NON URGENT TEMPORAIRE DEFINITIVE CONTENTS 1. INTRODUCTION HOW TO REINFORCE VOIC PASSWORDS POLICIES... 3

Transcription

1 TECHNICAL COMMUNICATION No. TC1774 Ed. 01 OXE Voic 46x5 Nb de pages: 19 Date: January 12 th 2013 URGENT NON URGENT TEMPORAIRE DEFINITIVE SUBJECT: REINFORCE SECURITY ON 46x5 VOIC SYSTEM CONTENTS 1. INTRODUCTION HOW TO REINFORCE VOIC PASSWORDS POLICIES On 4645 configuration On 4635 configuration HOW TO MANAGE CALL BARRING ON VOIC S 46X5 SYSTEMS How to control the voic access to PSTN Important System Parameters to check Remender : Call restrictions - barring (discrimination) EXAMPLES OF RECOMMENDED CONFIGURATION Configuration details and main parameters management Scenario configuration On 4645 Voic Call transfer from Automatic Attendant AA to PSTN CallBack Caller via Public Network Outcalling notification On 4635 voic system (Coming in the next edition) /19

2 1. INTRODUCTION Reminder: A voic is part of the OXE system and requires to be managed. Each voic uses categories to apply rights on user s mailbox. Outgoing calls management is also a major part to take in account. In the System documentation, you will find a part called Security where you will find all the Alcatel Lucent recommendations about security. Some parts of this document are directly extracted from this chapter. Other specific information s are also communicated to take in account some specific threats: Like the Alcatel Lucent Security Advisory N SA0046: - Voic phreaking prevention and security measures. This document describes: - How to apply the security parameters to improve the defense against password attacks. - How to set-up and control the outgoing calls made through 4635 and 4645 voic . Attacks and scenarios identified: - Brute/force attack on voic passwords and unauthorized Calls back. Consequences: Some messages can be heard or deleted by unexpected intruders. The Voice Mail CallBack caller feature can also be used to perform unauthorized international calls. We noticed that often the attack was made on entity extension managed in night routing which have a mailbox with password From some voice mail menu, it is possible to dial or to have access to external numbers. Consequences: Extra expenses are charged on the customer s bill. All these scenarios can be avoided by doing the proper management on barring. Configuration details are in the next parts. TC1774 2/19 Ed. 01 / 12 January 2013

3 2. HOW TO REINFORCE VOIC PASSWORDS POLICIES. Alcatel-Lucent strongly recommends setting up a customized password policy. You will find below the different parameters to configure these rules. They have to be modified on each voic type, to secure your voic access. 2.1 On 4645 configuration. Secure access to voice mail management Use the longest available PIN codes (8 characters instead of 3 characters) allowed by the password policy to prevent easy brute force attacks. On 4635, it is from 1 to 15 digits. Change password validity duration from unlimited to few days / weeks To force the password change on all the mailboxes, put a new value in the password validity parameter. At the next mailbox access of the owner will have to set a new password. Forbid the skip password parameter In /mgr/apllication/voic /4645 VM Class of Services/ Forbid trivial passwords to prevent dictionary attacks Deactivate the out-calling function if they are not required. Ed. 01 / 12 January /19 TC1774

4 In /Mgr/Application/Voic /4645 VM Global parameters/ Definition: Trivial Password Allowed ->> Put to False. YES: the user can use trivial passwords (1234, 0000, their directory number, etc.). NO: trivial passwords are not allowed. The following passwords are prohibited: - Sequence of digits in ascending or descending order, - Simple repetition of digits, - Directory number of the voice mailbox, - Directory number of the voice mailbox written backwards, - Password identical to the previous password. Decrease the numbers of unsuccessful attempts before being disconnected. In /Mgr/Application/Voic /4645 VM Class of Service/4645 COS Note: For instance 2 or less, the default value is 3. TC1774 4/19 Ed. 01 / 12 January 2013

5 2.2 On 4635 configuration. On 4635, most of the parameters needs to be managed the V24 console of the voice mail. You will find below some useful parameters to increase the security on passwords. From Menu 1-1 System Parameters / Change Installation Information From Menu 1-2 System Parameters / Change Configuration Parameters Ed. 01 / 12 January /19 TC1774

6 From the Menu 7 with class of Service 10 (Default Mailbox COS) 3. HOW TO MANAGE CALL BARRING ON VOIC S 46X5 SYSTEMS. Prerequisite Every voic can have access to PSTN if everything is managed by default, so it is mandatory to control and block unauthorized numbering. The barring management is mainly made by the OXE, some others parameters are also available within the voic management. Define the customer needs. It is mandatory to clarify the customer s expectations regarding the PSTN access of the voic . Main features available: TC1774 6/19 Ed. 01 / 12 January 2013

