>>How is everybody how holding up? Way better, okay. [Applause]. Okay so this is
Fatih and he's going to be talking about Vio Wars, let's give him a big DEF CON welcome.
>> Thank you. I appreciate it, for lasting and saying hello. My name is Fatih Ozavci and I will
talk about VoIP wars today. What we need we kind of previously on Voice over IP Wars. Because I
had another presentation last year and we had Voice over IP wars, return of the SIP and we
talked about session initiation protocol attacks. I provided Viproy; it's a kind of next
generation Voice over IP testing tool. It is developed for only pan testing, not for attackers.
So basically you cannot omit your tasks but attackers may not. I will not talk about SIP
too much today because I already talk and if you are curious about SIP security, you can get
the talk but I will talk about Voice over IP solutions to your security and some Cisco and
voice solutions products and newer novelties. I will provide a few new techniques; I will
provide a few new attack services. A few new novelties almost for you novelties and
three of them still unpashed.... And I will provide new tools and new features also developed new
interface for you as well. >>Ah, yeah, we are starting now. >>I am Fatih Ozavci, Security
Consultant and I am working for Sense of Security. I'm proud to be part of this team and thanks
for them. Also my interests are voice over IP mobile applications, network
infrastructure, I am a penetration tester so I can pan test anything, that's why I am
pan testing voice over IP. I missed some skills in this presentation so the key word is
combining and merging the skills. I....voice over IP penetration testing tool
kit...it is actually a .....word that means call, so this tool will have new feature and those
features are skinny attacks, skinny libraries, voice special attacks, STP features,
encryption features, and vander extensions. My agenda is talking about host voice over IP
services and giving some basic information. I am sure you don't need it but let me try.
Furthermore we will talk about network attacks, Cisco inter...communication domain
manager attacks, Cisco inter...manager attacks. We will have three different lines.
First one is attacking SIP services and we will talk about Cisco specific SIP problems.
Furthermore we will talk about attacking lines and we will talk about skinny attacks. This is a
basic infrastructure for hosted voice over IP services. Hosted voice over IP services are multi
talent environments. So, basically multi talent environments, pro-wide talent
specific services. Sandbox items and sandbox services are fully dedicated to this talent. But
shell services, they are available for all talents, not specific ones. So basically they
may have IP phones, soft phones, teleconference systems, some other third party connections
but they will use sandbox items, sand box objects for all voice over IP communication. Which are
STP, RTP and SIP servers, unified communication servers and some CDR servers and data
base servers, of course. Furthermore, they have shell services. Shell services are IP
phone services, client management, tent environment management or PBX connections
such as land line connections and GSN connections. Furthermore, they have shell...
but it depends on the infrastructure and configuration. If we want to
attack one single talent, we should use sandbox items. If you want to attack all the
environments, if we want to compromise all talents we should attack directly to the shared
services. I will show some jail breaking attacks here. I will talk about Cisco and Wahl
solutions, Wahl solutions, basically hosted a voice over IP .......... Cisco is a partner so
basically they will provide this hosted voice over IP environment for many customers. We will talk
about Cisco and Wahl today but these attacks can be cloned as well. Also known as voice over
...... as well, so you can use this extension as well. We will talk about these services.
Services are basically separated into two sections. First one is web based services to support
and manage all talent platforms. The second one is Voice over IP services to provide essential
services. And we will attack almost all of them. Our goal is discovering the network, finding
the box, defining the errors, learning the design and attacking those objects. They
think host and voice over IP environments are secure, it is physically but they are not. We
have physical pan testing and they showed me, even military grade operations, they are not
secure. Their physical security is kind of insufficient for those services. We can use a
talent connection, local form or comprehensiary forms; we may have PC port connections behind
the forms. Furthermore we may impersonate a technical guy or another, a cable guy and we can
get an access. Also we can .....a physical access and we can get a connection, a kind of
access for voice re-land but we should know voice re-land and that is why we have CDP attacks,
DDP attacks and Arc sweeping attacks as well. I do hope to raise a simple model for Viproy;
it is called a discovery protocol model. It is available on Viproy package and you can
use it on Metasploit, actually I used Hopper .... too many times, too many years. But I needed a
cross path, a kind of customization which is why I loved this model so, if you have
a Linux you should use ...., if you do not have a customized engagement, you should use this
model to customize it. Also you can use this model to far..... And after all do you have
voice...ID. And we will have a kind of connection but we should keep it persistent, we should
add a kind of modified form or wiretapping object. This is why I think about Tapio Pi. Tapio Pi
is basic... PI in the IP form. This is Cisco IP form, 7940. I disassembled it and I saw that
there's another board on it and this board is a basic board and it provides broken actions.
