1. Hacking Exposed: VoIP www.securelogix.com Mark D. Collier Chief Technology Officer mark.collier@securelogix.com

2. Hacking Exposed: VoIP We took on this project because there were no practical books on enterprise VoIP security that gave examples of how hackers attack VoIP deployments and explained to administrators how to defend against these attacks. We spent more than a year of research writing new VoIP security tools, using them to test the latest VoIP products, and scouring VoIP state-of-the-art security. This tutorial is based on material from the book. The book was published December 1, 2006 http://www.hackingvoip.com 536 pages http://www.hackingvoip.com

3. Overview Gathering Information:  Footprinting  Scanning  Enumeration Attacking the Network:  Network Infrastructure Denial of Service  Network Eavesdropping  Network and Application Interception Outline

4. Attacking Vendor Platforms:  Avaya  Cisco Attacking the Application:  Fuzzing  Disruption of Service  Signaling and Media Manipulation Outline

5. Social Attacks:  Voice SPAM/SPIT  Voice Phishing Outline

6. VoIP systems are vulnerable:  Platforms, networks, and applications are vulnerable  VoIP-specific attacks are becoming more common  Security isn ’ t always a consideration during deployment The threat is increasing:  VoIP deployment is growing  Deployments are critical to business operations  Greater integration with the data network  More attack tools being published  The hacking community is taking notice Introduction Introduction

7. Introduction Layers of Security Introduction

8. Internet Connection Internet Voice VLAN Public Voice Network IP PBX Introduction Campus VoIP TDM Trunks TDM Phones IP Phones Data VLAN PCs Introduction

9. Internet Connection Internet Voice VLAN Public Voice Network IP PBX Introduction Public VoIP VoIP Connection TDM Phones IP Phones Data VLAN PCs Introduction

10. This is the process a hacker goes through to gather information about your organization and prepare their attack Consists of:  Footprinting  Scanning  Enumeration Gathering Information

11. Steps taken by a hacker to learn about your enterprise before they start the actual attack Consists of:  Public website research  Google hacking  Using WHOIS and DNS Footprinting Gathering Information Footprinting

12. An enterprise website often contains a lot of information that is useful to a hacker:  Organizational structure and corporate locations  Help and technical support  Job listings  Phone numbers and extensions Public Website Research Introduction Gathering Information Footprinting

13. Public Website Research Organization Structure Gathering Information Footprinting

14. Public Website Research Corporate Locations Gathering Information Footprinting

15. Public Website Research Helpdesk Gathering Information Footprinting

16. Public Website Research Helpdesk

17. Public Website Research Job Listings Job listings can contain a ton of information about the enterprise VoIP system. Here is a portion of an actual job listing: Required Technical Skills: Minimum 3-5 years experience in the management and implementation of Avaya telephone systems/voicemails: * Advanced programming knowledge of the Avaya Communication Servers and voicemails. Gathering Information Footprinting

18. Public Website Research Phone Numbers Google can be used to find all phone numbers on an enterprise web site:  Type: “111..999-1000..9999 site:www.mcgraw-hill.com” Gathering Information Footprinting

19. Public Website Research Voice Mail By calling into some of these numbers, you can listen to the voice mail system and determine the vendor Check out our voice mail hacking database at:  www.hackingvoip.com Gathering Information Footprinting

20. Public Website Research Countermeasures It is difficult to control what is on your enterprise website, but it is a good idea to be aware of what is on it Try to limit amount of detail in job postings Remove technical detail from help desk web pages Gathering Information Footprinting

21. Google is incredibly good at finding details on the web:  Vendor press releases and case studies  Resumes of VoIP personnel  Mailing lists and user group postings  Web-based VoIP logins Google Hacking Introduction Gathering Information Footprinting

22. Vendors and enterprises may post press releases and case studies:  Type: “site:avaya.com case study” or “site:avaya.com company” Users place resumes on the Internet when searching for jobs  Search Monster for resumes for company employees Mailing lists and user group postings:  www.inuaa.org  www.innua.org  forums.cisco.com  forums.digium.com Google Hacking Gathering Information Footprinting

