Jean Piaget and Lev Vygotskys Theories on Cognitive Development

Jean Piaget and Lev Vygotskys Theories on Cognitive Development According to Meece (2002), Piaget and Vygotsky were two prominent scholars of cognitive development theories. Piaget was a biology, psychology and philosophy scholar while Vygotsky first received a degree in law, then a degree in psychology. Even with two very different backgrounds, both scholars took a constructivist approach to their research in cognitive development as they believed, children must construct their own understandings of the world in which they live (p. 121). This idea has been debated and discussed for years. Piaget and Vygotsky were two prominent scholars within the realm of cognitive development. Their theories of cognitive development have been influential in the development of theories of education. In Jean Piagets research, his main goal was to answer the question, How does knowledge grow? (Silverthorn, 1999). He did this through genetic epistemology which is the study of cognitive development in children. According to Meece (2002), there are four major cognitive stages in a childs cognitive development: sensorimotor, preoperations, concrete operations and formal operations. A childs thought process is different from other developmental stages and each of the stages has its own importance. Piaget believed that a child could not skip a stage because each one is necessary in the process of cognitive development. In accordance with Meece (2002) and funderstanding.com (2006) the four stages are described as such: Sensorimotor stage (birth 2 years old)The child, through physical interaction with his or her environment, builds a set of concepts about reality and how it works. This is the stage where a child does not know that physical objects remain in existence even when out of sight (object permanence). Preoperational stage (ages 2-7)The child is not yet able to conceptualize abstractly and needs concrete physical situations. Concrete operations (ages 7-11)As physical experience accumulates, the child starts to conceptualize, creating logical structures that explain his or her physical experiences. Abstract problem solving is also possible at this stage. For example, arithmetic equations can be solved with numbers, not just with objects. Formal operations (beginning at ages 11-15)By this point, the childs cognitive structures are like those of an adult and include conceptual reasoning. (p. 1) In Piagets research, these four stages are rather concrete. But, many current researchers do not completely agree with the exactitude and universality of these stages. Piaget also refers to three different types of knowledge. Physical knowledge is knowing the attributes of objects such as their number, color, size and shape (Meece, 2002, p. 122). Logio-mathematical knowledge involves the mental construction of relationships (p. 122). Social knowledge is derived in part through interactions with others (p. 123). Piaget focused on classification and relations, spatial relationships, time, movement, chance, number, conservation and measurement in concrete stages (Genetic Epistemology, 2006). Lev Vygotsky was more concerned with how a child interacts with his culture and society (Meece, 2002). Piaget viewed knowledge as individually constructed while Vygotsky viewed cognitive development as socially co-constructed between people as they interact (p. 155). Vygotsky believed that children are born with elementary mental abilities such as perception, attention and memory (Meece, p. 156). As children develop and interact socially with their culture and society, these innate characteristics are further developed. According to Vygotsky, one of the most important parts of cognitive development is language. Within this theory, language occurs in three stages: social speech, egocentric speech and inner speech. Social speech is just that: speech for the purposes of communicating. Egocentric speech is more intellectual and children use this by speaking out loud to themselves. Inner speech is used by children to think in their heads about the problem or task at hand, instead of verbalizing their thoughts in order to decide what to do next. According to the website funderstanding.com, the zone of proximal development explains that, a difference exists between what [a] child can do on [his or] her own and what the child can do with help [from knowledgeable peers or adults] (p. 1). For example, a young child may not be able to put together a complex puzzle by himself, but with the help of an older child or another adult, the young child could put together the puzzle correctly. Both Piagets and Vygotskys theories of cognitive development provide foundations for constructivist approaches to teaching and learning (Meece, 2002). Each of their theories concern qualitative changes within a childs cognitive process. They also have the same goal within the classroom, creating for students a community of learning. Even though both theories have a common goal, each of them has a different approach when dealing with children and education. For instance, Piagets theory can help educators understand how children react and learn according to their age while Vygotskys theory can help understand the role of society in childrens education. Piaget was a scholar of natural science who happened to discover a way to explain how children acquire knowledge as they develop in age. Piagets theory can be directly related to his traditional background as he tries to explain the major transformations that children go through while acquiring knowledge. Piaget strongly believed that each age group varied significantly not only in the individual and group aspect, but also in the cultural aspect as well. The stages that he created are the following: Sensorimotor, Preoperations, Concrete Operations, and Formal Operations. All of these stages are met when children manipulate objects. This manipulation allows the creation of mental representation of the world and it allows two-way interaction with the environment. Essentially, the goal is to allow a child the ability to create and understand his world in a logical way. All of these stages result from the childrens manipulation of objects that lets them create a mental representation of the world and act on and influence the environment they live in (and vice versa), so that learners gradually forego illogical ways of thinking. Piagets theory is about including spontaneous experimentation in a single and group basis, so that students can build their own understanding based on the experiences that they have. By setting up this system, the children are not only limited to the classroom setting, but they are more alert of their surroundings. This method leads them to learn about self-correction, self-instruction, and self-motivation because of its hand on experience approach. According to Piaget, the growth of knowledge is a progressive construction. Childrens logic and modes of thinking are initially entirely different from those of adults (Jean Piaget Society, 2006), believing that the acquisition of knowledge is a process of continuous self-construction (Silverthorn, 1999). In order to adopt the cognitive development following Piagets theory, the educator should organize the class time with spontaneous mental activities to let learners develop their own ideas and to construct a healthy learning environment. To achieve this, Piaget encourages teachers to provide a role for social interaction and communication by presenting appropriate materials, drills, so that children can actively learn how to confront their physical and social world by living their own experiences. According to Marcy Driscoll (1994), there are three basic instructional principles on which Piagetian theorists generally agree: Principle 1: The learning environment should support the activity of the child (i.e., an active, discovery-oriented environment) Principle 2: Childrens interactions with their peers are an important source of cognitive development (i.e., peer