Those broken actions are PC port connections, talent connection and a kind of ancillary
connection as well. Furthermore, they have power source, when I extract this board I saw that it
is connected using a wide circuit. You can use this circuit to connect or
disconnect. When I extracted I saw that this internet connection, RJ45 connection has
pins behind the card. So basically we can use these pins. I used a basic cable kit 5 and I
created a basic clone of the transpart. If this phone will be attached to the voice land we
can create and connect ... to the same network. And yeah, there are two spaces inside the
phone. First one is on this board and the second one is speaker space. I put my... to
the speaker space and you can use the other one as well. You may need the other one for
battery because power on the internet may have to choose in the same environment because it
needs, actually the IP phone will use electricity. Furthermore ...needs electricity
as well. But power over internet may support only two power supplies at the same time. And
as you know IP phone needs more electricity. This way you need another power source. You can
use a cell battery or you can try your chance with a ... IP phone. For example, if you
extract speaker you will see a battery connection right there. And yes, it has electricity so
you can use this electricity to your supply. It is not completed yet and I am still working on it
and I will provide a blog on it. Actually we will not talk about hardware attacks we will talk
about the modern protocol attacks and service level attacks. All of this environment
must be managed. This is why we have Cisco Host Calibration suite. This Cisco Host
Calibration suite contains Cisco unified communication domain manager. Also know as Wahl
Solutions. It has IP phone services, self care, talent user's management and their
services, furthermore talent services management. The difference is Talent uses will
use self care. Talent administrators will use Talent Services administration.
Furthermore, unified communication manager will be used for all voice over IP based
services. We have reported almost 40 novelties to Cisco. Cisco reported that some of them
they are not novelty, some of them, yes they are novelty but their impact is very limited.
And yes, some of them are novelty. And Cisco published a few advisories. I will share
those references at the end of the presentation. But, here is the thing, we have another
security advisory. This security advisory contains two different unpatched novelties and one real
novelty. Two unpatched ones are novelties. We found them on Wahl solutions IP phone examiner
services. It is still unpatched and will be patched in September, maybe the second
week. The other one is embedded, maybe you already know that, but the product is pretty expensive
so you cannot get this product easily. So, I have no priority right now. If you have this
product you can extract SSHT easily using this exit file. Cisco unified communication
domain measure also for embedded. Wahl ....is a basic client platform and this
platform contains some scripting novelties and yeah they are stored scripting novelties and
you can affect other users of the same talent. But domain manager actually management
services for talent it is a good attack surface for us. We can get an administrative user
easily by using features. Furthermore if we have a user we can elevate our privileges as
well. We have multiple privilege escalations. Also we have some stored scripting novelties. We
have potential and software escalations as well and we will talk about them. A basic user is
here, if you use device user you will have a response and you can create this easily. But if you
use upload features and if you send a bogus file which contains injections or a few bogus
contents as well you will have this error message. This error message contains some additional
errors, for example, soft errors. Cisco says that it takes this bug but it is not a novelty
because there is no injection here . I could not test it because all of them was a part
of a project in an engagement. During the engagement I had only 5 days to test all this
environment. HCS, infrastructure also unified communication system as well. This is why I
could not try SP injections. If you believe Cisco it is fine but if you do not believe you can
try using insecure file out put features. It leaks; it has CGI tools so you can create the
qualified inclusion attacks and execution as well. But they are potential attacks, you can
attack. Escalation is easy, you can modify a user if you have basic access, you will be a kind
of location administrator of the talent. You can modify the environment and modify the user
and add a different role on it and add role for example talent administration, division
administrator or infrastructure administrator. Furthermore if you want to add a user you can
use user type as well. If you use user type, you can use admin user and you can add a new admin
from scratch. Furthermore we can manipulate number translation to redirect all calls or all
extensions to us. So, basically, we have many attacks. However we have another measure service
here and the services are perform management feature of Wahl solutions. Wahl solutions
provide IP phone examine services. This service is a shell service. It is a family, a