23. Some VoIP phones are accidentally exposed to the Internet Use Google to search for:  Type: inrul:”ccmuser/logon.asp”  Type: inurl:”ccmuser/logon.asp” site:example.com  Type: inurl:”NetworkConfiguration” cisco Google Hacking Web-Based VoIP Logins Gathering Information Footprinting

24. Google Hacking Web-Based VoIP Logins Gathering Information Footprinting

25. Determine what your exposure is Be sure to remove any VoIP phones which are visible to the Internet Disable the web servers on your IP phones There are services that can help you monitor your exposure:  www.cyveilance.com  ww.baytsp.com Google Hacking Countermeasures Gathering Information Footprinting

26. Google Hacking Countermeasures Attacking The Platform Cisco

27. Enterprises depend on DNS to route website visitors and external email WHOIS searches can reveal IP addresses used by an enterprise WHOIS and DNS Introduction Gathering Information Footprinting

28. Use generic names where possible Disable anonymous zone transfers on your DNS servers WHOIS and DNS Countermeasures Gathering Information Footprinting

29. Steps taken by a hacker to identify IP addresses and hosts running VoIP Consists:  Host/device discovery  Port scanning and service discovery  Host/device identification Scanning Introduction Gathering Information Scanning

30. Consists of various techniques used to find hosts:  Ping sweeps  ARP pings  TCP ping scans  SNMP sweeps Host/Device Discovery Gathering Information Scanning

31. Host/Device Discovery Using nmap nmap -O -P0 192.168.1.1-254 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2006-02-20 01:03 CST Interesting ports on 192.168.1.21: (The 1671 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE 23/tcp open telnet MAC Address: 00:0F:34:11:80:45 (Cisco Systems) Device type: VoIP phone Running: Cisco embedded OS details: Cisco IP phone (POS3-04-3-00, PC030301) Interesting ports on 192.168.1.23: (The 1671 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 80/tcp open http MAC Address: 00:15:62:86:BA:3E (Cisco Systems) Device type: VoIP phone|VoIP adapter Running: Cisco embedded OS details: Cisco VoIP Phone 7905/7912 or ATA 186 Analog Telephone Adapter Interesting ports on 192.168.1.24: (The 1671 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 80/tcp open http MAC Address: 00:0E:08:DA:DA:17 (Sipura Technology) Device type: VoIP adapter Running: Sipura embedded OS details: Sipura SPA-841/1000/2000/3000 POTS VoIP gateway Gathering Information Scanning

32. Host/Device Discovery Ports SIP enabled devices will usually respond on UDP/TCP ports 5060 and 5061 SCCP enabled phones (Cisco) responds on UDP/TCP 2000-2001 Sometimes you might see UDP or TCP port 17185 (VXWORKS remote debugging!) Gathering Information Scanning

33. Host/Device Discovery Ping Sweeps Gathering Information Scanning

34. Host/Device Discovery ARP Pings

35. Several tools available:  nmap  hping Host/Device Discovery TCP Ping Scans Gathering Information Scanning

36. Host/Device Discovery SNMP Sweeps Gathering Information Scanning

37. Use firewalls and Intrusion Prevention Systems (IPSs) to block ping and TCP sweeps VLANs can help isolate ARP pings Ping sweeps can be blocked at the perimeter firewall Use secure (SNMPv3) version of SNMP Change SNMP public strings Host/Device Discovery Countermeasures Gathering Information Scanning

38. Consists of various techniques used to find open ports and services on hosts These ports can be targeted later nmap is the most commonly used tool for TCP SYN and UDP scans Port Scanning/Service Discovery Gathering Information Scanning

39. Using non-Internet routable IP addresses will prevent external scans Firewalls and IPSs can detect and possibly block scans VLANs can be used to partition the network to prevent scans from being effective Port Scanning/Service Discovery Countermeasures Gathering Information Scanning

40. After hosts are found and ports identified, the type of device can be determined Classifies host/device by operating system Network stack fingerprinting is a common technique for identifying hosts/devices nmap is commonly used for this purpose Host/Device Identification Gathering Information Scanning

41. Firewalls and IPSs can detect and possibly block scans Disable unnecessary ports and services on hosts Host/Device Identification Countermeasures Gathering Information Scanning

