The traditional technical surveillance countermeasures (TSCM) telephony approach has been disrupted by the advent of VoIP instruments and infrastructure. How does an investigator examine an instrument that is both susceptible to traditional, telephony based attack vectors and also vulnerable to new, cutting edge, IP based network vulnerabilities? What measurements need to be made at the physical layer and what programming needs to be validated in the application layer? How does one begin to understand an instrument that is a fully capable computer, network switch, web server, and voice transmission device?
The purpose of this course is to provide a framework by which the technical investigator can develop a comprehensive plan for examining VoIP instrumentation, servers, and infrastructure. Students will analyze ethernet traffic, VoIP instrument programming, IP PBX programming, VoIP instrument hardware, and physical infrastructure in order to determine the difference between a normal and compromised state. Through exercises, labs, and challenges this class hones an investigator’s judgment to perform the critical analysis needed to overcome the adversary’s arsenal of attacks.