7 - Access to PSTN through Automatic Attendant (AA) or from the Main voic menu - (The voic main menu is also an AA) - When trying to reach a user by AA, follows the Oxe PSTN transfer, when the user is forwarded on external number. - Out calling notification to a external programmed number, when a new unheard message is in the owner s mailbox. The voic calls the number. - Call back caller, including external caller, via Public Network from mailbox. If one of these features is not used by the customer, it is strongly recommended to disable it or control it by configuration. Known vulnerabilities: Some scenarios have been identified as critical, most of them were due to missing management and solved after applying the proper configuration. All are related to barring configuration. The most report threat were calls from voic to unwanted international numbers. The investigation shows, in the discriminator rules, these external numbers were allowed. Scenarios: - Transfer by AA to a user who is forwarded to an unwanted external number. - From the main voic menu (or greeting) by pressing *, I can dial ARS prefix (9 or 0) + external number. - During a message deposit, even made by an external call, by pressing *, I can dial ARS prefix (9 or 0) + external number. - Brute force attack on a mailbox password, access to the mailbox from PSTN, use of the call back sender feature to call international numbers. In the next section, we will detail the way how to block or control these scenarios. 3.1 How to control the voic access to PSTN Important System Parameters to check. ARS prefix Logical Discriminator used Entity number Discriminator Selector Discriminator rules ARS list Area number Ed. 01 / 12 January /19 TC1774

8 Trunk management Number compatible with (Discriminator x) Public COS Entity number OXE User rights Phone Feature Category (Forward to External number) Phone Feature Category (Transfer Outgoing-Incoming) Phone Feature Category (Transfer Outgoing-Outgoing) Phone Feature Category (PCX Calls Follow Ext. forwarding) Phone Feature Category (Voice Mail Manager Access) Public COS Entity number Public COS management Ext. Access On Attend. Transfer (Night: 0 Day: 1 Mode1:0 Mode2:0) Ext. Access on Set Transfer (Night: 0 Day: 1 Mode1:0 Mode2:0) Area Number. Voic main rights on 4645 Callback Call via Public Network Notification via Public Network Trivial Password Allowed Voic Owner rights on 4645 Skip password Outcall notification Password validity No max of rep XXXX Voic main rights on 4635 Block Messages to Uninitialized Mailboxes Menu 1-1 Minimum number of digits Menu 1-2 Number of bad Entries before disconnect Menu 1-2 and Menu Enable password check Menu 1-2 Follow PBX transfer Redirection Number (ECP) Menu 1-2 Out calling parameter Menu 5 Block Automated Operator Transfer Menu 6-1 and Menu Dialing Sequence for XXXX. Menu 6-1 Voic Owner rights on 4635 Type of Out calling Menu 7 10 Outcall Control Menu 7 10 Days until password change Menu 7 10 Skip password on direct call Menu 7 10 Out calling Auth. Code Menu 9-1 Out calling Phone No: Menu 9-1 TC1774 8/19 Ed. 01 / 12 January 2013

9 3.1.2 Reminder : Call restrictions - barring (discrimination) Extracts from OXE System Documentation/ Public Networks/Numbering Conversion/Barring..) Overview Call restrictions determine whether or not a user has the right to call the external number dialed. To decide whether to authorize or bar a call, the system uses: The initial digits of the number dialed. The public network carrier. This is because the signification of the number dialed differs depending on carrier. Caller entity. The restriction/barring (discrimination) rules are not necessarily the same on different entities. The time of the call. Calls authorized at certain times (during the day, for example), may not be authorized at other times (during the night, for example). System mode (day/night) is set either by the attendant or by a time period schedule (automatic switchover at a predetermined time). The calling set. Calls authorized on a manager set are not allowed on a booth (i.e. "public"/selfservice) set Operation Call by direct seize For a call made using direct trunk group seize (trunk group seize prefix used), the system matches an area identifier (dialing area) with the first digits of the number called. This area identifier (dialing area) depends on the trunk group and entity. Depending on calling set public network access Class of Service (COS), this area may be allowed or not. The discrimination mechanism requires a management item (configuration data), the discriminator. The discriminator configured for the trunk group is called the "logical discriminator". The entity matches "logical discriminator" and "real discriminator". The following figure presents an example of operation. Ed. 01 / 12 January /19 TC1774

10 Configuration objects used for an direct seize call If the number called does not match any discrimination rule, the call is refused ARS call For an ARS call, the trunk group effectively used is not known at the time of discrimination. In this case, the ARS prefix determines the logical discriminator to be used. TC /19 Ed. 01 / 12 January 2013

11 Configuration objects used for an ARS call Call on an ABC network On an ABC network, the caller may not be on the same node as the trunk group used to access the public carrier. In this case, discrimination is performed on the caller's node Call in transit Calls arriving from a private network and that are to access the public network via the local system may undergo discrimination. If discrimination is required, it is based on trunk group "Public network access COS". Ed. 01 / 12 January /19 TC1774