42. Involves testing open ports and services on hosts/devices to gather more information Includes running tools to determine if open services have known vulnerabilities Also involves scanning for VoIP-unique information such as phone numbers Includes gathering information from TFTP servers and SNMP Enumeration Introduction Gathering Information Enumeration

43. Vulnerability Testing Tools Gathering Information Enumeration

44. Vulnerability Testing Tools Gathering Information Enumeration

45. Vulnerability Testing Countermeasures Gathering Information Enumeration The best solution is to upgrade your applications and make sure you continually apply patches Some firewalls and IPSs can detect and mitigate vulnerability scans

46. SIP Enumeration Introduction Gathering Information Enumeration

47. SIP Enumeration Directory Scanning [root@attacker]# nc 192.168.1.104 5060 OPTIONS sip:test@192.168.1.104 SIP/2.0 Via: SIP/2.0/TCP 192.168.1.120;branch=4ivBcVj5ZnPYgb To: alice Content-Length: 0 SIP/2.0 404 Not Found Via: SIP/2.0/TCP 192.168.1.120;branch=4ivBcVj5ZnPYgb;received=192.168.1.103 To: alice sip:test@192.168.1.104>;tag=b27e1a1d33761e85846fc98f5f3a7e58.0503 Server: Sip EXpress router (0.9.6 (i386/linux)) Content-Length: 0 Warning: 392 192.168.1.104:5060 "Noisy feedback tells: pid=29801 req_src_ip=192.168.1.120 req_src_port=32773 in_uri=sip:test@192.168.1.104 out_uri=sip:test@192.168.1.104 via_cnt==1" Gathering Information Enumeration

48. SIP Enumeration Directory Scanning Gathering Information Enumeration

49. SIP Enumeration Automated Directory Scanning Gathering Information Enumeration

50. TFTP Enumeration Introduction Almost all phones we tested use TFTP to download their configuration files The TFTP server is rarely well protected If you know or can guess the name of a configuration or firmware file, you can download it without even specifying a password The files are downloaded in the clear and can be easily sniffed Configuration files have usernames, passwords, IP addresses, etc. in them Gathering Information Enumeration

51. TFTP Enumeration Using TFTPBRUTE [root@attacker]# perl tftpbrute.pl 192.168.1.103 brutefile.txt 100tftpbrute.pl,, V 0.1 TFTP file word database: brutefile.txt TFTP server 192.168.1.103 Max processes 100 Processes are: 1 Processes are: 12 *** Found TFTP server remote filename : sip.cfg *** Found TFTP server remote filename : 46xxsettings.txt Processes are: 13 Processes are: 14 *** Found TFTP server remote filename : sip_4602D02A.txt *** Found TFTP server remote filename : XMLDefault.cnf.xml *** Found TFTP server remote filename : SipDefault.cnf Gathering Information Enumeration

52. TFTP Enumeration Countermeasures Gathering Information Enumeration It is difficult not to use TFTP, since it is so commonly used by VoIP vendors Some vendors offer more secure alternatives Firewalls can be used to restrict access to TFTP servers to valid devices

53. SNMP Enumeration Introduction SNMP is enabled by default on most IP PBXs and IP phones Simple SNMP sweeps will garner lots of useful information If you know the device type, you can use snmpwalk with the appropriate OID You can find the OID using Solarwinds MIB Default “passwords”, called community strings, are common Gathering Information Enumeration