teaching and social negotiation) (Driscoll, 1994). Principle 3: Adopt instructional strategies that make children aware of conflicts and inconsistencies in their thinking (i.e., conflict teaching and Socratic dialog) All of these principles are meant to be used in such a way that children can relate and continue to build upon previously acquired knowledge. It is important and necessary that teachers play the role of facilitators and encourage dialog among students about things that they have discovered themselves, so that learning become an automatic and enjoyable process. Piaget has inspired major curriculum reforms, some of his major contributions to education are (Meece, 2002): Knowledge must be actively constructed by the child. Educators should help children learn how to learn. Learning activities should be matched to the childs level of conceptual development. Peer interactions play an important role in the childs cognitive development (p. 169). Although this method seems beneficial, the financial cost and time-consumption that is involved during the set-up cause this method to be less influential. When compared with Piagets theory, Vygotskys theory places a stronger emphasis on social interactions. According to Vygotsky, knowledge is not individually constructed, but co -constructed between people. For Vygotsky, language and communication play the most important role of cognitive development his primary concern dealing with nature, evaluation and the transmission of human culture. Vygotsky identified three stages in childrens use of language: Language is primarily used for communication (social speech). Children begin to use egocentric or private speech to regulate their own thinking. Children use inner speech or verbal thoughts to guide their thinking and actions. For Piagets theory, language did not play such an important role in childrens development; however for Vygotskys theory speech is an extremely important developmental phenomenon as he believed that children learn through conversations with adults as the need to communicate with them presses the child to seek for the adult meanings of things that are said (Mason Timothy, 2006). So learning becomes a result of mature thinking and behavior due to socio-cultural experiences. For instance, Vygotsky encourages collaborative process of learning between teachers and students in the going of social events in the classroom. Vygotskys term Zone of Proximal Development (ZPD) was used to refer the difference between what children can do on their own, and what they could do with the assistance of others (Meece, 2002). The ZPD indicates what a childs level of mental development is at a particular time (Galant, 2006). Vygotsky assumed that interactions with adults and peers in the zone of proximal development help children move to higher levels of mental functioning (Meece, 2002). Vygotsky believed that interactions with adults and peers in this zone helped children move to higher levels of mental functioning within the classroom. Vygotskys approach challenges traditional teaching methods, as he emphasizes the significance of cooperative thinking that take place in the decision making process. This involves having students paired together or in small groups in which the teachers task is to focus on maintaining students motivation in order to pursue the instructional goal. Vygotskys theory is about guided discovery by having the teacher offer, intriguing questions to students and having them discover the answers through testing hypotheses. The students are engaged in the discovery process; however, they are still receiving assistance from a more knowledgeable source (Sample, 2006). According to Meece (2002), some of the major Educational Contributions of Vygotskys theories are: Role of private speech in cognitive development. The importance of guided participation and scaffolding. The role of peer interactions in cognitive development (p. 159-161). This method is helpful because it encourages constant peer review. However, if not handled properly, it can bring up a common problem that students and teachers frequently face. This disadvantage would be when groups rely on one member to do all the work. Meece (2002) explains that Piagets cognitive development theory is based on a childs innate ability to productively think on their own. This cognitive ability allows them to move to the next cognitive stage as they mature biologically and adapt to their environment. Children assimilate and accommodate their current schema, or mental constructs, to fit the new information presented in the classroom. Cognitive development and social interaction feeds intellectual activity and learning. The classroom methods of instruction should match the level of cognitive development, facilitating the advancement to the next stage of cognitive development. The level of cognitive development for early childhood learners (2-7 years) is described by Piaget as the preoperational stage (Meece, 2002). At this stage intuition and language develop. Examples of instructional tools Piaget would recommend to describe objects they are experiencing include: concrete props, symbols, and visual aids such as drawings, usage of models or examples, lessons about the childrens world and their experiences, less paper-and-pencil tasks and more hands on learning, back-and-forth conversations with peers to develop skills for the next stage, and field trips. According to Piaget, logical and mental operations are part of the cognitive development of children in the elementary school years (7-11 years). A childs thinking becomes less rigid and more dynamic during this stage. Piaget called this stage the concrete operations stage (Meece, 2002). Huitt (1997) mentions these instructional tools that follow this theory: concrete props such as three dimensional science models, lab work with minimal steps, brief and well organized lectures, relate existing instruction into previously learned material, word problems in math, and problems which require logic and analysis to solve. The Math Forum at Drexel University (2006) explained math education using a Piagetian theory: Students need to construct their own understanding of each mathematical concept, so that the primary role of teaching is not to lecture, explain, or otherwise attempt to transfer mathematical knowledge, but to create situations for students that will foster their making the necessary mental constructions. A critical aspect of the approach is a decomposition of each mathematical concept into developmental steps following a Piagetian theory of knowledge based on observation of, and interviews with, students as they attempt to learn a concept (para.1). Piagets final stage in his theory of cognitive development covers the 12 year old and up group. This stage is called the formal operations stage. Huitt Hummel (2003) describe this stage as characterized by a shift in thinking from the real to the involvement of abstractions and reflections. In this stage, intelligence is demonstrated through the logical use of symbols related to abstract concepts. Early in the period there is a return to egocentric thought. Only 35% of high school graduates in industrialized countries obtain formal operations; many people do not think formally during adulthood (page 1). Huitt (1997) suggests classroom practices such as these to best use Piagets theory: concrete operations stage type graphs on a more complicated scale, ask students to explore hypotheticals as they explore other worlds or complicated issues, encourage students to describe opposing viewpoints, have students describe how the solved the problem, teach broad but curriculum related concept s, and use materials and ideas relevant to the students to broaden their perspectives. Meece (2002) explains that Vygotsky did not believe an individuals thinking structure as innate, but cultural and social in origin and influence. Social and cultural interactions with knowledgeable peers and adults fuel cognitive development while improving the elementary thinking