00:00:00.000-->00:00:07.583
>>Hey how’s everyone doing?
Pretty good? So this is not um
talk on KSLR, um KASLR this is

00:00:07.583-->00:00:13.000
uh phone system testing the hack
attrack- er hacker tracker app
was wrong so if you were

00:00:13.000-->00:00:16.833
expecting that I’m sorry. This
is, we’re gonna talk about phone
systems. So before we get

00:00:16.833-->00:00:22.917
started mandatory disclaimer,
everybody’s seen these. Uh these
are my opinions, type of thing.

00:00:22.917-->00:00:27.917
If you’re gonna do some of this
stuff make sure you’re having
your get out of jail free card

00:00:27.917-->00:00:34.208
all serviced and trademarks
there. That up there is. so
yeah. What we’re gonna talk

00:00:34.208-->00:00:42.125
about is uh bit of history,
evolution of phone systems,
nothing- nothing too big or in

00:00:42.125-->00:00:45.708
depth um. Not gonna talk about
SS7 carrier site stuff, it's
mostly gonna be about VoIP and

00:00:45.708-->00:00:51.250
modern phone systems, testing
them externally from like the
dial interface. Um and then we

00:00:51.250-->00:00:55.750
go on how to test those in the
issue type 2 file I’m gonna map
those to the OS top 10 as best

00:00:55.750-->00:01:01.083
as we can because we know the OS
is web and we’re talking about
phone systems so, that should be

00:01:01.083-->00:01:06.917
interesting. Um there’s a little
bit of overlap between external
and internally testing these

00:01:06.917-->00:01:11.917
because the nature of it but we
we cover that as best we can.
And then we’ll finish it off

00:01:11.917-->00:01:18.375
with some fun tricks that you
can do. Um or that I’ve
discovered you can do so. Uh

00:01:18.375-->00:01:25.458
that’s me, Owen Snide, is my
handle uh been here since the
year 2000, uh I don’t have a big

00:01:25.458-->00:01:33.500
list of acronyms behind my name,
or a title, but umm I’m fairly
involved with the local IoS and

00:01:33.500-->00:01:38.333
26 hundred and yeah I like to do
presentations, talk to people
for fun because it gets me out

00:01:38.333-->00:01:43.000
of my like introvert
personality. What um, what do
you call it like that, it gets

00:01:43.000-->00:01:46.583
me out of my comfort zone.
[chuckles] Makes me pretty
nervous talking in front of

00:01:46.583-->00:01:51.333
people so. I’ve given a couple
other talks on various topics
since about 2005 and- but since

00:01:51.333-->00:01:58.167
2015 me and Patrick are talking,
doing phone system stuff. it’s
just a lot to learn and do so.

00:01:58.167-->00:02:04.250
That’s that’s for real fun I
actually ride mountain bikes.
It’s the longest I’ve ever ran

00:02:04.250-->00:02:09.458
with one topic though is on
testing phone systems. So I was
born in the 80’s raised in the

00:02:09.458-->00:02:13.458
90’s don’t know how many of you
have seen this before, we had
all these antiquated

00:02:13.458-->00:02:20.083
technologies um. I’m not sure if
I miss the 90’s, because they
weren’t that great for me.

00:02:20.083-->00:02:23.958
Because they say you actually
had to play video games if
anybody remembers that. It’s

00:02:23.958-->00:02:29.375
very depressing. And you have to
sit next to somebody, there’s no
real internet, and if you had a

00:02:29.375-->00:02:34.458
APT that’s how you had to block
them. So you could just take the
phone of the- you can’t do that

00:02:34.458-->00:02:41.458
these days so. How many people
here remember their childhood
phone number? Eh I can’t see out

00:02:41.458-->00:02:45.375
the back but a decent number. So
you know people don’t keep their
numbers like they used to. Uh

00:02:45.375-->00:02:51.167
times have changed. But the
older crowd generally may, may
remember that. I remember my

00:02:51.167-->00:02:55.333
first phone number which is
really weird cause I can’t
remember other things. Uh this

00:02:55.333-->00:02:59.667
this is really good, really good
one if you’re into social
engineering and stuff. To find

00:02:59.667-->00:03:05.208
out post on social media and get
that secret answer to the secret
question. So who uses phones?

00:03:05.208-->00:03:11.708
We’ll do a raise of hands, why
not? Nobody. A few. Okay no
everybody uses phones right?

00:03:11.708-->00:03:16.542
There’s nobody who doesn't in
some form. Uh particularly
interested in all of those, but

00:03:16.542-->00:03:20.500
banking finance could be your
daily banking your retirement
your investments those are

00:03:20.500-->00:03:26.000
pretty pretty scary ones. Then
all of these other ones are
pretty good too, right?

00:03:26.000-->00:03:31.458
Everybody uses them so for
history on them. Really I’m not
gonna cover a whole bunch of

00:03:31.458-->00:03:37.208
history. Sorry Wrong Number, eh
me and Patrick did uh two years
ago did a pretty in depth- er

00:03:37.208-->00:03:43.708
well I thought it was in depth,
but a overview of the past. How
we got to where we are today.