54. SNMP Enumeration Solarwinds Gathering Information Enumeration

55. SNMP Enumeration snmpwalk [root@domain2 ~]# snmpwalk -c public -v 1 192.168.1.53 1.3.6.1.4.1.6889 SNMPv2-SMI::enterprises.6889.2.69.1.1.1.0 = STRING: "Obsolete" SNMPv2-SMI::enterprises.6889.2.69.1.1.2.0 = STRING: "4620D01B" SNMPv2-SMI::enterprises.6889.2.69.1.1.3.0 = STRING: "AvayaCallserver" SNMPv2-SMI::enterprises.6889.2.69.1.1.4.0 = IpAddress: 192.168.1.103 SNMPv2-SMI::enterprises.6889.2.69.1.1.5.0 = INTEGER: 1719 SNMPv2-SMI::enterprises.6889.2.69.1.1.6.0 = STRING: "051612501065" SNMPv2-SMI::enterprises.6889.2.69.1.1.7.0 = STRING: "700316698" SNMPv2-SMI::enterprises.6889.2.69.1.1.8.0 = STRING: "051611403489" SNMPv2-SMI::enterprises.6889.2.69.1.1.9.0 = STRING: "00:04:0D:50:40:B0" SNMPv2-SMI::enterprises.6889.2.69.1.1.10.0 = STRING: "100" SNMPv2-SMI::enterprises.6889.2.69.1.1.11.0 = IpAddress: 192.168.1.53 SNMPv2-SMI::enterprises.6889.2.69.1.1.12.0 = INTEGER: 0 SNMPv2-SMI::enterprises.6889.2.69.1.1.13.0 = INTEGER: 0 SNMPv2-SMI::enterprises.6889.2.69.1.1.14.0 = INTEGER: 0 SNMPv2-SMI::enterprises.6889.2.69.1.1.15.0 = STRING: "192.168.1.1" SNMPv2-SMI::enterprises.6889.2.69.1.1.16.0 = IpAddress: 192.168.1.1 SNMPv2-SMI::enterprises.6889.2.69.1.1.17.0 = IpAddress: 255.255.255.0... SNMPv2-SMI::enterprises.6889.2.69.1.4.8.0 = INTEGER: 20 SNMPv2-SMI::enterprises.6889.2.69.1.4.9.0 = STRING: "503" Gathering Information Enumeration

56. Disable SNMP on any devices where it is not needed Change default public and private community strings Try to use SNMPv3, which supports authentication SNMP Enumeration Countermeasures Gathering Information Enumeration

57. The VoIP network and supporting infrastructure are vulnerable to attacks Most attacks will originate inside the network, once access is gained Attacks include:  Network infrastructure DoS  Network eavesdropping  Network and application interception Attacking The Network

58. Several attack vectors include:  Installing a simple wired hub  Wi-Fi sniffing  Compromising a network node  Compromising a VoIP phone  Compromising a switch  Compromising a proxy, gateway, or PC/softphone  ARP poisoning  Circumventing VLANs Attacking The Network Gaining Access

59. Some techniques for circumventing VLANs:  If MAC filtering is not used, you can disconnect a VoIP phone and connect a PC  Even if MAC filtering is used, you can easily spoof the MAC  Be especially cautious of VoIP phones in public areas (such as lobby phones) Attacking The Network Gaining Access

60. Some other VLAN attacks:  MAC flooding attack  802.1q and ISL tagging attack  Double-encapsulated 802.1q/Nested VLAN attack  Private VLAN attack  Spanning-tree protocol attack  VLAN trunking protocol attack Attacking The Network Gaining Access

61. The VoIP network and supporting infrastructure are vulnerable to attacks VoIP media/audio is particularly susceptible to any DoS attack which introduces latency and jitter Attacks include:  Flooding attacks  Network availability attacks  Supporting infrastructure attacks Network Infrastructure DoS Attacking The Network Network DoS

62. Flooding attacks generate so many packets at a target, that it is overwhelmed and can’t process legitimate requests Flooding Attacks Introduction Attacking The Network Network DoS

63. VoIP is much more sensitive to network issues than traditional data applications like web and email:  Network Latency – amount of time it takes for a packet to travel from the speaker to the listener  Jitter – occurs when the speaker sends packets at constant rates but they arrive at the listener at variable rates  Packet Loss – occurs under heavy load and oversubscription Mean Opinion Score – subjective quality of a conversation measured from 1 (unintelligible) to 5 (very clear) R-value – mathematical measurement from 1 (unintelligible) to 100 (very clear) Flooding Attacks Call Quality Attacking The Network Network DoS

64. Software applications (wireshark, adventnet, Wildpackets, etc.) Hardware Appliances (Aglient, Empirix, Qovia,, etc.) Integrated router and switches (e.g. Cisco QoS Policy Manager) Flooding Attacks Call Quality Attacking The Network Network DoS

