My Journey With Mr.SIP Pro:From Hobby Project To Leading VoIP Security Testing Framework

Ismail Iş, a senior security consultant at Synopsys with over 15 years of experience in banking and telecom security, presents the evolution of Mr.SIP Pro—a VoIP security testing framework that began as a hobby project for academic research and has grown into a professional tool used by security researchers, network administrators, and penetration testers worldwide. The presentation traces the framework's development from its 2010 inception through open-source release in 2017 to its current state as a comprehensive VoIP security testing platform.

Project History: Mr.SIP Pro originated in 2010 as a personal research project while the speaker worked at Natasha, a Turkish cybersecurity firm. The initial project won an innovation competition and secured approximately 2 million euros in research funding, leading to the establishment of a cybersecurity department that grew from one to 100 engineers within three years. The tool remained closed-source and was used by Turkish government entities until 2015. After the company discontinued the project, the speaker reprogrammed the framework in 2016 and released the first open-source version in 2017. Since then, Mr.SIP Pro has been presented at major conferences including Black Hat (USA, EU, Asia), DEF CON, and Arsenal events, and has been featured in academic papers and journals.

VoIP Security Context: The presentation emphasizes VoIP security's critical importance, citing approximately 28.2 billion dollars in annual telecom fraud losses (1.74% of total telecom revenues). Common vulnerabilities include attacks against VoIP users and PBX systems, with telephony denial-of-service and caller ID spoofing as primary threats. Legacy SIP protocols were not designed with modern security requirements in mind, and many organizations struggle to manage VoIP security adequately.

Core Capabilities: Mr.SIP Pro comprises information gathering modules (network scanner, enumerator, sniffer, call eavesdropper), vulnerability assessment modules (configuration scanner reporting misconfigurations), and offensive modules including denial-of-service simulator, password cracking tools targeting SIP digest authentication, signaling manipulator enabling caller ID spoofing, attack scenario player executing complex attacks including DDoS, RTP modules supporting eavesdropping and DTMF tone recording, and robocalling capabilities. Auxiliary tools include RFC-compliant message generators and IP address generation engines to bypass filtering.

Applications: The framework serves penetration testing, VoIP security product testing (performance, load, robustness), proof-of-concept and quality assurance for security products, and academic research. Testing methodology involves identifying SIP servers, enumerating users, testing registration hijacking, attempting authentication attacks, manipulating signaling, and launching denial-of-service attacks using virtual testing environments.

Takeaways: Mr.SIP Pro addresses a market gap for VoIP-specific security testing tools. The speaker emphasizes that success in security work requires dedication, continuous learning, and passion. The framework's evolution from academic hobby to professional tool demonstrates the potential impact of focused security research on the industry.