skills of the child (perception, attention, memory) to a higher level. Vygotsky might suggest Reciprocal Teaching in the classroom. This involves guided participation by a knowledgeable adult; with the students eventually taking over the learning activity. Egocentric speech was favored by Vygotsky. This is the thinking aloud speech children sometimes use to work through a problem. Vygotsky would not only encourage students to use this speech, but would demonstrate its use in practical settings. Collaborative learning activities would also be emphasized in the Vygotsky classroom. Learning is facilitated with meaningful discussions among students in a collaborative learning setting. Especially valuable are discussions with knowledgeable peers. Knowledgeable peers and teachers elevate a student beyond the students current capabilities, a place the student would not have achieved otherwise. It is absolutely possible to incorporate parts of both Piaget and Vygotskys theories in the classroom. Both theorists take a constructivist point of view and also believe that students are not passive in their knowledge (Meece, 2002). It is important for the teacher to be important organizers, stimulators, guides, and supporters of learning (p. 168). Piagets theory suggests that students need a curriculum that supports their cognitive development by learning concepts and logical steps. He also suggests that children are only capable of learning specific material in specific stages of cognitive development. Vygotsky would suggest more peer and cultural interactions in the classroom (funderstanding.com, 2006). He also believes that knowledgeable adults can help children learn even if they are not at the specific stage as Piaget suggests (Meece 2002). It is possible that while children are learning about concepts and logic, they can also interact with their peers and other adults by wor king on projects that relate the two together. It seems as though children may show some signs of specific development at specific times, but with help they can also excel at tasks they may not be able to do without help of others. Piaget and Vygotsky have differing views on cognitive development, but it is possible to incorporate parts of both theories when thinking about teaching strategies. Teachers must take into consideration the social and cultural background of the student before preparing the lesson plan. Using Piagets theory, the student must be at the correct stage of development in order use and understand the knowledge at hand. But, Vygotsky says that even if the child is not at the correct stage of development then a knowledgeable adult or teacher could influence the child and help him get to a level beyond what his level would otherwise indicate.

Volleyball Expectations

My expectations from the team this year are to be good teammates for one another and everyone on the team. This looks like welcoming, encouraging, and helping each other during workouts, practice, and games. It doesn't mean that everyone has to be best friends, but Just that the players treat each other as our motto: â€Å"It's a team thing†. My expectations from the coaching staff this year are to watch and correct individual mistakes and not to let bad habits go unnoticed. I like how the coaches will focus on what we are doing and talk to us about how to fix anything.The personal attention for everyone helps us all to become better players. Skill wise, I bring to the table for this team that I am able to get a good pass to the setter, can play serve receive, and I have a Jump serve. I focus on back row because it all starts with a pass. In terms of attitude and leadership, I bring to the table for this team a positive attitude. If a teammate gets discouraged about what they' re doing, I want to encourage them to play the next ball and not worry about their mistakes.For adhering, when we are out on the court and come together in the middle to talk, I tell the girls that what we need to focus on or add motivation to finish a game. At this time, I perceive my strengths are that I am a fast learner and work at correcting my mistakes after instruction. I feel that my weaknesses are that I haven't learned all of the plays. For example, I'm most comfortable with hitting a 4 as an outside, and although Vive been introduced to other hits I'm not as familiar with them.I see my ole on the team this year as an all-around volleyball player. My role is to be a more efficient hitter/blocker, play defense, and go after every ball as hard as I can. I am to keep the ball in play no matter what. My individual short term goal for the next week at practice is to work on my hitting. I need to get more power and load up on my step-close so I can Jump higher. I also need to ti me my approach better to the ball (depending on its tempo) because at practice I was either too early or too late.My worth term goal for our team for the next week at practice is to talk more on the court, because it was pretty much silent last time. We only really talked after coach pointed it out. And even then, we didn't keep it up. Also, to call for the ball as loud as we can when hitting so the setter can hear us. A lot of confusion can be avoided this way. My individual long term goal for this season is to be able to become a better-rounded volleyball player. I want to improve on my hitting?I am off on my timing and don't get low on my step-close to Jump higher.Also, I want to be more accurate on hitting certain areas on the court. I want to be able to set and pass more on target as well, especially on out of system. My long term goal for our team this season is to be a team that other schools don't want to play because of both our consistency on defense and offense. I want ou r team to dig up balls that has the other side wondering how we were able to manage to get the ball up and hitting the ball so hard that the other players are hesitant to go after it. Volleyball Expectations

What Duty of Care Means in Children’s and Young People’s Settings

1, What duty of care means in children's and young people's settings. Duty of care in children's and young peoples setting means the adults providing care have to ensure the child is kept safe from any form of harm or abuse. This can include giving full attention, watching for hazards, accidents and mistakes and following correct procedures. Also ensuring the child is the most important part of your day. 2, How the duty of care contributes to the safeguarding or protection of individuals.The duty of care contributes to safeguarding by ensuring the child is happy, healthy and safe whilst in your care. This can be done by undertaking thorougher risk assessments and procedures/precautions to avoid accidents, mistakes and hazards such as making sure all equipment is clean and not broken, children are supervised at all time by staff who have the relevant checks and health standards are maintained when preparing food and changing nappies.Giving children attention and observing their behavi or also contributes to safeguarding as you will be better placed to notice any needs the child has as they develop. Task C 1, The main points of agreed procedures for handling complaints in children and young people's settings Listen to complaint Record complaint in writing including all details and facts Speak to manager Ensure person complaining knows a time frame for complaint to be investigated and dealt with Manager will then speak to relevant people, investigate and report back to complainant , How would you respond to a complaint. I would listen carefully and respectfully to the complaint, if appropriate (depending on the nature of the complaint) I would ask other members of staff if they can offer an insight as to what happened, then refer it to my manager. If the manager was not available I would take a written account of all the details/facts and contact the manager who would then investigate and report back to me and the complainant. If the complaint was a staff on staff complaint I would refer it straight to my manager.

