This is part of the BruCON VoIP security crash course training intro. For more information about the course and to secure a place, check out the BruCON website.
Most VoIP systems perform signaling using a protocol separate than the media transfer protocol. Signaling protocols allow VoIP systems to register, authenticate, and initiate phone calls and tends to carry a lot of intelligence with it. In this part of the training, Joffrey and myself will talk you through the following different signaling protocols and attacks that apply to these protocols:
- SIP - an open standard
- IAX2 - used by Asterisk PBX and compatible phones
- SCCP (Skinny) - used by Cisco systems
- MGCP - the media gateway control protocol, typically used between gateways and IVR systems
- H.323 - found in gateways and older systems
The fun part? The exercises! We plan to use a hands-on approach rather than simply describe the protocols and attacks.
These are some of the practicals we have in store:
- Sniffing SIP, in order to understand how it all works and also spy on the metadata or signal
- Scanning SIP, to see how we can easily identify SIP devices very quickly using SIPVicious and other tools
- SIP extension enumeration and online password cracking, to understand better how VoIP attackers are in fact making phone calls for free at the expense of their victims
- Avoiding toll / fraudulent calls, featuring the main ways that attackers are abusing SIP PBX servers out there
- INVITE floods, which is still an effective attack and bring down various SIP enabled devices
- Fuzzing SIP, existent tools and their usage
- Using John the ripper to crack SIP passwords, which also includes capturing the SIP authentication messages and patching John the ripper to crack the hash
- Online and offline password cracking in IAX2, the tools and their usage
- Scanning IAX2 which allows us to find Asterisk servers
- MiTM attacks using SCCP proxy, which is a fun way of playing with the phones and can allow us to turn Cisco phones into remote spy bugs
- Capture FAC (Forced Authorization Codes) code, which is a restriction usually used in Cisco VoIP environments to allow / block international calls
- Call fraud with MGCP, since MGCP has little or no security
- DoS on MGCP, or how to cause your VoIP Gateway to go down
- RTP redirection, which can allow all sorts of fun (and sometimes profit)
- Callmanager hijack (details later ;-))
With all these exercises we expect all the attendees to get really busy and gain useful experience with the signaling protocols.