Methodology for Studying the Level of Network Security of an IP PBX Server

This paper presents a methodology for studying the level of network security of VoIP platforms. The methodology is designed for VoIP platforms where the voice and video traffic passes through and are processed by the VoIP server itself, rather than being exchanged directly between the end devices. The proposed methodology consists of four stages: scanning for open ports; scanning for well-known vulnerabilities; penetration testing; and finally, analysis and recommendations (if necessary). Well-known tools used for monitoring IP networks were used to implement the methodology: Namp, Wireshark, hping3, and Colasoft Capsa Free. The studied VoIP platforms were VitalPBX and Issabel, which are based on the Asterisk FreePBX platform. The penetration tests included attacking VitalPBX and Issabel with TCP and UDP DoS attacks. The penetration tests were carried out and implemented using the GNS3 IP network modeling platform. This study found that Issabel has many more unnecessarily open ports than VitalPBX; on both platforms, DoS attacks are likely to be unsuccessful, which was confirmed by the experimental studies carried out. The applicability of the proposed methodology was confirmed by the study carried out.