VoIP Security Service - Free Essay Example

Sample details Pages: 20 Words: 5948 Downloads: 4 Date added: 2017/06/26 Category Statistics Essay Did you like this example? Chapter 4 VoIP Security Issues Don’t waste time! Our writers will create an original "VoIP Security Service" essay for you Create order 4.1 Denial-of-Service (DoS) in VoIP Purpose: The purpose of VoIP DoS attack is to exhaust network resources and interrupt VoIP operations through a flood of messages or by corrupting or degrading the quality of messages, thus preventing subscribers from effectively using the service. Situation: We must consider different scenario when studying DoS attacks: In a typical situation of establishing a VoIP connection for voice conversation where end systems or/and gateway are targets. At first place subscribers try to establish a voice call conversation over a VoIP channel. VoIP services should be available to subscribers when requested. In order to manage the Media gateways deployed across the communications, some VoIP systems use control protocols (e.g. MGCP and Megaco/H.248) and security mechanism. VoIP secure gateways (VoIP-SGW) are developed in advance to make IP telephony protocols friendly for common firewall configuration. In order to meet the unflawed communication level, a VoIP system must be having enough capability (i.e. routing, bandwidth, and QoS) that provide the VoIP system a high level proficiency of communication across the infrastructure. A secure VoIP system implements an intrusion detection system (IDS), firewall on the phone itself to check the media packet flow, or perform authentication. But at least a minimum set of defenses that filter unwelcome packets, for example a firewall, must be deployed. Problem: IP telephony subscribers need to be blocked from using VoIP services. The attack can be carried out taking advantage of the following vulnerabilities: VoIP security is in an initial phase at the moment, there is lack of expertise and security standards. Users might unintentionally expose the system. While there exist some basic countermeasures such as IDS and firewalls, administrator may not configure them appropriately Older firewalls cannot work interactively with VoIP and may leave open many more ports than VoIP actually uses for a transmission, leaving your machine vulnerable to hackers. Unit now VoIP has been developed and deployed focusing on functionality with less thought for security [SAV01]. That means that not vary advanced defenses are in place. For example, strong authentication is not common in VoIP. VoIP is vulnerable to DoS attacks which have not previously been a security issue with the circuit-switched telephony systems because of its analog nature. With the rush to implement new VoIP systems, features and standards, implementation flaws are common. IP PBXs include many layers of software that may contain vulnerabilities. Programming mistakes, such as not properly checking the size of the parameters of protocol request, when exploited, can result in the following issues. [VVS01] Remote access: An attacker obtaining remote (often administrator level) access. Malformed request DoS: A carefully crafted protocol request (a packet) exploiting a vulnerability which results in a partial or complete loss of function. Load-based DoS: A flood of legitimate requests overwhelming a system. As with any network-base service, enterprise VoIP must communicate with other components on a LAN and possibly over an untrusted network such as the internet, where packets are easy to intercept. Because RTP carries media, which must be delivered in real-time to be usable for an acceptable conversation, VoIP is vulnerable to DoS attacks that impact the quality delivery of audio such as those that affect jitter and delay. VoIP tools can offer very good cover traffic for DoS attacks because VoIP runs continuous media over IP packets [CRN01] Solution: Two basic standards are used for VoIP systems: H.323 and SIP. We consider here an attack in an H.232 environment. The SIP attack can be considered a variant of this pattern or a separate pattern. Likewise, specific Dos attacks against gateways will be analyzed from the supporting Megaco/H.248 protocol viewpoint. Figure 5.1 shows the class diagram of the structure of an H.323 system. The Layer 2 Switch provides connectivity between H.323 components. The Gateway takes a voice call from a circuit-switched Public Switched Telephone Network (PSTN) and places it on the IP network. The PSTN uses PBX switches and Analog Phones. The internet (IP network) contains Routers and Firewalls to filter traffic to the Terminal Devices. The gateway also queries the Gatekeeper via the Internet with caller/callee numbers and the gatekeeper translates them into routing numbers based upon service logic. The IP-PBX server acts like a call-processing manager providing call setup and routing the calls throughout the network to other voice devices. Softphones are applications installed in Terminal Devices (e.g. PCs or wireless devices). One method to launch a DoS attack is to flood a server with repeated requests for legal service in an attempt to overload it. This may cause severe degradation or complete unavailability of the voice service. A flooding attack can also be launched against IP phones and Gateways (e.g. a flood of register or invite events). With this form of DoS attacks, the target system is so busy processing packets from the attack that it will be unable to process legitimate packets, which will either be ignored or processed so slowly that the VoIP service is unusable. Attackers can also use the TCP SYN Flood attack (also known as resource starvation attack) to obtain similar results. This attack floods the port with synchronization packets, normally used to start a connection. In a Distributed DoS, multiple systems are used to generate a massive flood of packets. To launch a massive DDoS attack the hacker previously installs malicious software on compromised terminal devices (infected with a Trojan horse) that can be triggered at a later time (a.k.a. zombies) to send fake traffic to targeted VoIP components. Targeted DoS attacks are also possible where the attacker disrupts specific connections. The class diagram of Figure 5.2 shows the structure for a DDoS attack in an H.323 architecture where any VoIP component can be a target for Dos. Classes Attack Control Mechanism and Zombie describe the software introduced by the attacker. Note that the Zombie is just a terminal device in a different role. The sequence diagram of Figure 5.3 shows the sequence of steps necessary to perform an instance of a DoS attack of the first type mentioned above. An attacker (internal or remote), with knowledge of a valid user name on a VoIP system, could generate enough call requests to over-whelm the IP-PBX server. An attacker may disrupt a subscribers call attempt by sending specially crafted messages to his/her ISP server or IP PBX component, causing it to over allocate resources such that the caller receives a service not available (busy tone) message. This is an example of a targeted attack. Similarly, out-of-sequence voice packets (such as receiving media packets before a session is accepted) or a very large phone number could open the way to Application Layer attacks (a.k.a. Attacks against Network Services). Buffer Overflow attacks might paralyze a VoIP number using repeated calling. For example, an attacker intermittently sends garbage (I.e. both the header and the payload are filled with random