McAfee Labs released a very interesting white paper about VoIP vulnerability trends and targets, and about protocol- and application-level attacks.
They first observed an increase in VoIP vulnerabilities during the end of 2006 and that trend has continued through today.
They credit part of this increase to better tools for finding VoIP vulnerabilities, yet this upward trend should be largely attributed to the growing number of VoIP installations.
Protocol-level attacks
Eavesdropping
Eavesdropping attacks can occur because the media transport protocol that carries the conversation lacks encryption in many default configurations. This is the case when using RTP as the media transport layer. For a superior solution, you should use secure RTP (SRTP), which provides both encryption and authentication.
Read more here.