65. Some types of floods are:  UDP floods  TCP SYN floods  ICMP and Smurf floods  Worm and virus oversubscription side effect  QoS manipulation  Application flooding Flooding Attacks Types of Floods Attacking The Network Network DoS

66. Layer 2 and 3 QoS mechanisms are commonly used to give priority to VoIP media (and signaling) Use rate limiting in network switches Use anti-DoS/DDoS products Some vendors have DoS support in their products (in newer versions of software) Flooding Attacks Countermeasures Attacking The Network Network DoS

67. This type of attack involves an attacker trying to crash the underlying operating system:  Fuzzing involves sending malformed packets, which exploit a weakness in software  Packet fragmentation  Buffer overflows Network Availability Attacks Attacking The Network Network DoS

68. A network IPS is an inline device that detects and blocks attacks Some firewalls also offer this capability Host based IPS software also provides this capability Network Availability Attacks Countermeasures Attacking The Network Network DoS

69. VoIP systems rely heavily on supporting services such as DHCP, DNS, TFTP, etc. DHCP exhaustion is an example, where a hacker uses up all the IP addresses, denying service to VoIP phones DNS cache poisoning involves tricking a DNS server into using a fake DNS response Supporting Infrastructure Attacks Attacking The Network Network DoS

70. Configure DHCP servers not to lease addresses to unknown MAC addresses DNS servers should be configured to analyze info from non-authoritative servers and dropping any response not related to queries Supporting Infrastructure Attacks Countermeasures Attacking The Network Network DoS

71. VoIP signaling, media, and configuration files are vulnerable to eavesdropping Attacks include:  TFTP configuration file sniffing  Number harvesting and call pattern tracking  Conversation eavesdropping Network Eavesdropping Introduction Attacking The Network Eavesdropping

72. TFTP files are transmitted in the clear and can be sniffed One easy way is to connect a hub to a VoIP phone, reboot it, and capture the file By sniffing signaling, it is possible to build a directory of numbers and track calling patterns voipong automates the process of logging all calls TFTP/Numbers/Call Patterns Attacking The Network Eavesdropping

73. Conversation Recording Wireshark Attacking The Network Eavesdropping

74. Conversation Recording Wireshark

75. Attacking The Network Eavesdropping Conversation Recording Cain And Abel

76. Other tools include:  vomit  Voipong  voipcrack (not public)  DTMF decoder Conversation Recording Other Tools Attacking The Network Eavesdropping

77. Place the TFTP server on the same VLAN as the VoIP phones and use a firewall to ensure that only VoIP phones communicate with it Use encryption:  Many vendors offer encryption for signaling  Use the Transport Layer Security (TLS) for signaling  Many vendors offer encryption for media  Use Secure Real-time Transport Protocol (SRTP)  Use ZRTP  Use proprietary encryption if you have to Network Eavesdropping Countermeasures Attacking The Network Eavesdropping

78. The VoIP network is vulnerable to Man-In-The-Middle (MITM) attacks, allowing:  Eavesdropping on the conversation  Causing a DoS condition  Altering the conversation by omitting, replaying, or inserting media  Redirecting calls Attacks include:  Network-level interception  Application-level interception Network/Application Interception Introduction Attacking The Network Net/App Interception

79. The most common network-level MITM attack is ARP poisoning Involves tricking a host into thinking the MAC address of the attacker is the intended address There are a number of tools available to support ARP poisoning:  Cain and Abel  ettercap  Dsniff  hunt Network Interception ARP Poisoning Attacking The Network Net/App Interception

80. Network Interception ARP Poisoning Attacking The Network Net/App Interception

81. Network Interception ARP Poisoning Attacking The Network Net/App Interception

82. Network Interception ARP Poisoning Attacking The Network Net/App Interception

83. Network Interception Countermeasures Attacking The Network Net/App Interception Some countermeasures for ARP poisoning are:  Static OS mappings  Switch port security  Proper use of VLANs  Signaling encryption/authentication  ARP poisoning detection tools, such as arpwatch

84. Application Interception Introduction Attacking The Network Net/App Interception It is also possible to perform a MITM attack at the application layer Some possible ways to perform this attack include:  Registration hijacking  Redirection attacks  VoIP phone reconfiguration  Inserting a bridge via physical network access