bytes corrupting the Callees jitter buffer voice packets) to the callees phone in between those of the callers voice packets. Therefore the Callees phone is so busy trying to process the increased packet flow that the jitter (delay variation) causes any conversation to be incomprehensible [MDPV01] Figure 5.4 shows the class diagram of the structure of a Megaco/H.248 environment. Megaco/H.248 is the media gateway control protocol, this is a master-slave, transaction oriented protocol in which Media Gateway Controllers (MGC) control the operation of Media Gateways (MG) [VVDN02] VoIP media gateways are vulnerable to DoS because they accept signaling messages. In this setting a Dos attack would occur at MGC when the attacker sends large amount of UDP packets to the protocols default port 2944 or 2945, which keeps the MGC busy handling illegal messages, and finally blocks the normal service. An attacker can keep sending Service change or Audit capabilities command to a MG and thereby bring down the MG [SVID01]. Therefore, VoIP Gateways will not be able to initiate calls or maintain a voice call during a DoS attack. The audio quality will be affected as well. An alternative to launch DoS attacks is when an attacker redirects media sessions to a media gateway. The attack will overwhelm the voice component and prevent it from processing legitimate requests. Signaling DoS attacks on media gateways con consume all available Time Division Multiplexing (TDM) bandwidth, preventing other outbound and inbound calls and affecting other sites that use TDM, On the other hand, due to the fact that VoIP media session are very sensitive to latency and jitter, DoS on media is a serious problem. VoIP media, which is normally carried with RTP, is vulnerable to any attack that congests the network or slows the ability of an end device (phone or gateway) to process the packets in real time. An attacker with access to the portion of the network where media is present simply needs to inject large numbers of either RTP packets or high QoS packets, which will contend with the legitimate RTP packets [VVS01]. Consequences: The success of this attack implies: DoS can be especially damaging if key voice resources are targeted (e.g; media gateways). Flooding of the firewall can prevent it from properly managing parts for legitimate calls VoIP QoS can be degraded by jitter and delay and may become totally unusable. The Zombies in the targeted network can also be used as DoS launching points from which to attack anther network Possible sources of failure include: Threats and attacks can be defined but are difficult to carry out in practice, mainly due to lack of knowledge and testing opportunities for attackers. 4.2 Call Interception in VoIP: Purpose: The VoIP call interception pattern provides a way of monitoring voive packets of RTCP transmissions. This kind of attack is the equivalent of wiretapping in circuit switch telephone system. Context: Two or more subscribers are participating in a voice call conversation over VoIP channel, In public IP network such as the Internet, anyone can capture the packets meant for another user. In order to achieve confidentiality, enterprises may use encryption and decryption techniques when making or receiving VoIP calls. Since cryptographic algorithms are typically implemented in hardware, they are difficult to implement in VoIP, which is software-base. In VoIP network, transport-protocol based threats rely on a non-encrypted RTP stream [VIS03]. On the other hand, enterprises may route voice traffic over a private network using either point-to-point connections or a carrier-based IP VPN service. Two basic standards are used for VoIP systems: H323 and SIP. We consider here an attack in an H323 environment. The SIP attack can be considered a variant of this pattern or a separate pattern. Problem: A call that traverses in converged network needs to be intercepted. The attack can be carried out talking advantage of the following vulnerabilities. The Real Time Protocol (RTP) is not a complete protocol but rather a framework where vendors are provided implementation freedom according to their specific application profiles [VIS03]. This means that specific implementations may have diverse degrees of security. In RTP, information on the used codec is available in the header of every RTP packet, via the PT header field [VIS03] PC-based IP phones (a.k.a. Softphones) are applications installed on user systems (e.g. desktops) with speakers and microphones that reside in the data segment. It is possible for worms, viruses and other malicious software common on PCs to infect the voice segment in VoIP. In wireless VoIP (i.e. VoIPoW), publicly available software can be used to crack Wired Equivalent Privacy (WEP) products. As VoIP in a wireless environment operates on a converged (voice, data, and video) network, voice and video packets are subject to the same threats than those associated with data networks. Likewise, all the vulnerabilities that exist in a VoIP wired network apply to VoIPoW technologies plus the new risks introduced by weaknesses in wireless protocols. The tools used for call interception purpose can be downloaded freely on the internet, greatly increasing the potential of this type of attack. VoIP security is in an incipient phase at the moment, there is lack of expertise and security standards. Users might inadvertently expose the system. While there exist some basic countermeasures such as IDS and firewalls, administrators may not configure them appropriately. Unit now VoIP has been developed and deployed focusing on functionality with less thought for security [SAV01]. That means that not very advanced defenses are in place. For example, strong authentication is not common in VoIP. Because of the many nodes in packet network, call interception can be applied in many places. The transfer of voice data over public networks (i.e. the internet), facilitates the possibility of attacks on this technology. It is much easier to hack VoIP network hubs than traditional phone switches. Although hackers cannot intercept voice calls, they can have access to packets traversing the converged network. Anyone can record, duplicate and distribute to unintended parties voice calls over IP. IP Phones have become available for software developers. The increase in features and complexity comes however with a security cost: more application equal more avenues of attack [VST04]. VoIP is vulnerable to call interception attacks which have not previously been a security issue with circuit-switched networks where tapping requires physical access to the system. Therefore tapping is a serious concern in IP telephony when compared with the traditional telephony environment. Solution: VoIP Call interception gives attackers the ability to listen and record private phone conversation by interception both the signaling and the media stream. The attacker is also able to modify the content of the packets being intercepted acting as a man in the middle. In principle this threat affects both the signaling and the data depending on the ability of attacker of intercepting both [VST04]. Due to the fact that voice travels in packets over the data network, hackers can use data-sniffing and other hacking tools to identify, modify, store and play back unprotected voice communications traversing the network, thus violating confidentiality. A packet sniffer is a software application that users a network adapter card in promiscuous mode (a mode in which the network adapter