation perform 'make samples' to install sample

(asteriskguru.com)

Posted by Dark Prince at 11:05:00 AM 0 comments
Labels: , , , , ,

Fax Over IP (Part I)

Traditionally, there have been two approaches for sending FoIP networks:
real-time methods and store-and-forward methods. The primary difference in service between these two approaches lies in the delivery and method of receipt
confirmation. The Frame Relay Forum has defined a real-time protocol for the
transmission of fax-over–frame relay networks. Likewise, the ITU and Internet
Engineering Task Force (IETF) are working together to continue to evolve both
the real-time FoIP network standard (T.38) as well as the store-and-forward FoIP
network standard (T.37). Both T.37 and T.38 were approved by the ITU in June,
1998. Furthermore, T.38 is the fax transmission protocol selected for H.323.
There are tremendous opportunities for cost savings by transmitting fax calls
over packet networks. Fax data in its original form is digital. However, it is
modulated and converted to analog for transmission over the PSTN. This analog
form uses 64 kbps of bandwidth in both directions.
FoIP QoS
The advantages of reduced cost and bandwidth savings of carrying FoIP networks are associated with some QoS issues that are unique to packet networks and can affect the reliability of the fax transmission.
Timing
A major issue in the implementation of FoIP networks is the problem of
inaccurate timing of messages caused by delay through the network. The delay of fax packets through a packet network causes the precise timing that is required for many portions of the fax protocol to be skewed and can result in the loss of the call. The FoIP protocol in the IWF must compensate for the loss of a fixed timing of messages over the packet network so that the T.30 protocol operates without error.
There are two sources of delay in an end-to-end, FoIP call: network delay and
processing delay.
• network delay—This is caused by the physical medium and protocols
that are used to transmit the fax data and by buffers used to remove
packet jitter on the receiving end. This delay is a function of the
capacity of the links in the network and the processing that occurs as
the packets transit the network. The jitter buffers add delay when they
remove the packet-delay variation of each packet as it transits the
packet network. This delay can be a significant part of the overall delay,
as packet-delay variations can be as high as 70 to 100 milliseconds in
some frame-relay networks and even higher in IP networks.
• processing delay—This is caused by the process of demodulating and
collecting the digital fax information into a packet for transmission
over the packet network. The encoding delay is a function of both the
processor execution time and the amount of data collected before
sending a packet to the network. Low-speed data, for instance, is
usually sent out with a single byte per packet, as the time to collect a
byte of information at 300 bps is 30 milliseconds.
Jitter
Delay issues are compounded by the need to remove jitter, a variable interpacket timing caused by the network that a packet traverses. An approach to removing the jitter is to collect packets and hold them long enough so that the slowest packets to arrive are still in time to be played in the correct sequence. This approach, however, causes additional delay. In most FoIP protocols, a time stamp is incorporated in the packet to ensure that the information is played out at the proper instant.
Lost-Packet Compensation
Lost packets can be an even more severe problem, depending on the type of
packet network that is being used. In a VoIP application, the loss of packets can
be addressed by replaying last packets and other methods of interpolation. A
FoIP application, however, has more severe constraints on the loss of data, as the fax protocol can fail if information is lost. This problem varies, depending on the type of fax machine used and whether error-correction mode is enabled.
Two schemes that are used by FoIP software to address the problems of lost
frames are as follows:
• repeating information in subsequent frames so that the error can be
corrected by the receiver's playout mechanism
• using an error-correcting protocol such as TCP to transport the fax data
at the expense of added delay

Posted by Dark Prince at 10:53:00 AM 0 comments
Labels: , , , ,

Asterisk Hacking

Today,Asterisk become the most wide use solution for IP PBX.With Asterisk and one old PC ,you can building one system with many Application as:voicemail,Call forwarding,Music on hold,Call conferencing,v.vv.
So,you might be read this book,it;s truly useful for me when I'm development A NGN system called by Unified Messaging.I hope it can help you,too.Thank you.

Syngress Asterisk Hacking May 2007 eBook
Syngress Asterisk ...
Hosted by eSnips

Posted by Dark Prince at 10:38:00 AM 0 comments
Labels: , , , , , ,
Subscribe to: Posts (Atom)