85. User Attacker Proxy Attacker Places Themselves Between Proxies Or Proxy/UA Application Interception Attacking The Network Net/App Interception

86. Application Interception Countermeasures Attacking The Network Net/App Interception Some countermeasures to application-level interception are:  Use VLANs for separation  Use TCP/IP  Use signaling encryption/authentication (such as TLS)  Enable authentication for requests  Deploy SIP firewalls to protect SIP proxies from attacks

87. This section describes unique attacks against specific VoIP vendor platforms, including:  Avaya  Cisco Attacking The Platform

88. The Avaya Communication Manager is Avaya’s enterprise- class offering Offers strong security, but some default configuration should be changed Avaya uses Linux and VxWorks as the underlying operating system on many components, which is arguably more secure than Windows Avaya Communication Manager Attacking The Platform Avaya

89. Avaya Communication Manager Attacking The Platform Avaya

90. Open Ports Attacking The Platform Avaya

91. Open Ports Attacking The Platform Avaya

92. Open Ports Attacking The Platform Avaya

93. Open Ports Attacking The Platform Avaya

94. Open Ports Attacking The Platform Avaya

95. Open Ports Attacking The Platform Avaya

96. Open Ports Countermeasures Attacking The Platform Avaya

97. Open Ports Countermeasures Attacking The Platform Avaya

98. SNMP and TFTP Attacking The Platform Avaya Avaya uses TFTP and SNMP In 3.0, SNMP is enabled by default on the IP PBX and IP phones Some components ship with default public and private community strings

99. SNMP and TFTP Countermeasures Attacking The Platform Avaya Use the same countermeasures as before Avaya provides a secure copy feature as an alternative to TFTP Communication Manager 4.0 disables SNMP by default Version 2.6 for IP phones does not ship with default community strings

100. Flooding Attacks Attacking The Platform Avaya We used udpflood and tcpsynflood to perform DoS attacks against various components Unfortunately, these attacks were very disruptive

101. Flooding Attacks Countermeasures Attacking The Platform Avaya Use the same countermeasures as before Avaya C-LAN cards provide some level of DoS mitigation Newer IP phone software provides better DoS mitigation http://support.avaya.com/security

102. Miscellaneous Security Issues Attacking The Platform Avaya Avaya signaling and media are vulnerable to eavesdropping Avaya uses some default passwords on key IP PBX components Password recommendations for IP phones are weak By default, Avaya IP phones can be reconfigured when booted

103. Miscellaneous Security Issues Countermeasures Attacking The Platform Avaya Avaya supports proprietary encryption for signaling and media. SRTP will be supported in Communication Manager 4.0 Default passwords should be changed to strong values Local access to the IP phone can be controlled with a password

104. The Cisco Unified Call Manager is Cisco’s enterprise class offering Offers strong security, but requires some configuration Version 4.1 is based on Windows. Version 5.0 is based on Linux A Must Read Document is the Solution Reference Network Design (SRND) for Voice communications. (http://tinyurl.com/gd5r4).http://tinyurl.com/gd5r4 Includes great deployment scenarios and security use cases (lobby phone, desktop phone, call manager encryption how-to, etc.) Cisco Unified Call Manager Attacking The Platform Avaya

105. Cisco Introduction Attacking The Platform Cisco

106. Cisco Discovery Protocol – Cisco’s proprietary layer 2 network management protocol. Contains juicy information that is broadcast on the entire segment – Disable it! Cisco Discovery Protocol Attacking The Platform Cisco

107. Cisco Unified Call Manager requires a large number of open ports Port Scanning Attacking The Platform Cisco

108. Cisco IOS has a great feature called “autosecure” that”  disables a slew of services (finger, http, ICMP, source routing, etc.)  enables some services (password encryption, TCP synwait-time, logging, etc.).  And locks down the router and switch (enables only ssh, blocks private address blocks from traversing, enables netflow, etc.) Port Scanning Countermeasures Attacking The Platform Cisco

