Scanning the Intertubes for VOIP

Transcription

1 Scanning the Intertubes for VOIP Telephony exposed on the net

2 whoami EnableSecurity 9 years old SIPVicious and VOIPPACK (for CANVAS) Surfjack, Extended HTML Form attack

3 next few minutes Brief intro to how VoIP is being abused Scanning for VoIP systems How to fingerprint VoIP systems Possibilities for abuse

4 VoIP Scanning SIP IAX2 H.323 SCCP

5 A primer on SIP Text based just like HTTP UDP port 5060 INVITE gets things to buzz and ring REGISTER sends phone calls your way OPTIONS gives you supported options

6 A primer on IAX2 Binary protocol running on port 4569 POKE is like ping PONG is like er.. pong REGREQ is like REGISTER REGREJ stands for registration rejected

7 VoIP and Cybercrime Scans for SIP are on the rise News of fraud What is happening in the background? What tools are they using?

8 Scans OPTIONS SIP/2.0 Via: SIP/2.0/UDP :1498;branch=BCEA2F83-1CEF-FC6A C18CE6425E;rport Max-Forwards: 70 To: From: Call-ID: 4203F1B5-3E1F-E6D6-32FF-B8C2DFAA190F CSeq: 1 OPTIONS Contact: <sip:@ :1498;transport=udp> Accept: application/sdp Content-Length: 0

9 Honeypot Some python code put together Replies to requests and acts like a registrar

10 demo

11 SIP Scanning OPTIONS is ideal for this REGISTER adds value :-) Tell between a registrar and an endpoint

12 OPTIONS scan OPTIONS scanner SIP Registrar 200 OK

13

14 Scanning IAX2 POKE scanner Asterisk Box PONG

15

16 Headers of interest SIP/ Not found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-59472;received= ;rport=5061 From: "test" To: "test" Call-ID: 37012f88-24ac-44aa-ac45-2e6a05421e7d CSeq: 1 REGISTER User-Agent: Asterisk PBX Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Content-Length: 0

17 Modified User-agent SIP/ Not found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-59472;received= ;rport=5061 From: "test" To: "test" Call-ID: 37012f88-24ac-44aa-ac45-2e6a05421e7d CSeq: 1 REGISTER User-Agent: MyVeryOwn PBX Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Content-Length: 0

18 Give away SIP/ Not found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-59472;received= ;rport=5061 From: "test" To: "test" Call-ID: 37012f88-24ac-44aa-ac45-2e6a05421e7d CSeq: 1 REGISTER User-Agent: MyVeryOwn PBX Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Content-Length: 0

19 Give away SIP/ Not found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-59472;received= ;rport=5061 From: "test" To: "test" Call-ID: 37012f88-24ac-44aa-ac45-2e6a05421e7d CSeq: 1 REGISTER User-Agent: MyVeryOwn PBX Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Content-Length: 0

20 Fingerprinting To Tag Sipura / Linksys SPA [a-fa-f0-9]{16}i0 Cisco VoIP Gateway [a-fa-f0-9]{6,8}-[a-fa- F0-9]{2,4} AVM FRITZ!Box [a-fa-f0-9]{16,29}

21 Order of headers SIP/ OK Via: SIP/2.0/UDP :5061;branch=z9hG4bK-24832;rport;received= From: "hello" To: "hello" Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 CSeq: 1 OPTIONS User-Agent: xxx voic Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Contact: <sip: > Accept: application/sdp Content-Length: 0

22 Order of headers SIP/ Not Found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-59202;received= ;rport=5061 From: "hello" To: "hello" Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 CSeq: 1 OPTIONS User-Agent: xxx asterisk Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY Supported: replaces Accept: application/sdp Content-Length: 0

