VOIP WARS: THE PHREAKERS AWAKEN

Fatih Ozavci – @fozavci
Managing Consultant – Context Information Security Fatih Ozavci, Managing Consultant
 VoIP & phreaking
 Mobile applications and devices
 Network infrastructure
 CPE, hardware and IoT hacking
 Author of Viproy and VoIP Wars Public speaker and trainer
 Blackhat, Defcon, HITB, AusCert, Troopers

2 UC and IMS fundamentals
 Security issues and vulnerabilities Practical attacks
 Securing communication services

Fundamentals

DesignVulnerabilities

PracticalUC Attacks

3

Audio Call

AliceBobTDM4Signalling

SIP ServerAlice

BobMedia

RTP Proxy5

Signalling
SIP ServerAlice

BobMedia

RTP Proxy6

Signalling
SIP ServerAlice

BobMedia

RTP Proxy7

SIP Headers• Caller ID• Billing
SIP Content• SDP• Enc. Keys
RTP Content• Audio/Video• File sharing• RDP

SIP Server

1- REGISTER
1- 200 OK
Phone A

2- INVITE SDP/XML
2- 100 Trying

RTP

4- 200 OK SDP/XML

3- INVITE
SDP/XML

4- ACK
3- 200 OK
SDP/XMLRTP

RTP Proxy

RTP

RTP Proxy

Phone B8910VoIPServerWindowsServerOfficeServer

ActiveDirectory

VirtualMachines

CISCO IP PHONE
7970 SERIES12ABC

4GHI

5JKL

3DEF?

6MNO+

789PQRSTUV

WXYZ*0OPER#11Tenant Services

SIP & Media
Server

Database
ServerShared Services

Management
ClientApplications ApplicationsPBX

CISCO IP PHONE
7970 SERIES

12ABC

4GHI

5JKL

3DEF?

6MNO
+89PQRS

7TUV

WXYZ

*0OPER#12

DNS / SRV

DNS / SRV

VoIP
ServerWindows
ServerPhone Aa@sky.com

OfficeServerActiveDirectory

Phone Bb@sky.com

Kenobi Corp

DNS
ServerSkywalker Corp

VirtualMachines

Phone Cc@sky.com

SIP / RTP
Edge Server
sky.com

Edge Server
kenobi.comPhone X
x@kenobi.com
13

CORE NETWORKACCESS NETWORKUC/VoIP Subscribers

Session Border
Controller (SBC)ACCESS NETWORK

Call Session ControlFunction(P-CSCF, S-CSCF, I-CSCF)

Home Subscriber
Server (HSS)

Application
Server (AS)

Session Border
Controller (SBC)Media Resource
Function
MRFC / MRFPVoLTE/LTE Infrastructure

Mobile Subscribers
14 Inter-vendor security issues
 INSUFFICIENT client management Missing client monitoring Missing software updates NO SIP/SDP or message filtering Centralised attack deployment
 Internal trust relationships
 Meeting and conferencing options
 Flexible collaboration options
15

 Content transferred to clients
 SIP/SDP content (e.g. format, codecs)
 Rich messaging (e.g. rtf, html, audio) Unified messaging
 Injecting files, XSS, phishing, RCE File transfers, embedded content
 Communication subsystem
 Call or SIP headers Rarely secured protocols (e.g. MSRP)
16 Engage through a first contact point UC messaging, conference invitation, courtesy phones

 Combine old and new techniques
 Use UC for malicious activities (e.g. MS-RTASPF)

17

 Red Teaming Exercises Courtesy phones, conference rooms, media gateways

 Human Factor Testing Vishing, smishing, instant messaging, UC exploits
 Infrastructure Analysis
 Toll fraud, caller ID spoofing, TDoS/DDoS Application Security Assessments
 Management portals, self-care portals
 WebRTC, VoIP/UC apps, IVR software18 Service requirements
 Cloud, subscriber services, IMS
 Billing, recordings, CDR, encryption
 Trusted servers and gateways
 SIP proxies, federations, SBCs SIP headers used (e.g. ID, billing) Tele/Video conference settings
 Analyse the encryption design
 SIP/(M)TLS, SRTP (SDES, ZRTP, MIKEY)
19 SIP header analysis
 Caller ID spoofing, billing bypass
 Communication types allowed File transfer, RDP, MSRP, teleconference Message content-types allowed
 XSS, corrupted RTF, HTML5, images
 Conference and collaboration

 Fuzzing clients and servers
 SIP headers, SDP content, file types
 Combine with known attacks
20 Attacks with NO user interaction
 Calls with caller ID spoofing Fake IVR, social engineering Messages with caller ID spoofing Smishing (e.g. fake software update) Injected XSS, file-type exploits Bogus content-types or messages
 Meetings, multi-callee events
 Attacking infrastructure Raspberry PI with PoE, Eavesdropping21