109. Network Flooding Countermeasures:  Another great feature from Cisco is AutoQos, a new IOS feature ( auto qos command).  Enables Quality of Service for VoIP traffic across every Cisco router and switch  Scavenger class QoS also a relatively new Cisco strategy – rate shape all bursty non-VoIP traffic Flooding Countermeasures Attacking The Platform Cisco

110. Patch Management is key – use the Cisco Voice Technology Group Subscription Tool (http://www.cisco.com/cgi- bin/Software/Newsbuilder/Builder/VOICE.cgi) DoS and OS Exploitation Countermeasures Attacking The Platform Cisco

111. Eavesdropping and Interception Countermeasures:  Enable port security on Cisco Switches to help mitigate ARP Spoofing  Enable Dynamic ARP inspection to thwart ARP Spoofing  Dynamically restrict Ethernet port access with 802.1x port authentication  Enable DHCP Snooping to prevent DHCP Spoofing  Configure IP source guard on Switches Eavesdropping and Interception Countermeasures Attacking The Platform Cisco

112. Eavesdropping and Interception Countermeasures:  Configure VTP Transparent Mode  Change the default Native VLAN Value to thwart VLAN hopping  Disable Dynamic Trunk Protocol (DTP) to thwart VLAN Hopping Eavesdropping and Interception Countermeasures Attacking The Platform Cisco

113. Eavesdropping and Interception Countermeasures:  Activate authentication and encryption of the signaling and media streams  Skinny over TLS  SRTP  Requires creating and distributing certificates on phones Attacking The Platform Cisco Eavesdropping and Interception Countermeasures

114. VoIP systems are vulnerable to application attacks against the various VoIP protocols Attacks include:  Fuzzing attacks  Flood-based DoS  Signaling and media manipulation Attacking The Application

115. Fuzzing describes attacks where malformed packets are sent to a VoIP system in an attempt to crash it Research has shown that VoIP systems, especially those employing SIP, are vulnerable to fuzzing attacks There are many public domain tools available for fuzzing:  Protos suite  Asteroid  Fuzzy Packet  NastySIP  Scapy Fuzzing Introduction Attacking The Application Fuzzing  SipBomber  SFTF  SIP Proxy  SIPp  SIPsak

116. INVITE sip:6713@192.168.26.180:6060;user=phone SIP/2.0 Via: SIP/2.0/UDP 192.168.22.36:6060 From: UserAgent To: 6713 Call-ID: 96561418925909@192.168.22.36 Cseq: 1 INVITE Subject: VovidaINVITE Contact: Content-Type: application/sdp Content-Length: 168 Attacking The Application Fuzzing Fuzzing Example

117. INVITE sip:6713@192.168.26.180:6060;user=phone SIP/2.0 Via: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaa… From: UserAgent To: 6713 Call-ID: 96561418925909@192.168.22.36 Cseq: 1 INVITE Subject: VovidaINVITE Contact: Content-Type: application/sdp Content-Length: 168 Attacking The Application Fuzzing Fuzzing Example

118. There are many public domain tools available for fuzzing:  Protos suite  Asteroid  Fuzzy Packet  NastySIP  Scapy Fuzzing Public Domain Tools Attacking The Application Fuzzing  SipBomber  SFTF  SIP Proxy  SIPp  SIPsak

119. There are some commercial tools available:  Beyond Security BeStorm  Codenomicon  MuSecurity Mu-4000 Security Analyzer  Security Innovation Hydra  Sipera Systems LAVA tools Fuzzing Commercial Tools Attacking The Application Fuzzing

120. Make sure your vendor has tested their systems for fuzzing attacks Consider running your own tests An VoIP-aware IPS can monitor for and block fuzzing attacks Fuzzing Countermeasures Attacking The Application Fuzzing

121. Describes an attack where a flood of packets overwhelms a target, such as a SIP proxy or phone Attacking The Application Flood-Based DoS Flood-Based DoS Introduction

122. Several tools are available to generate floods at the application layer:  rtpflood – generates a flood of RTP packets  inviteflood – generates a flood of SIP INVITE packets  SiVuS – a tool which a GUI that enables a variety of flood- based attacks Virtually every device we tested was susceptible to these attacks Attacking The Application Flood-Based DoS Flood-Based DoS

