Hacking Exposed: VoIP

1. Hacking Exposed: VoIP Mark D. CollierChief Technology Officermark.collier@securelogix.com www.securelogix.com

2. Hacking Exposed: VoIP We took on this project because there were no practical books on enterprise VoIP security that gave examples of how hackers attack VoIP deployments and explained to administrators how to defend against these attacks. We spent more than a year of research writing new VoIP security tools, using them to test the latest VoIP products, and scouring VoIP state-of-the-art security. This tutorial is based on material fromthe book. The book was published December 1, 2006http://www.hackingvoip.com536 pages

3. Outline Outline Overview Gathering Information: • Footprinting • Scanning • Enumeration Attacking the Network: • Network Infrastructure Denial of Service • Network Eavesdropping • Network and Application Interception

4. Outline Outline Attacking Vendor Platforms: • Avaya • Cisco Attacking the Application: • Fuzzing • Disruption of Service • Signaling and Media Manipulation

5. Outline Outline Social Attacks: • Voice SPAM/SPIT • Voice Phishing

6. Introduction Introduction VoIP systems are vulnerable: • Platforms, networks, and applications are vulnerable • VoIP-specific attacks are becoming more common • Security isn’t always a consideration during deployment The threat is increasing: • VoIP deployment is growing • Deployments are critical to business operations • Greater integration with the data network • More attack tools being published • The hacking community is taking notice

7. Introduction IntroductionLayers of Security

8. Introduction IntroductionCampus VoIP TDM Phones TDMTrunks PublicVoiceNetwork IPPBX IP Phones Voice VLAN Data VLAN InternetConnection Internet PCs

9. Introduction IntroductionPublic VoIP TDM Phones VoIPConnection PublicVoiceNetwork IPPBX IP Phones Voice VLAN Data VLAN InternetConnection Internet PCs

10. Gathering Information Gathering Information This is the process a hacker goes through to gather information about your organization and prepare their attack Consists of: • Footprinting • Scanning • Enumeration

11. Gathering InformationFootprinting Footprinting Steps taken by a hacker to learn about your enterprise before they start the actual attack Consists of: • Public website research • Google hacking • Using WHOIS and DNS

12. Gathering InformationFootprinting Public Website ResearchIntroduction An enterprise website often contains a lot of information that is useful to a hacker: • Organizational structure and corporate locations • Help and technical support • Job listings • Phone numbers and extensions

13. Gathering InformationFootprinting Public Website ResearchOrganization Structure

14. Gathering InformationFootprinting Public Website ResearchCorporate Locations

15. Gathering InformationFootprinting Public Website ResearchHelpdesk

16. Gathering InformationFootprinting Public Website ResearchHelpdesk

17. Gathering InformationFootprinting Public Website ResearchJob Listings Job listings can contain a ton of information about the enterprise VoIP system. Here is a portion of an actual job listing: Required Technical Skills:Minimum 3-5 years experience in the management and implementation of Avaya telephone systems/voicemails: * Advanced programming knowledge of the Avaya Communication Servers and voicemails.

18. Gathering InformationFootprinting Public Website ResearchPhone Numbers Google can be used to find all phone numbers on an enterprise web site: • Type: “111..999-1000..9999 site:www.mcgraw-hill.com”

19. Gathering InformationFootprinting Public Website ResearchVoice Mail By calling into some of these numbers, you can listen to the voice mail system and determine the vendor Check out our voice mail hacking database at: • www.hackingvoip.com

20. Gathering InformationFootprinting Public Website Research Countermeasures It is difficult to control what is on your enterprise website, but it is a good idea to be aware of what is on it Try to limit amount of detail in job postings Remove technical detail from help desk web pages

21. Gathering InformationFootprinting Google HackingIntroduction Google is incredibly good at finding details on the web: • Vendor press releases and case studies • Resumes of VoIP personnel • Mailing lists and user group postings • Web-based VoIP logins

22. Gathering InformationFootprinting Google Hacking Vendors and enterprises may post press releases and case studies: • Type: “site:avaya.com case study” or “site:avaya.com company” Users place resumes on the Internet when searching for jobs • Search Monster for resumes for company employees Mailing lists and user group postings: • www.inuaa.org • www.innua.org • forums.cisco.com • forums.digium.com

23. Gathering InformationFootprinting Google HackingWeb-Based VoIP Logins Some VoIP phones are accidentally exposed to the Internet Use Google to search for: • Type: inrul:”ccmuser/logon.asp” • Type: inurl:”ccmuser/logon.asp” site:example.com • Type: inurl:”NetworkConfiguration” cisco

24. Gathering InformationFootprinting Google HackingWeb-Based VoIP Logins

25. Gathering InformationFootprinting Google HackingCountermeasures Determine what your exposure is Be sure to remove any VoIP phones which are visible to the Internet Disable the web servers on your IP phones There are services that can help you monitor your exposure: • www.cyveilance.com • ww.baytsp.com

26. Attacking The PlatformCisco Google HackingCountermeasures

27. Gathering InformationFootprinting WHOIS and DNSIntroduction Enterprises depend on DNS to route website visitors and external email WHOIS searches can reveal IP addresses used by an enterprise

28. Gathering InformationFootprinting WHOIS and DNSCountermeasures Use generic names where possible Disable anonymous zone transfers on your DNS servers

29. Gathering InformationScanning ScanningIntroduction Steps taken by a hacker to identify IP addresses and hosts running VoIP Consists: • Host/device discovery • Port scanning and service discovery • Host/device identification