card sends all packets received in the physical network wire to an application for processing) to capture all network packets that are sent across a particular collision domain. This packet sniffer application can reside in a general-purpose computer attached, for example, in a local area network [Fer05]. For example, the tool voice over misconfigured Internet telephones (a.k.a. vomit), takes an IP phone conversation trace captured by the UNIX tool tepdump, and reassembles it into a wave file which makes listening easy [DSCN01, SATT03] using MP3 or alternative audio files. The reassembled files can be co llected later, emailed or otherwise sent on the eavesdropper. Figure 5.5 shows the sequence of the steps necessary to monitor a VoIP conversation. Figure 5.5 Sequence diagram for a call interception With tepdump, hackers can identify the IP and MAC address of the phone to be attacked. By using an Address Resolution Protocol (ARP) spoofing tool, the attacker could impersonate the local gateway and the IP phone on the network, creating a default gateway [DSCN01]. This allows RTP streams to and from the target IP phone to be monitored by the attacker. The communication between the Gateway and Gatekeeper is equally vulnerable to call interception using the same techniques described for terminal devices. The RTP streams can be intercepted between the IP end-stations or between the Gateways and Gatekeeper (IP Trunk) [SATT03]. Likewise, the FragRouter tool would have to be enabled on the attacking machine so the data packets would reach their ultimate destination. If the hacker has access to the local switched segment, he may be able to intercept a call by inserting a phone into the voice segment with a spoofed Media Access Control (MAC) address, and assuming the target phones identity. Consequences The success of this attack implies: It is possible to listen in on a conversation by intercepting the unencrypted media stream between the two terminal devices. Attackers may use telephone systems for divulging crucial information such as Social Security numbers, Credit Card numbers or other confidential information. Inside a company, eavesdropping could allow access to confidential business information. Hackers could capture the packets and decode their voice packet payload between two or more VoIP terminal devices. Due to the fact that voice travels in packets over the data network, hackers can use data-sniffing and other hacking tools to identify, modify, store and play back unprotected voice communications traversing the network, thus violating confidentiality and integrity. A hacker breaking into a VoIP trunk has access to many more calls than he would with traditional telephone tapping. Consequently, he has a much greater opportunity of obtaining useful information from tapping a VoIP data stream than from monitoring traditional phone systems. Call interception attacks result in the attacker being able to use the intercepted data for other malicious intents, such as: call pattern tracking, number harvesting, and conversation reconstruction [VST04]. The interception and modification threat results in the attacker being able to modify the packets for malicious actions, examples are: Call blackholing the attacker intentionally drops essential packets (e.g. INVITE) of the VoIP protocol resulting the call initiation to fail; Call rerouting the attacker redirects the packets on a different path in order to include unauthorized nodes in the path or to exclude authorized ones from it; Conversation alteration the attacker alters the packets in order to modify the conversation between two users; Conversation degrading the attacker intentionally drops a selection of packets or modify the content of them with the objective of degrading the overall quality of the conversation [VST04]. Possible sources of failure include: Call Interception is somewhat limited because it would require physical access to the local network or remote access to a compromised host on the local network. Intercepting voice traffic as it crosses the Internet is more difficult because once the packetized voice hits the carrier; it becomes much harder to single out among other traffic. It is more difficult to intercept calls on VoIP networks than capturing and reading text messages on public networks. 4.3 Theft of Service in VoIP Intent The Theft of Service pattern provides an opportunity for attackers to gain access to the VoIP network by imitating subscribers and/or seizing control of terminal devices and performing free calls. Situation: The VoIP system should have adequate capability (i.e. routing, bandwidth, and QoS) to meet the peak communication load. The system may have a minimum set of perimeter defenses, e.g. a firewall. Some VoIP systems use control protocols (e.g. MGCP and Megaco/H.248) and security mechanisms, in order to manage the Media gateways deployed across the infrastructure as well as to make it difficult for an attacker to overcome system resources. In a converged network both the signaling and media traffic must be monitored. Similarly, secure VoIP implementations use cryptographic algorithms to protect the media packets. Theft of service attack (a.k.a. IP telephony fraud) is intended against service providers. Problem An unauthorized user wants to make expensive phone calls without paying for them. The attack can be carried out taking advantage of the following vulnerabilities: Theft of service attacks may be caused by inadequate security mechanisms in VoIP, the insertion of malicious software that modifies the normal behavior of terminal devices, and the unauthorized connection of devices to the network. It is possible to charge calls to another users account by using stolen user identification details. Phone usage and billing systems can be manipulated by fraudulent telephone users in order to make profit. The benefits of portability and accessibility introduced by IP Telephony have a downside of an increased risk of service theft [SATT03]. When using Hoteling, the primary protection against theft of service in the traditional telephony environment, the physical security of the handset, is no longer enough [SATT03]. Unattended IP telephone. Rogue telephones can be installed. MAC addresses are easy to spoof. Solution: This attack could be accomplished using several techniques. An attacker may just simply want to place calls using an unattended IP phone or assuming the identity of the legitimate user of a terminal device. The attacker uses the identity of the owner (i.e. identity theft) without the owners consent. She then charges the call to the owners account. A more complex method is when the attacker places a rogue IP phone on the network or uses a breached VoIP gateway to make fraudulent calls. In a service volume fraud, the attacker injects in the network more traffic than what declared in the session request in order to avoid paying for the used resources [VST04].Theft of service can also be perpetrated using falsified authentication credentials. A number of IP Telephony vendors authenticate their end points via Ethernet media access control addresses (MACs). MAC addresses are notoriously easy to spoof [SATT03]. An attacker might impersonate as an IP Telephony signaling server and request an end-device to perform authentication before dealing with its call request. Using the endpoints IP Telephony network credentials the malicious party will be able to authenticate to any IP Telephony based server as well as to place free of charge phone