23 Order of headers SIP/ OK SIP/ Not Found Via: SIP/2.0/UDP :5061;branch=z9hG4bK-24832;rport;received= Via: SIP/2.0/UDP :5061;branch=z9hG4bK- From: "hello" From: "hello" To: "hello" "hello" Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 CSeq: 1 OPTIONS CSeq: 1 OPTIONS User-Agent: sipgate voic User-Agent: sipbox asterisk Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, Allow: INVITE, NOTIFY ACK, CANCEL, OPTIONS, BYE, REF Contact: <sip: > Accept: application/sdp Content-Length: 0 Supported: replaces Accept: application/sdp Content-Length: 0

24 Order of headers SIP/ OK SIP/ Unauthorized Via: SIP/2.0/UDP :5061;branch=z9hG4bK-24832;rport;received= Via: SIP/2.0/UDP :5061;branch=z9hG4bK- From: "hello" From: "hello" To: "hello" "hello" Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 Cseq: 1 REGISTER CSeq: 1 OPTIONS Call-id: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 User-Agent: sipgate voic WWW-Authenticate: Digest realm="sipgate.at", Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, Content-Length: NOTIFY0 Contact: <sip: > Accept: application/sdp Content-Length: 0

25 Case for header names SIP/ OK SIP/ Unauthorized Via: SIP/2.0/UDP :5061;branch=z9hG4bK-24832;rport;received= Via: SIP/2.0/UDP :5061;branch=z9hG4bK- From: "hello" From: "hello" To: "hello" "hello" Call-ID: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 Cseq: 1 REGISTER CSeq: 1 OPTIONS Call-id: 6a53b3b9-3c0b-47d3-9e7f-b024ffe74663 User-Agent: sipgate voic WWW-Authenticate: Digest realm="sipgate.at", Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, Content-Length: NOTIFY0 Contact: <sip: > Accept: application/sdp Content-Length: 0

26 Fingerprinting Just one packet needed To tag Headers Community effort

27 Community effort SIPVicious Included svlearnfp.py Generated regular expressions for to tags Generated hashes describing headers SIPVicious

28 Interesting facts Random scans work pretty well ADSL etc FRITZ!Box, Speedtouch Asterisk Cisco Gateways

29 demo

30 Introducing REGISTER Binds an extension to an IP and port Normally requires authentication If no password is set it binds without auth

31 More interesting facts The REGISTER scan Dangerous Useful for cheap honeypots :-)

32 Enumeration of extensions Response to a REGISTER for non-existent extension A different response indicates that the extension exists If the extension has no password it sends a 200 OK Otherwise asks for authentication

33 REGISTER 100 REGISTER 101 * REGISTER 102

34 404 Not found 200 OK * 401 Auth required

35 demo

36 DDoS using IAX2? REGREQ :-) ACK REGREJ * ACK

37 DDoS using IAX2? REGREQ }:-) ACK REGREJ *

38 DDoS using IAX2? REGREQ }:-) ACK REGREJ REGREJ *

39 DDoS using IAX2? REGREQ }:-) ACK REGREJ REGREJ REGREJ *

40 DDoS using IAX2? }:-) REGREQ :-/ ACK REGREJ REGREJ REGREJ *

41 DDoS using IAX2? ********* :-o }:-)

42 DDoS using IAX2? ********* : -( }:-)

43

44 SIP Digest Auth REGISTER usually gets a 401 Unauthorized INVITE gets a 407 Proxy Authentication Challenge response mechanism Takes various properties + password Nonce, Method, URI

45 Digest Leak INVITE 200 OK

46 Digest Leak BYE 407 Challenge

47 demo

48 Vulnerable endpoints X-lite Gizmo5 Zoiper

49 Vulnerable endpoints Cisco 7940 Grandstream GXP* Patton Smartlink Linksys SPA942 Fritzbox

50 But... There s no SIP Phones on the net! There are ;-) The net is full of Fritzbox Internal endpoints behind NAT

51 More at.. EnableSecurity.com/research Sipvicious.org VOIPSA.org

52 Shoutouts! Sjur at usken.no dudes from.mt =)

53 Q.A

54