30. Gathering InformationScanning Host/Device Discovery Consists of various techniques used to find hosts: • Ping sweeps • ARP pings • TCP ping scans • SNMP sweeps

31. Gathering InformationScanning Host/Device DiscoveryUsing nmap nmap -O -P0 192.168.1.1-254 Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2006-02-20 01:03 CST Interesting ports on 192.168.1.21: (The 1671 ports scanned but not shown below are in state: filtered) PORT STATE SERVICE 23/tcp open telnet MAC Address: 00:0F:34:11:80:45 (Cisco Systems) Device type: VoIP phone Running: Cisco embedded OS details: Cisco IP phone (POS3-04-3-00, PC030301) Interesting ports on 192.168.1.23: (The 1671 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 80/tcp open http MAC Address: 00:15:62:86:BA:3E (Cisco Systems) Device type: VoIP phone|VoIP adapter Running: Cisco embedded OS details: Cisco VoIP Phone 7905/7912 or ATA 186 Analog Telephone Adapter Interesting ports on 192.168.1.24: (The 1671 ports scanned but not shown below are in state: closed) PORT STATE SERVICE 80/tcp open http MAC Address: 00:0E:08:DA:DA:17 (Sipura Technology) Device type: VoIP adapter Running: Sipura embedded OS details: Sipura SPA-841/1000/2000/3000 POTS<->VoIP gateway

32. Gathering InformationScanning Host/Device DiscoveryPorts SIP enabled devices will usually respond on UDP/TCP ports 5060 and 5061 SCCP enabled phones (Cisco) responds on UDP/TCP 2000-2001 Sometimes you might see UDP or TCP port 17185 (VXWORKS remote debugging!)

33. Gathering InformationScanning Host/Device DiscoveryPing Sweeps

34. Gathering InformationScanning Host/Device DiscoveryARP Pings

35. Gathering InformationScanning Host/Device DiscoveryTCP Ping Scans Several tools available: • nmap • hping

36. Gathering InformationScanning Host/Device DiscoverySNMP Sweeps

37. Gathering InformationScanning Host/Device DiscoveryCountermeasures Use firewalls and Intrusion Prevention Systems (IPSs) to block ping and TCP sweeps VLANs can help isolate ARP pings Ping sweeps can be blocked at the perimeter firewall Use secure (SNMPv3) version of SNMP Change SNMP public strings

38. Gathering InformationScanning Port Scanning/Service Discovery Consists of various techniques used to find open ports and services on hosts These ports can be targeted later nmap is the most commonly used tool for TCP SYN and UDP scans

39. Gathering InformationScanning Port Scanning/Service DiscoveryCountermeasures Using non-Internet routable IP addresses will prevent external scans Firewalls and IPSs can detect and possibly block scans VLANs can be used to partition the network to prevent scans from being effective

40. Gathering InformationScanning Host/Device Identification After hosts are found and ports identified, the type of device can be determined Classifies host/device by operating system Network stack fingerprinting is a common technique for identifying hosts/devices nmap is commonly used for this purpose

41. Gathering InformationScanning Host/Device IdentificationCountermeasures Firewalls and IPSs can detect and possibly block scans Disable unnecessary ports and services on hosts

42. Gathering InformationEnumeration EnumerationIntroduction Involves testing open ports and services on hosts/devices to gather more information Includes running tools to determine if open services have known vulnerabilities Also involves scanning for VoIP-unique information such as phone numbers Includes gathering information from TFTP servers and SNMP

43. Gathering InformationEnumeration Vulnerability TestingTools

44. Gathering InformationEnumeration Vulnerability TestingTools

45. Gathering InformationEnumeration Vulnerability TestingCountermeasures The best solution is to upgrade your applications and make sure you continually apply patches Some firewalls and IPSs can detect and mitigate vulnerability scans

46. Gathering InformationEnumeration SIP EnumerationIntroduction

47. Gathering InformationEnumeration SIP EnumerationDirectory Scanning [root@attacker]# nc 192.168.1.104 5060 OPTIONS sip:test@192.168.1.104 SIP/2.0 Via: SIP/2.0/TCP 192.168.1.120;branch=4ivBcVj5ZnPYgb To: alice <sip:test@192.168.1.104> Content-Length: 0 SIP/2.0 404 Not Found Via: SIP/2.0/TCP 192.168.1.120;branch=4ivBcVj5ZnPYgb;received=192.168.1.103 To: alice sip:test@192.168.1.104>;tag=b27e1a1d33761e85846fc98f5f3a7e58.0503 Server: Sip EXpress router (0.9.6 (i386/linux)) Content-Length: 0 Warning: 392 192.168.1.104:5060 "Noisy feedback tells: pid=29801 req_src_ip=192.168.1.120 req_src_port=32773 in_uri=sip:test@192.168.1.104 out_uri=sip:test@192.168.1.104 via_cnt==1"

48. Gathering InformationEnumeration SIP EnumerationDirectory Scanning

49. Gathering InformationEnumeration SIP EnumerationAutomated Directory Scanning

50. Gathering InformationEnumeration TFTP EnumerationIntroduction Almost all phones we tested use TFTP to download their configuration files The TFTP server is rarely well protected If you know or can guess the name of a configuration or firmware file, you can download it without even specifying a password The files are downloaded in the clear and can be easily sniffed Configuration files have usernames, passwords, IP addresses, etc. in them