Vonage/SunRocket - VOIP router security issue

When you receive the VOIP routers from Vonage (Motorola VT2442) and SunRocket (InnoMedia MTA-6328Re), they are configured with default passwords. Their configurations can be accessed via the WAN or LAN connections on port 80 (HTTP). The InnoMedia router can be accessed via port 23 (Telnet) as well, I am not sure about the Motorola. This means that if you choose to put these devices behind the cable modem (as I suggest here), anyone who knows the default password can get access to your router via the WAN connection. Changing the default password is critical.

On the Innomedia router you have two user ids; "admin" and "user". The "user" user id allows you to modify the router's configuration. The "admin" user id allows you to modify the VOIP settings which contain the SunRocket account information and allows it to make and receive calls. The included documentation does not provide the admin password since making changes could affect your service. The problem is that the SunRocket admin password has leaked onto the Internet and individuals have had their accounts hijacked and received expensive invoices for international calls. I have not heard that the Vonage Motorola VT2442 router has the same problem, however one should implement the solution I am about to describe regardless of which VOIP router you use.

The solution is simple, forward port 80 and 23 to a dummy address, that way no one can access the configuration capabilities via the WAN connection. This can be done in router settings and does not involves changing VOIP settings.

The InnoMedia configuration. The creation of 2 rules suffices to protect the router. Port 80 TCP to 192.168.251.101 (dummy address) HTTP and Port 23 TCP to 192.168.251.100 (dummy address) TELNET fixes the security hole. I also found out that the InnoMedia does not log itself out after a period of time, so it is important to explicitly logout every time you access the configuration.

Comments

[stefen34]

Thanks for the information. Security in voip phone programming is really a difficult job specially when u are providing a
business voip solution.

[polycom ip 550]

Thank you as well for providing the adequate explanation on setting up the VoIP configuration on the client.

[CCTV Bristol]

The VoIP configuration is a whole lot simpler than I thought, thanks for laying down the guidelines here!

[business voip solution]

I'm a little surprised the configuration is that simple. I was expecting something slightly complicated considering this is security we're talking about.