basic tool set, but it is a basic shell object for all talents. All phones, IP phones
or cell phones or teleconference room phones, or devises, it doesn't matter. They will use
this service. So basically we can attack the service to get additional access or compromise
all talents. We can use additional attacks on it. For example, call forwarding, speed
dialing manipulation, voice mail access, pin changing, it is still unpatched. Second week of
September it will be in use. This URL is the basic attack service; SRV is the service type
and service name. Device ID, make and address and you can easily get it. An action may be
called for rewriting or updating basic speed dial. It is very secure, binary, unrecordable
protocol. So it does not need any authentication authorization feature. Who can't record a XML
file, right? Basically this service works on an XML content. You can not record an XML file,
right. This is why I developed two different models to exploit this novelty. I will not share
this exploit on my software package but I will share here. Furthermore I will show the
service in a different way. First problem is this product is expensive. I have mentioned yet?
Okay. But the thing is I cannot provide a live demo on this product because I have no Cisco
UCDM here, that's why I developed a fact service for it. So basically I will use my
exploits to this fact service. I hope it will work, I hope you do as well. But, we will see. Okay,
we have a cheat sheet here and basic Wahl's demos. This service provides MAC based
identamanagement, after that it all services such as call forwarding or speed dial. At
this demo I will use the call forwarding feature. I have this service here, probably one of
them. Ahh, here. This is our fact service. We can copy on past our code. Basically we us a
model call forwarding, 4.1 which is me my port and action and it seems we have a target. If the
MAC address is valid we will have a display name of the faint number. Faint number is eunuch
in this environment. But this faint number is basically exemption. If you want to
redirect it you should update this faint number. So basically, we will update it. For example
set action, forward two. See, it seems okay. Our display name is 007. Furthermore, we are talking
about Cisco environments. Right? We are not talking about IP phones. We are talking about
everything which means we have jeopardy interface as well. Jeopardy interface provides
additional connectivity for third party items as well such as Cisco Jabber or regular Cisco
clients. Furthermore, SDK for all other third party clients such as Microsoft Link. At this
point we can use forwarding just like this as well. For example set forward to James Bond. And
we can use name, agency name is updated. I am showing this because Microsoft Link and other
products may need a main address to handle a message or call. So this is basic call forwarding we
can update all talents and we can redirect all phones to us and we can redirect just like a
basic internet exchange server. We have additional speed dials. Those phones need a speed dial
service because they have no speed dial on SIP protocol. That is why they need a kind of
protocol to provide this speed dial access. That's why we have another model here. Viproy was
speed dial. Okay? Here we go. We have three different speed dials for this MAC address. MAC
address can be obtained using scan attacks as well. So we can get a kind of communication map
of the talent or all talents. So we will have a communication path. We can add or remove a
content for example, add Viproy to third position. Set action list and run. See, Viproy is in
the third position. We can try to add Viproy to a specific position, for example one. That
position is not available because it is in use. But, we can modify this as well. So, get
the list again, Viproy is in the position now. This service is a kind of dangerous service but
the thing is it has been used for all talents, we can jail bait all platforms here. We can
redirect everybody, every user of all talents. Okay, if we go back. We have additional
features. We talked about web based attacks. But the thing is, sorry; I should show the fact
services card and my expert card here. My expert is, actually it is pretty complicated. Actually
it has bypass and depth bypass issues as well. So, basically you should very careful. Agency
this is the exploit part. This is my shock cord and agency, this is ASR bypass feature,
provide their name, field number and forward to. If you do not use forward to, you will not
bypass sandbox and AS alarm and dep as well. So basically exploit is very complicated. I
will not share this exploit because it can be pretty dangerous. However, I can share
my fact service so you can find how it works. Right? It is already available on Viproy so
basically you can work on this fake web service to understand how it works. Okay. We should
continue. Sufficiently attacks, we have additional voice over web attacks here. Those are
unified communication attacks. We have TDM, PSDM and they are old they think SIP is next
generation and they think SIP is ready to use for all unified communication systems. However,
they do not agree about features of SIP that's why they modified SIP. Not even Cisco. Cisco,
Microsoft and all third party vendors, because SIP has message metals. It has invite as well.