12 Configuration objects used for an transit call Refused calls are released or redirected to the attendant Call by speed dialing For each speed dialing number, the manager determines if a call to the matching number is subject to discrimination or not. This feature allows exceptions to be created in the discrimination rules. For example, a foreign branch office that can be called by a speed dialing number without discrimination may thus be called by all members of staff, whereas international calls are only authorized on some sets. 4. EXAMPLES OF RECOMMENDED CONFIGURATION The next parts will show the proper management to apply to be able to control the PSTN access through the voic system. IMPORTANT POINTS: - The more you detail your discriminator rules, the more efficient will be your barring. - We recommend to not use the entity 0 the default discriminator 0 and 1, keep them empty with no rules used by users s extension to have access to PSTN. TC /19 Ed. 01 / 12 January 2013

13 4.1 Configuration details and main parameters management Scenario configuration. In that example, we will avoid to use the default configuration as much as possible, so the discriminator 0 and 1 will not be used. Here we made the scenario with ARS prefix but a professional trunk seizure prefix may be used too. ARS prefix 0 with logical discriminator 2. PSTN trunk N 122 Ars list 12 linked to Trunk 122. Area 1 to allow the access Area 3 to ban the access Discriminator N 2 for user. Discriminator N 4 for 4645 voic N 4 Public COS 0 for Trunk Public COS 2 for User Public COS 4 for Voic Entity 0 -> Trunk Entity 2 -> User Entity 4-> Main Voic and Automatic Attendant. Main voicemal number AA entry AA menu Numbering rules for the test: An user can call international numbers but only UK and Germany. An user can call all national numbers and cell phone numbers. An user can call specfic numbers. The voic can transfer calls to national numbers and cell phones. The voic can not transfer call to specific numbers. The voic can not transfert call to international numbers. The voicemaiil can only tranfert calls to Alcatel Lucent UK offices. (+44) XXXX No trunk prefixes can be used to access to PSTN Trunk managent. Ed. 01 / 12 January /19 TC1774

14 Do the same in the second level ARS management. TC /19 Ed. 01 / 12 January 2013

15 Discrminator management From /Entities/Discriminator Selector Create your voic dicriminator Create the entity dedicated to voic and put the right value in the discriminator selector.(same thing for the Users entity.) Ed. 01 / 12 January /19 TC1774

16 Create your discriminator rules for your voic . For instance all national call beginning by 02+XXXXXXXX are allowed. Area 1 is allowed. Final discrimantor rules for voic . Final discriminator rules for users. 4.2 On 4645 Voic On 4645, there is three main features that need to be properly managed. In the following part, we will detail the feature below. TC /19 Ed. 01 / 12 January 2013

17 4.2.1 Call transfer from Automatic Attendant AA to PSTN. - Manage your Automatic Attendant with your parameters. Reminder: The main 4645 greeting menu is an AA with default parameters (Entity 0 Public COS 0.) Note: When you create an 4645 AA, the system creates an analog user with the same number where the parameters will be applied. From the VM Class of Service 1: Decrease the number of attempts before disconnection. Check the AA parameters in the User part. (Automatically created from the 4646 VM AA menu.) - Do the same for the AA menu. Ed. 01 / 12 January /19 TC1774

18 4.2.2 CallBack Caller via Public Network The Callback Caller is a feature that allow the mailbox owner to call back someone who left him a message. The option is heard after the message playing. This is the most used feature by hackers, they make severals attempts to attack the mailbox password and when it is done, they used this feature to be recalled. The attack are mostly on Entity routing number with mailbox. Of course if the mailbox is 0000, it is easy to go in So it is really important to check with the customer, if he needs this feature. Because if the passwords are not well protected (see part 2 how to reinforce your password policy.), your system is potentially weak. Important: If a call is initiated by activing this feature, the parameters used are the ones belonging the user. Here in our exemple we have : Entity 2 Public COS 2. Test avec les classes de services sur les transferts The barring used for this feature is the Users rights and mostly the international access is given by the commun discriminator rule 00 only. As I have explained previously, a relevant barring can be made with some rules to allow numbers or disallow numbers. Here it is really important to restrict the access to the user international contacts only. An 4760/8770 import can easily forbid the access to the known destinations of hacking (Cuba, Iraq, Somalia, Benin ) Check the user rights and the 4645 features in the 4645 Global Parameters Outcalling notification. This feature allows the mailbox owner to be called by the voic when a message is left in his mailbox. Always managed from the user mailbox interface. Important: The call initiated by the voic takes the user rights. Here in our exemple we have : Entity 2 Public COS 2. Exactly than for the Call Back feature, the same recommendations can be followed here. TC /19 Ed. 01 / 12 January 2013

19 4.3 On 4635 voic system(coming in the next edition) FIN DU DOCUMENT Informations légales : Alcatel, Lucent, Alcatel-Lucent et le logo Alcatel-Lucent sont des marques d Alcatel-Lucent. Toutes les autres marques appartiennent à leurs propriétaires respectifs. Les informations présentées sont sujettes à modification sans préavis. Alcatel-Lucent ne peut être tenu pour responsable de l inexactitude de ces informations. Copyright 2013 Alcatel-Lucent. Tous droits réservés. Ed. 01 / 12 January /19 TC1774