VoIP is one of the most widely-used technologies among businesses and, increasingly, in households. It represents a combination of Internet technology and phone technology that enhances and expands the possibilities of both. One of these possibilities involves using it for botnet command and control infrastructure and a data exfiltration vector.
The concept of VoIP Botnet is to operate in closed networks with limited access and the potential of censorship using everyday telecommunication and telephony services such as voicemail, conference calls, voice and signaling information.
Moshi Moshi is a proof of concept VoIP Botnet that allows the operator to dial in from a payphone or mobile phone, and get shell access and exfiltrate data from the bots.
This presentation will discuss and demonstrate the use of VoIP technology to create "Moshi Moshi", we also explore some interesting properties of VoIP based botnet.
Additionally, we will discuss mitigating factors and ways that VoIP providers should implement in order to prevent further VoIP abuse.