calls. Figure 7 shows the sequence of the steps necessary to commit theft of service in VoIP (Figure 1 shows the units involved). First, the attacker uses a brute force attack to find the special prefixes that Internet phone companies use to identify authorized calls to be routed over their networks. The attacker then looks for vulnerable ports and routers in private companies and gets their IP addresses. On finding vulnerable ports, she hacks into the network to get administrator names and passwords. The attacker then reprograms the routers to allow them to handle VoIP calls, and to masquerade the true source of the traffic. The attacker then routes her calls to the targeted network via the routers she has hacked, and then sends the calls from the targeted network to Internet phone service providers. She may also attach the access codes to the calls, so that the Internet phone providers believe they are legitimate calls. Finally, unauthorized calls will go through successfully and will be completed over the Internet phone provider networks. Sequence diagram for theft of service attack Another method of attack is by receiving an application in a spam email, or accidentally downloaded from the Internet. This application can direct the phone to call premium rate numbers by installing itself on a softphone (i.e. applications installed on user systems with speakers and microphones). Finally, the reduction in costs for Moves, Adds, and Changes (MAC) in an IP Telephony environment has led to the addition of daemons/services on many vendors IP Telephones. Some of the more popular services include HTTP, SNMP, and Telnet [SATT03]. Attackers may take advantage of the benefits of portability and accessibility introduced by VoIP to perform theft of service. Hoteling is one of the most popular features of VoIP, it consist of moving all the features, including address book, access abilities and personalized speed dial from one phone to another [SATT03]. When using Hoteling, the physical security of the IP phone is no longer enough. Consequences: The success of this attack implies: In order to make expensive calls to premium rate numbers, rogue devices could be attached to an organizations network without the users knowledge. Weaknesses in wireless security policies could also be exploited by rogue devices. Unauthorized phone calls will seem to originate from subscribers inside the attacked VoIP network. Attackers could also steal minutes from VoIP service providers and resell them on the black market. Attackers will be able to register for unauthorized services taking advantage of the virtual communication paths in IP networks. In IP telephony, premium rate numbers will be dialed automatically. Possible sources of failure include: Threats and attacks can be defined and theorized but are difficult to carry out in practice, mainly due to the lack of knowledge and testing opportunities for attackers. 4.4 Call Hijacking in VoIP Purpose: The Call hijacking attack pattern is intended to direct a participant or participants of a VoIP call to a terminal device other than the intended recipient. The hacker is able to trick a remote user into believing one is talking to his/her intended recipient when in fact one is really talking to the hacker. Situation: Two or more call participants exchanging information (signaling information and the packetized voice) between them. This call related information is exposed to a number of possible attacks when traversing public IP networks such as the Internet. Problem: A Call traversing a converged network needs to be redirected to an unintended recipient. This attack can be carried out taking advantage of the following vulnerabilities: SIP messages have no built-in means to insure integrity. SIP does offer limited built-in security. SIP is a technology still in development; it does not provide security built in capabilities. This protocol does not support integrity of the message contents. Sniffing tools are more effective when using SIP, which is text-based protocol. Registration in SIP is normally performed using UDP, which makes it easier to proof requests. Authentication is often not required and if present, its usually weak [BVIS01]. When authentication in SIP is used, it is not strong. Failed registrations are not always logged. SIP proxies will not normally detect directory scanning and registration hijacking attempts [BVIS01]. Since the data packets do not flow over a dedicated connection for the duration of a session, an adversary could manipulate the routing of packets and cause delay in certain paths forcing the packets to take a path chosen by the adversary. [ITVP01]. The signaling messages are sent in the clear, which allows an attacker to collect, modify and replay them as they wish. Attackers who successfully perform Call Interception attacks can compromise wireless networks with improperly configured access points. Solution: Although VoIP is implemented using various signaling protocols, we consider here an attack in an SIP environment. The H.323 attack can be considered a variant of this pattern or separate pattern. In a SIP environment, a proxy server is used to initiate calls on behalf of endpoints and control call routing. The proxy server also performs security functions such as authentication, authorization and network access control. Figure 5.8 shows the components for a SIP-based network, User Agents (UAs), are combinations of User Agent Client (UAC) and User Agent Servers (UAS). The UA is the phone and the register server receives registrations and requests updates to the location server, which keep track of the UAs. A UAC is responsible for initiating a call by sending a URL-addressed INVITE to the intended recipient. A UAS receives requests and sends back responses. The UAC and UAS are identified by SIP addresses. The proxy server is connected to VoIP gateway (to make possible a call from a regular telephone to an IP phone) and to other proxy servers. The registrar and location server may be integrated in the proxy server. The rest of the VoIP architecture is similar to Figure 5.1 and represented by a UML package. Once the call has been established, the RTP media streams ow between the end stations directly. Call Hijacking in VoIP requires breaking into a converged network and interception packets being sent between two or more subscribers participating in voice call conversation (please refer to Call Interception attack pattern). After the IP address or phone number of either party is discovered, malicious users can user this information to hijack the call. This attack is achieved by impersonating a legitimate UA to a SIP register substituting a legitimate IP address with an attacker IP address. The attacker then manipulates the registration associated with the victims SIP URI [VIS03]. In this way, by manipulating outgoing call requests, the attacker is able to substitute a legitimate IP address (of either party) in the header (e.g. the Form header of a SIP request) of the intercepted packet with her own address. The hijacking attack can be also be done by performing a DoS attack against the users device deregistering the user. Generating a registration race-condition in which the attacker sends repeatedly REGISTER requests in a shorter timeframe (such as ever 15 seconds) in order to override the legitimate users registration request [TAAC01]. The class diagram of Figure 5.9 shows the structure for a VoIP Call Hijacking attack in SIP architecture. The sequence diagram of Figure 5.10 shows the