 Unified Communication Solutions
 Cisco Hosted Collaboration Suite Microsoft Skype for Business (a.k.a Lync)
 Free software (e.g. Kamalio, OpenIMS) Other vendors (Avaya, Alcatel, Huawei)

 Attacking through Signalling services
 Messaging, voicemail and conference system Cloud management and billing Authorisation scheme Client services (self-care, IP phone services)22 Vulnerable CPE
 Credential extraction
 Attacking through embedded devices

 Insecurely located distributors
 Hardware hacking, eavesdropping
 SIP header and manipulation for Toll Fraud Attacking legacy systems (e.g. Nortel?) Voicemail hijacking23 Analysing encryption design Implementation (e.g. SRTP, SIP/TLS)
 Inter-vendor SRTP key exchange Privacy and PCI compliance Network segregation
 IVR recordings (e.g. RTP events)
 Eavesdropping Call recordings security24 Inter-vendor services design
 Network and service segregation
 *CSCF locations, SBC services used
 VoLTE design, application services
 SIP headers are very sensitive Internal trust relationships
 Filtered/Ignored SIP headers Caller ID spoofing, Billing bypass

 Encryption design (SIP, SRTP, MSRP)
25

 Viproy VoIP Penetration Testing Kit (v4)
 VoIP modules for Metasploit Framework
 SIP, Skinny and MSRP services
 SIP authentication, fuzzing, business logic tests
 Cisco CUCDM exploits, trust analyser...
 Viproxy MITM Security Analyser (v3)
 A standalone Metasploit Framework module
 Supports TCP/TLS interception with custom TLS certs
 Provides a command console to analyse custom protocols
26 Cloud communications
 SIP header tests, caller ID spoofing, Billing bypass, hijacking IP phones
 Signalling services
 Attacking tools for SIP and Skinny
 Advanced SIP attacks
 Proxy bounce, SIP trust hacking
 Custom headers, custom message-types

 UC tests w/ Viproxy + Real Client27

SIGNALLING / MESSAGING• SDP / XML• SIP Headers• XMPP• MSRPCONTENT• Message types (HTML, RTF, Docs)• File types (Docs, Codecs)• Caller ID Spoofing• DoS / TDoS / Robocalls, Smishing

FORWARDED REQUESTS• Call Settings• Message Content

NO USER INTERACTION• Call request parsing• Message content parsing• 3rd party libraries reachable28

29

 Unified Messaging
 Message types (e.g. rtf, html, images)
 Message content (e.g. JavaScript)
 File transfers and sharing features
 Code or script execution (e.g. SFB) Encoding (e.g. Base64, Charset)
 Various protocols
 MSRP, XMPP, SIP/MESSAGE

 Combining other attacks
31 Attacker’s Client TLS / Proxy Certificate
 Compression
Skype for Business
Attacker’s Client Console Enabling Features
 Content Injection
 Security Bypass

HACME 1Viproxy

HACME 2

Interactive Console
MANIPULATE SIP CONTENTINJECT MALICIOUS SUBJECTSSEND PHISHING MESSAGESHACME 332

UC content forwarded to UC clients (NO interaction)
 SIP INVITE headers
 Message content
 SIP/SDP content
ForwardedRequest

Office 365
Federations*MS15-123

Call Request

Skype for Business
Attacker’s Client

Changed Request

Viproxy

Skype forBusiness Server34

URL filter bypass via JavaScript<script>var u1="ht"; u2="tp"; u3="://";o="w"; k="."; i="";u4=i.concat(o,o,o,k);
window.location=u1+u2+u3+u4+"viproy.com"</script>

Script execution via SIP messages<script>window.location="viproy.com"</script>

Script execution via SIP headers
Ms-IM-Format: text/html; charset=UTF-8; msbody=PHNjcmlwdD53aW5kb3cubG9jYXRpb249Imh0dHA6Ly93d3cudmlwc
m95LmNvbSI8L3NjcmlwdD4=35

Attacking through a PBX or proxy Sending a meeting request
 Using a CUSTOM SIP header Waiting for the shells

PRIVATE NETWORK

ForwardedRequests
Meeting Request(Attack in SIP headers)ViproyForwarded Meeting
RequestSIP PBX Server

Skype for BusinessServer36

 Secure design
 Enforce security via SBCs
 Messaging, SIP headers, meetings…
 Enforce authentication

 Secure inter-vendor configuration
 Protect the legacy systems
 Protect the clients38 Securing Unified Communications (UC) is NOT

just securing VoIP.

 Brace yourselves, VoIP/UC are attacks are coming.
 #TaylorYourCommunicationSecurity !

39Viproy VoIP Penetration Testing Kit

http://www.viproy.com
Context Information Security

http://www.contextis.com

40

QUESTIONS?

THANKS!