atcomsystems.ca/forum Forums VOIP Phones & IP PBX VoIP & Cloud Phones, Hosted PBX, General IP Phones I wish I had it in writing

So I have been sick all week and went to the doctor today. The practice I go to is part of one of the largest hospitals in the city. Naturally, someone high up makes decisions, and every building has to go with it. Yep, you guessed it. CISCO PHONES! So of course, I had to ask 'how do you like your phones?'
The nurses and doctors said they can't stand them, they don't work write, can't figure them out...
Even though I have bronchitis, it made me smile
Thank you Cisco!

I kind of suspect that the people who install these don't really know or care about what it takes to get them working right (yeah, I can hear everyone saying "no $!it Sherlock")

Now if only those people at the top (who probably have well-maintained TDM systems and say "upgrade us last...") would see it that way...

As long as I'm dreaming, I'd like to have world peace, a house in the country, with free Internet...

Jeff, there is another reason I find doctors AND lawyers suspect. How much work do you think YOU'D get if your company was called Moss Communications PRACTICE?
I would prefer to NOT be the subject of 'practice'! Doctors, according to the media 'outlets',(toilet drains, but that's another story for another time) need all the 'practice' they can get, so they'll do 'it' correctly when it's my turn! John C. (Not Garand)

I used to work at one of the local hospitals, one day I passed a doctor in the hallway and said hi doc. He proceded to lecture me about all the hard work and years in school that nobody was going to call him a place where one parks boats, I told him ok.

After that day I said,
HI DOC,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,tor

Its fits the old saying "nobody gets fired recommending IBM". Thats what Cisco has turn into, people actually recommend Cisco because they feel they are the largest and the safest choice.

I am not an expert about this nor am I a Cisco defender. But, does it depend on how the system was setup or is it really a poor solution period?
We are a Nortel dealer and some people can't stand the Norstar because some tech installed it wrong.

It's a poor solution to begin with, intolerable by legacy standards. If you add the typical installation it becomes useless.

-Hal

I was back at the doctor yesterday (still sick).
I heard those damn Cisco ringers and wanted to throw up
They can't even make it ring like a normal phone. It just sort of beeps.

Set up wrong? Perhaps but I don't think so...Look at the last paragraph of the Cisco notice of how to defeat unintended eavesdropping....really. How many speakerphones/headsets have we had to disable on other products?


Security Flaw Opens Cisco VoIP Phones To Eavesdropping

By Jennifer Hagendorf Follett, CMP Channel
2:54 PM EST Thu. Nov. 29, 2007

Cisco Systems has confirmed a security vulnerability discovered in its VoIP phones that enables attackers to eavesdrop on voice calls.

The San Jose, Calif.-based vendor issued a security alert Wednesday that identified 11 models of its Cisco Unified IP Phone 7900 Series handsets that are vulnerable to the attack. All Cisco IP phones that support Extension Mobility, a feature that allows users to log into a phone and configure it as their own on a temporary basis, are vulnerable, the company said.

Cisco classified the alert as a low-level risk with a base score of 4.0 on the Common Vulnerability Scoring System. No updates are available, though Cisco identified several workarounds to combat the problem.

Cisco's security alert came in response to a presentation given at the Hack.Lu 2007 security conference by researcher Joffrey[STET] Czarny, a penetration tester for the security research division of Telindus, a Belgium-based systems integrator.

An attacker with valid Extension Mobility authentication credentials could use a properly configured Cisco IP phone to eavesdrop on ongoing conversations around the affected device, a breach that could lead to the disclosure of sensitive information, according to the alert.

For attackers to exploit the vulnerability, the internal Web server of the IP phone must be enabled, which is a default setting. The IP phone must also be configured to use the Extension Mobility feature, which is not a default setting. In addition, the attacker must have valid Extension Mobility authentication credentials. An attacker could procure authentication credentials by gaining physical access to the network and inserting a sniffing device between an IP phone and switch port, according to the alert.

Phones would exhibit visual queues if they were being exploited by the vulnerability, including illuminated speakerphone buttons and an off-hook indication on their LCD displays.

Cisco identified three workarounds to ward off attack, including disabling the internal Web server on IP phones, disabling the Extension Mobility feature and disabling the speakerphone/headset functionality on IP phones. The vendor also said the attack can be mitigated by restricting access to the internal Web server of IP phones (TCP port 80) using an access control list.

Lovely, just lovely. I will be in contact with several key (lost) customers tomorrow morning for sure. It never ceases to amaze me the level of crap that people will tolerate in order to "keep up with the Jones".