123. Attacking The Application Flood-Based DoS Flood-Based DoS SiVuS

124. There are several countermeasures you can use for flood- based DoS:  Use VLANs to separate networks  Use TCP and TLS for SIP connections  Use rate limiting in switches  Enable authentication for requests  Use SIP firewalls/IPSs to monitor and block attacks Flood-Based DoS Countermeasures Attacking The Application Flood-Based DoS

125. In SIP and RTP, there are a number of attacks possible, which exploit the protocol:  Registration removal/addition  Registration hijacking  Redirection attacks  Session teardown  SIP phone reboot  RTP insertion/mixing Attacking The Application Sig/Media Manipulation Signaling/Media Manipulation Introduction

126. Proxy User Proxy Attacker User Attacker Erases Or Adds Bogus Registrations, Causing Calls to be Dropped Or Sent to the Wrong Address Registration Removal/Addition Attacking The Application Sig/Media Manipulation

127. Proxy User Proxy Attacker Hijacked Media Hijacked Session User Registration Hijacking Attacking The Application Sig/Media Manipulation

128. Registration Hijacking Attacking The Application Sig/Media Manipulation

129. Inbound Calls Are Redirected Attacker Proxy User Attacker Sends “301/302 – Moved” Message User Redirection Attacks Attacking The Application Sig/Media Manipulation

130. Attacker Sends BYE Messages To UAs Attacker Proxy User Session Teardown Attacking The Application Sig/Media Manipulation

131. Attacker Sends check-sync Messages To UA Attacker Proxy User IP Phone Reboot Attacking The Application Sig/Media Manipulation

132. Attacker Sees Packets And Inserts/Mixes In New Audio Attacker Proxy User Audio Insertion/Mixing Attacking The Application Sig/Media Manipulation

133. Some countermeasures for signaling and media manipulation include:  Use digest authentication where possible  Use TCP and TLS where possible  Use SIP-aware firewalls/IPSs to monitor for and block attacks  Use audio encryption to prevent RTP injection/mixing Attacking The Application Sig/Media Manipulation Signaling/Media Manipulation Countermeasures

134. There are a couple of evolving social threats that will affect enterprises:  Voice SPAM or SPAM over Internet Telephony (SPIT)  Voice phishing Social Attacks

135. Voice SPAM refers to bulk, automatically generated, unsolicited phone calls Similar to telemarketing, but occurring at the frequency of email SPAM Not an issue yet, but will become prevalent when:  The network makes it very inexpensive or free to generate calls  Attackers have access to VoIP networks that allow generation of a large number of calls It is easy to set up a voice SPAM operation, using Asterisk, tools like “spitter”, and free VoIP access Voice SPAM Introduction Social Attacks Voice SPAM

136. Voice SPAM has the potential to be very disruptive because:  Voice calls tend to interrupt a user more than email  Calls arrive in realtime and the content can’t be analyzed to determine it is voice SPAM  Even calls saved to voice mail must be converted from audio to text, which is an imperfect process  There isn’t any capability in the protocols that looks like it will address Voice SPAM Voice SPAM Social Attacks Voice SPAM

137. Some potential countermeasures for voice SPAM are:  Authenticated identity movements, which may help to identify callers  Legal measures Enterprise voice SPAM filters:  Black lists/white lists  Approval systems  Audio content filtering  Turing tests Voice SPAM Countermeasures Social Attacks Voice SPAM

138. VoIP Phishing Introduction Similar to email phishing, but with a phone number delivered though email or voice When the victim dials the number, the recording requests entry of personal information The hacker comes back later and retrieves the touch tones or other information Social Attacks Phishing

139. VoIP Phishing Example “Hi, this is Bob from Bank of America calling. Sorry I missed you. If you could give us a call back at 1-866-555-1324 we have an urgent issue to discuss with you about your bank account.” Hello. This is Bank of America. So we may best serve you, please enter your account number followed by your PIN. Social Attacks Phishing

140. VoIP Phishing Example Social Attacks Phishing

141. VoIP Phishing Countermeasures Traditional email spam/phishing countermeasures come in to play here. Educating users is a key Social Attacks Phishing

142. Questions?

143. Notes…