But, the thing is they use secure sharing, adding file transfer or a kind of voice mail
using sample, Wildfire, etc. Those are very complicated things. You cannot use SIP just
like that. That's why they modified it. But they modified SIP, regular SIP protocol. They
have additional exemptions. We will talk about a few ones. The thing is Cisco has
authentication problems about SIP. Microsoft has a few additional features on SIP.
Yeah, we will talk about Cisco now but we can talk about Microsoft later. It is basically
a Linux operating system so if you will first remove the Cisco unified communication and if you
have a novelty you can execute the code on a regular Linux server. Keep the same
formations. We should discover web services using our regular features such as Viproy
discovery features, registry, other tools. Furthermore, ..... are in the group tool, it is in
use and developed by Zander Gucci, thanks to him I have used this tool for many years. After
that I developed Viproy because I needed additional authentication features because
authenticating SIP services it needs some kind of authentication. After
authentication you may have additional features. For example registration, yeah you can get
that kind of access on this SIP server. And we talked about SIP service attacks last year, and I
actually demonstrated a few advance attacks. But the thing is Cisco SIP authentication is
somehow different. It needs address, device type and exzantion. Three of them must be
valid to authenticate you as a form. If you want to use user name and password it is fine, it
is supported for third party IP phones as well. Furthermore, Cisco suggests that security
requirement is essential for voice over IP environment. So, they can use digital certificate
base for authentication. Cisco unified communication provides additional user name and you can
use these errors. Register and subscribe it is very easy task. You can use Viproy; you check my
presentation last year. You can use or change your phone number and address or regular text and
we can use them. Furthermore I have demonstrated additional advanced attacks such as SIPro
advanced attack. We can use remote SIPro, other services to attack. It was what we
demonstrated last year. Furthermore, we can use it to attack other servers. For
example, they provide four or three billion messages which is too much. If you send a bogus
message you have errors. If you use IP spoofing you can use basic service attacks. Also we
can use hacking SIP trust relationships. We can use IP spoofing, we can get a
communication. After that, we can add IP addresses in the field. Find which IP address and
port is trusted. I demonstrated this last year this, and we initiated a base call. Also, we
can attack mobile applications using this as well. But the thing is.... is somehow
different in the same environment. First of all Cisco UCM accepts addresses as
identity and it doesn't need further authentication for many SIP based IP phones, and our own
skinny environment. Also, we can find raw waste in the same environment, it will provide for
users, antennas and all the other environments. However, they need citrons connections,
that's why they use additional, some connections are looters. That's why we can use them to
initiate calls because they have no identification by default. We can use custom headers, we can
add specific headers. Here is the thing, remote party ID is where generic header and Cisco
accepts remote party ID because it is a kind of compatibility issue. So, if add a basic remote
party ID in our current connection, authenticated connection, Cisco will accept
remote party ID as an identity. So we call everywhere with a fake identity. Caller ID
spoofing, yes, it bypasses the billing features furthermore we can access voice mail and third
party operators. Here is the thing; we have public real world attacks such as caller ID fraud
for all operators. If we had an operator we could not initiate our attack, caller ID spoofing
attack. Initiate a call through the land line connections to call the third party GSM
operator to access a voice mail account without a pin. It's all caller identity, it's an attack
and it is in use. Also we can send call back messages, we can send fake messages, we can use
spam, we can use this attack against other operators and we can use for other terms. And
this is a basic demonstration of an attack. I already demonstrated other SIP attacks,
you find my last presentation, voice over IP, it is on you tube as well. I will use a basic SIP
connection here. We will use our invite model and we have two different clients here. First
one and second one and they are connected through a Cisco server. It is a trial edition so
basically we will have a trial access and yes it works. I have registered forms here and I will
use invite model with proto TCP. We have TCP on tailor support now so we can use it.