sequence of steps necessary to perform this type of attack. The hijack begins with the attacker sending a specially crafted REGISTER request to the target proxy/register, to unbind all existing registrations. If the server requires authentication, it replies to the REGISTER requests with a challenge. Once all legitimate contacts have been deleted, the attacker sends a second REGISTER message containing new Contact header line with the attackers address [BVIS01]. Registration hijacking can also be performed by intercepting and editing REGISTER requests sent between a valid UA and registrar. This attack is possible, but is less of concern than the attack described above [BVIS01].Likewise; the attacker can spoof a SIP response, indicating to the caller that the called party has moved to a rogue SIP address, and hijack the call. Consequences: The success of this attack implies: This attack causes all the victims calls to be received by the attacker or other unauthorized parties. Call hijacking can result in violation of confidentiality to the legitimate endpoint. By performing call hijack in VoIP, an attacker has complete control (i.e. manipulating, blocking, conferencing, and recording) of the call and has access to all SIP messages. The attackers station can also capture authentication or other call related information. Likewise it can masquerade as a voice mail system opening a channel to the attacker. By hijacking the call, the attacker can also perform a Man-In-The-Middle (MITM) attack, where it transparently sits between the calling and called UAs, able to collect and modify both the signaling and media. Another type of MITM attack involves redirection of an inbound call to a media gateway, generation toll fraud [BVIS01]. This attack can be successful even if the remote SIP proxy server requires authentication of user registration, because the SIP messages are transmitted in the clear and can be captured, modified and replayed. Through call hijacking, the attacker can perform various attacks including theft of service in VoIP or message tampering. It will also enhance the DoS vulnerability which will make the users device useless. When this attack is applied to a VoIP network, the Quality of Service (QoS) may be diminished to a noticeable level [ITVP01]. Possible sources of failure include: Successful attacks require that the fake responses coming from the attacker station contains the right header content to be accepted as legitimate. Some fields are especially hard to estimate or intercept and thus mirror [VIS03]. 4.5 IP Spoofing in VoIP Purpose: The VoIP Spoofing pattern is intended to allow hackers (internal or external), to masquerade a legitimate terminal device. Situation: Two or more subscribers are participating in a voice call conversation over a VoIP cannel that may be intercepted. In public IP networks such as the Internet, anyone can capture the packets meant for another user. Problem: An attacker needs to trick a remote user into believing one is talking to his/her intended recipient when in fact they are really talking to the hacker. The attack can be carried out taking advantage of the following vulnerabilities: VoIP devices such as IP phones, Gatekeepers, gateways and Proxy servers inherit the same vulnerabilities of the operation system or firmware [VS05] on top of which they run. Many SIP implementations still user the Universal Datagram Protocol (UDP) for transporting SIP messages, which is an unreliable form of packet transfer. UDP does not use re-transmission or sequence numbers, so it is easier for an attacker to spoof UDP packets [BVIS01]. Attackers may take advantage of the connectionless nature of the UDP protocol to spoof registration requests. Solution: IP spoofing gives attackers the ability to generate an IP packet with an IP source address other than its own. There are two methods of doing this. The hacker can use either an IP address that is within the range of trusted IP addresses for a network or an authorized external trusted IP address that has access to specified resources on a network. With user identification based in the IP layer and the IP layer easily tampered with, it is easy for unauthorized users to impersonate legitimate ones by marking packets sent over these networks with a borrowed IP address. These abuses of services and benefits (e.g. making international calls) occur at the expense of legitimate users, who are often completely unsuspecting until the bill arrives long after the abuser has disappeared [FA01]. IP spoofing is possible because the routing of VoIP packets is based only on the destination address. Due to the fact that that touting mechanism is not based on source addresses, when the packet is delivered to its destination address, the attacker address is that of source and not of the original sender. An IP Softphone can spoof the functionality and appearance of an IP hardphone to the call processing platform. Using tools such as SMAC (Spoof MAC) witch allows users to change MAC address for almost any Network Interface Cards (NIC) on the Windows 2000 and XP systems, the IP softphone can be configured quite easily to assume the full functionality and rights of any extension given only the MAC address of that extension [SATT03]. Some voice mail systems use Caller ID to authenticate administrative access to individual voice mail accounts. IF the Caller ID of an inbound call matches the number assigned to the telephone associated with the voice mailbox, the system assumes that the call is originating from that phone, and call is routed to the voice mailbox with administrative privileges. Caller ID can be readily spoofed using freely available PBX software and a H.323/VoIP gateway service, and possibly via other methods. Caller ID should not be trusted for authentication. [VMS06] Consequence: The success of this attack implies: Attackers can hide their identity for launching DoS attacks. Call hijacking and theft of service can also be accomplished using IP spoofing. When using this attack pattern, malicious users can bypass authentication and filtering in order to cause information leak, data modification, and arbitrary code execution. Without spoof mitigation filter a hacker might be able to spoof the address of the IP-PBX and UDP flood the entire voice segment [FA01]. Attackers will obtain access to sensitive logging data and routing information form subscribers; even if they are not capable of interception VoIP calls. IP spoofing attacks against VoIPoW networks makes other type of attacks possible. Attackers can establish itself as routing node and perform call interception for example. By using IP spoofing, attackers can take advantage of trust relationships based on the caller IP address. IP spoofing can also be used to gain important VoIP logging information in order to modify a call session. When spoofing weak authenticated voicemail systems, attackers can listen to and deleted messages, modify the greeting, and perform other administrative functions [VMS06]. Possible sources of failure include: The Transmission Control Protocol (TCP) is a connection oriented. Guaranteed-delivery transport. TCP is more secure than UDP, because it involves a negotiated setup and tear down, sequence numbers, and retransmissions for lost packets [BVIS01]. Successful attacks require that the forged responses coming from the attacker machines contains the right header content to be accepted as legitimate. Some header fields are especially hard to estimate or intercept and thus mirror [VIS03].