Over the years, VoIP equipment and software have been of great interest in the market. Cisco Systems (News - Alert), Inc., for example, is one such provider of voice and unified communications for business corporations and consumers alike. Up until now, Cisco has transformed the way people do business by manufacturing several unified IP phones, which deliver voice over IP (VoIP)-related communication services over wired Ethernet or wireless Wi-Fi.

Opposed to a traditional phone, VoIP offers unified messaging, advanced communication features and media conferencing with data and video as well. VoIP comes handy to reduce communication and infrastructure costs. It supports voice calls, call routing and voicemail on an internal or packet-switched network; Cisco relies on a Session Initiation Protocol (News - Alert) (SIP) connection to provide Internet voice connectivity and exchange of communication.

Indeed, VoIP phones have become popular over the years, but they are not all that reliable for secure voice communications; although software is protected by strong encryption to avoid attacks and exploitation by hackers or eavesdroppers, explains Ang Cui, Columbia Engineering's Computer Science PhD candidate, who agrees with Salvatore Stolfo, a Computer Science Professor at Columbia University, who says that all VoIP phones – even Cisco VoIP phones – are able to reveal users’ private communications.

Just as any other Internet-connected device, IP telephony equipment like Cisco VoIP phones are also vulnerable to online risks, like ARP (Address Resolution Protocol) spoofing attacks. As a result, it may cause someone else to gain access and eavesdrop into VoIP communications.

Cui and Stolfo, who recently analyzed Cisco VoIP phones' firmware, discovered several vulnerabilities with the Unified IP Phones in the 7900 series running a version of Cisco IP Phone (News - Alert) software up to and including 9.3.1-ES10. Last month, a presentation (available on YouTube) by Cui at the Chaos Computer Conference in Hamburg spoke of this exploitation on Cisco VoIP phones.

Even though the Cisco Unified Communications (News - Alert) Manager provides certificate authentication and Public Key Infrastructure (PKI), both computer scientists say that to protect exploitation of user credentials, which are vulnerable to theft by an attacker able to penetrate an organization's network, Symbiote, a host-based root-kit injection detection mechanism, could be used to monitor gaps within the firmware to proactively protect and safeguard all kinds of embedded system attacks that can occur with Cisco’s voice-over-IP phones that go on the Internet.

Cisco has, however, released a patch that addresses the vulnerability in its VoIP phones, but it did not fix the problem to deter an attacker to eavesdrop on conversations without a user knowing he/she is being monitored, according to the computer scientists’ report. In fact, they claim the patch was ineffective.

As a result, Cisco’s A-Team is currently working on mitigations and a permanent patch to correct it once and for all. In the meantime, a security advisory describing the vulnerability – as a failure to properly validate certain system calls where it is possible for an attacker to overtake portions of the kernel and control the device – will soon be issued to affected users, said a Cisco’s spokesman.