Furthermore we will use specific phone number and log in features, furthermore we have
different log in metals, I choose register. Furthermore, we have vander extensions and it
must be used. Vander extensions first one is Cisco device. If you want to register yourself as
an IP phone such as 7940 or 41 you should use Cisco device with application. If you want to use
third party device such as third party clients you should use Cisco unification header, after
that my user name and password. This is not a novelty, see we have a call. And yeah, the thing
is it is one of thirteen. Let me explain why. If I had set the remote party header it will have
a call from 2001 which is my original one, right, see. But the thing is we can set custom
IDs. For example from James Bond or we can use a current client for example, 1013. Also we have
additional features here, for example sending a message. We have no public tool to send a
message. We should manipulate or we should prepare our tools such as SIP and after that we can
send a message, right? But we can manipulate message features such as message tie or message
content that is used for additional sharing features of third party clients such as
Cisco jabber. So basically we can change this content to attack different clients using
different scale. For example message tie, fuzz 2000, it is possible as well. But I will use
this sample for a basic search engine feature. Operators hack the operator because bypassed
identification. Furthermore, it is the basic HTML feature, HTML message. So basically we can
send this message to the real phone as well. If it receives this message, if it is a smart
phone as well, this can be good. Furthermore, we can change message content, for example
message tie, it is still text and plain but message content could be fast 500, fast 5000. It
depends on you. Some of the clients they are really vulnerable such as Cisco Jabber
or for example XLight or you know Microsoft Link. Yeah, we will continue with other
attacks, because we can attack clients. I mentioned client attacks last year so I will pass
this slide I already provided this slide on my presentation so you can check them as well. And
Cisco has different clients and we can attack all of them we can use attacks as well. And I have
a tool for it. Reproxy is another tool I have developed for TCP, TNS interception.
Furthermore, it supports custom digital search features. It has low feature it has multiple
duplication as well. It is a fork of proxy. So basically we have used this tool to
manipulate other clients. It has multiple issues; sorry about that but I will fix it in a few
months. You can fix it as well, it is available on Viproy. I would appreciate a few patches.
This is a basic SIP fishing demo and I already showed it. Basic client attack demos, we can use
them as well. I have crashed an IOS application last year using only spoofing, so we can attack.
But, this is not the case. We should talk about skinny as well. Skinny is a generic
protocol. Cisco uses it for all local environments. Even for hosted voice over IP services.
It is a kind of compatibility requirement because they will use SIP by default. They will
use skinny for regular SIP phones, regular Cisco IP phones. It is a kind of protocol so
basically you should use many packages to register yourself. We can use basic attacks, when I
search, VoIP or SIP attacks or skinny attacks; I sell always one single name, Jace Nostrom.
He has a pension about VoIP but not only VoIP as well he helped me too much for this
presentation, thank you for him again. Of course Viper and Spara they have published some tools
and novelties on skinny. I am not sure about Viper 11 as skinny support because I saw a
communication but I am not sure because there is no information on their page and yeah. Also
Felix found a few novelties on skinny protocol. But we have no public skinny analyzer or skinny
tool. That is why I decoded this protocol using Y Shock, just like it. But the thing is it is
different versions, such as 17, 19, 20, so some of the packages and samples are not available on
Y Shock consult. So basically you cannot decode them. There is one item of this library, right
side basic skinny passer, it has many different options for many different responses from server
and left side is a basic sample. Signing the register, it is pretty easy. Everybody develops
a basic skinny model. But the thing is, developing a skinny model; yes it is easy, such as
register or call. It is pretty easy. But if you need more, you can develop using same library
as well, because I provide a basic library through Metasploit. So you can basically
develop your own... on skinny. I have a basic... but it is not good right now. But, think about
it, register needs no authentication, right? First register packages. So basically,
many...but nobody...for example button templates, or nobody ... the remote server during a call.
So you can do it because all packages and all comments very easy for example prep, open,
receive channel. And you can use a bogus device app here or a port. So it's a kind of new
attack surface for you. But I have a demo as well. If you register it to a specific mega
address we can use regular clients as well such as Cisco IP Communicator, it supports device
name, custom device name and you can use your device name here, if you have a registration. Here
is the demo. I have Cisco communicator right side. I have Cisco UCM, I have Cisco UCM 912.
But I tested all the novelties on 10.5.1, 10.5.2 and lower versions so it works with them.
It has two different options Cisco IP Communicator or regular Cisco IP phone. You can use all
of them. In this sample, I have two different clients; let me check they can call each other.
They can call, good and they called, and yeah. Now we will use skinny attacks. This is a
basic register plug in. Basically we will use remote target MAC address and IP
address, that's all. IP addresses, server IP address MAC addresses, IP phones MAC
address. After that we can register. Agency, I can attribute information of this
MAC address such as line ID's. But the thing is I am not using MAC spoofing here. I am using
MAC address in the connection as an identity, that's all. There is no MAC spoofing here. So, I
can use other MAC addresses such as this MAC address. When I use this MAC address agency lift up
our first line. It is disconnected now. It's a kind of service for older versions. I
reviewed the information which line is available for this MAC address and I am one of them.
But the thing is we can insure the call here. For example, I can call anyone. This is another
model, Viproy skinny call and I will use another MAC address and my target is 1,013. When I use
it, it will be registered first and the Agency it is here. I do not fix this error. It is
necessary because if the other client, real client, will try to connect, re-connect, you will
have this error. Because your PTC connection will be terminated, that will be only
one single client. This is why I keep this error. This says the remote client is trying to
reconnect. We will try it again, see it will work. So, it is registering now and we are
getting confirmation and we are calling, see from 1001. Okay, register called we can
additional features such as call forwarding, it is more useable one. It is still trying to
register, but if you try to redirect this phone number 1012, 1013, it will be really good for
us, right? Because, we can redirect all phones to us, after that we can redirect them to
anywhere. It is connected right? When I try to register it is disconnected again. It may try a
few times but it will have success. Lines open for call forwarding, 1013 numbers dialed
and see it is forwarded. This is my skinny model and you can use basic features such as register,
call or call forwarding or you can turn it as a kind of advanced pauser so you can
attack remote Cisco UCM's using this attack. As you see I did not talk about toll fraud too
much because we have a good speaker here. Patrick McNeil provided a really good, maybe
best toll fraud speech ever, this afternoon, sorry this morning. And it was really good
and you should get a video or presentation and please visit our register 436. Am I right?
Okay good. So he has a really good toll fraud speech. And I am talking about other attacks. So
basically, we can attack network, we can attack Cisco UCM, we can attack Cisco Unified
Communication Domain Manager clients, skinny protocol, SIP, we can attack everywhere.
Solutions, our solutions published by Cisco and we have additional suggestions. First of
all, IP phone examiner service or remote party ID. This ..and they are yeah, they are still
unpatched and you can attack these servers using remote party ID or IP phone examiner
services. Furthermore, you can use other novelties and starting from 3277 to 3283. Furthermore,
a few additional novelties and 92, sorry 97 and 32 sorry 3302 and we have yeah, many novelties
here almost twelfth series assigned, some of them not here because they are information
level. And yeah, basically you should secure your design we have attack services on
everywhere we can attack server, we can attack protocols, we can attack lines and we can attack
web applications as well. Basically security deployment and good design they may help
you to secure the network. That's all. And yeah, I have references that you can download
that you were here. I have a 15 minute training video, also I have another Def Con video you
can use you tube to find it. And we have agency attacks there. Furthermore, I really
appreciated a Sense of Security team they supported me too much actually. They encouraged me
again and again here. Furthermore Jeff Norstrom helped me too much about this
presentation. Furthermore, some good suggestions about my point of view. Also, Mark, Paul Henry
and Sandra, of course. This is my presentation, this is what I have. Do you have any questions
related with this topic? I cannot see by the way. Do you have any questions? No question?
You do not give any questions here, okay? Okay, thank you. (Applause)