00:03:43.708-->00:03:49.458
And Exploding the Phone this
book by Phil Lapsley is supposed
to be the best book on the

00:03:49.458-->00:03:54.208
phone, kinda the phreak history.
I have not read it it’s on my
bucket list. But we’re not gonna

00:03:54.208-->00:03:59.542
really talk about that stuff
we’re talking about more on the
digital side so. The last slide

00:03:59.542-->00:04:07.167
of the history, well maybe not
the last slide but. Let’s see if
you can hear this. Nope. No

00:04:07.167-->00:04:11.458
sound. But we know what a modem
sounds like er we’ll get back to
this bit in the- further on in

00:04:11.458-->00:04:15.208
the slides but in the beginning
this pictogram you see that
it’s, you can’t see, it’s right

00:04:15.208-->00:04:25.875
there. That’s kind of important
for phone systems. So let’s see.
I’m gonna need sound for some of

00:04:25.875-->00:04:33.375
these future demos but next
slide. And this is a history of
kind of communication. Eh ‘96

00:04:33.375-->00:04:38.708
NetMeeting, all of these have
kind of been bundling stuff on.
Everybody’s been building

00:04:38.708-->00:04:45.000
technologies to help people
communicate. And we go in what
10 years ago now the Iphone

00:04:45.000-->00:04:51.042
release- was released which is a
real game changer. But all of
these are close sourced with the

00:04:51.042-->00:04:54.875
exception of Asterisk because
everybody want to make some
money off off of communications

00:04:54.875-->00:04:59.667
because, you are the product.
And in more recent history we
have all of these alright

00:04:59.667-->00:05:04.250
Hangouts and Unifolk
communications, Screen Sharing,
Kik, Snapchat, all of these.

00:05:04.250-->00:05:07.833
They’re kind of related to phone
systems ‘cause you are
communicating that's the thing.

00:05:07.833-->00:05:14.167
Even Uber and uh what’s it Lyft
they all require a phone number
to be activated or to use their

00:05:14.167-->00:05:23.667
service, so. That’s pretty much
all the history, that I’m gonna
cover, and we’ll get on to more

00:05:23.667-->00:05:31.292
phone system stuff, so. PBXs you
your prime branch exchange. This
is what is the heart of phone

00:05:31.292-->00:05:37.250
systems because you no longer
have to have someone physically
plugging stuff in and people

00:05:37.250-->00:05:42.125
everybody runs them. Not- not
everybody but a lot of places
run them to reduce your costs

00:05:42.125-->00:05:49.167
you you get the benefits of all
these apps and you know, cheap
calling. So that’s why people

00:05:49.167-->00:05:56.458
run PBXs and you and your basic
deployment is gonna be a PBX.
With maybe a SoftPhone a SIP

00:05:56.458-->00:06:02.958
Phone or just a ATA which is
your analog telephone adapter.
And then the client in the

00:06:02.958-->00:06:09.250
telephoning world is called your
user agents. Uh these things
this is a more common

00:06:09.250-->00:06:13.833
deployment. And you just have
more stuff basically. Right you
have a ton more user agents and

00:06:13.833-->00:06:19.792
your unified communications is
kind of all tying in to each
other. And you can see you’ve

00:06:19.792-->00:06:24.292
got your 2 locations, location A
location B you can parse course
through them. And your provider.

00:06:24.292-->00:06:30.292
So. You’ve got voicemail, all of
these things. And then your
large deployment looks like

00:06:30.292-->00:06:38.250
that, right? You have redundancy
failovers and a whole bunch of
other things which really looks

00:06:38.250-->00:06:44.208
like this. Nobody knows what it
looks like but you have call
monitoring, transcribing all of

00:06:44.208-->00:06:50.375
those. Um voice biometrics is
interesting and people use it
for 2 factor authentication and

00:06:50.375-->00:06:55.417
they really use telephone
numbers for a whole bunch of
things. So your common protocols

00:06:55.417-->00:07:03.125
are far as VoIP goes you sesh
initiat- session initiation
protocol um the example for that

00:07:03.125-->00:07:10.000
is on the right. You- it’s very
similar to HTTP you’ve got a
text protocol that you send a

00:07:10.000-->00:07:16.583
request and get a response, it’s
very similar so and it’s to
initiate a session, a media

00:07:16.583-->00:07:23.000
session, which will be the RTP
string which is the real time
protocol. And then you have H323

00:07:23.000-->00:07:29.833
which is just a number, it’s
kind of a competitive SIP. And
IAX was supposed to kind of be

00:07:29.833-->00:07:36.667
another competitive SIP which
was created by the creator of
Asterisk and that one that was

00:07:36.667-->00:07:42.083
supposed to address some pro-
problems with SIP but it never
really took off as much. And

00:07:42.083-->00:07:49.042
XMPP is another one Extendable
Messaging and Presence Protocol.
That’s a mouthful. Uh they all

00:07:49.042-->00:07:54.792
kind of facilitate phone calls,
and then once you’ve facilitated
or orchestrated that call you

00:07:54.792-->00:07:59.792
have the media which is
transported through a codec. And
there’s a bunch of these, people

00:07:59.792-->00:08:04.750
geek out over these all the
time. Uh they’re the ones you
really have to be concerned

00:08:04.750-->00:08:10.875
about PCM Alaw Ulaw and then GSM
and, uh Ulaw is for North
American Alaw is for other

00:08:10.875-->00:08:21.708
countries. And let’s see. DTMF
is your dual tone mult- multi
frequency so you know ev- when

00:08:21.708-->00:08:25.500
you pick up the phone and you
dial a number you hear the beeps
and then you dial extensions you

00:08:25.500-->00:08:29.292
hear the beeps it’s basically 2
tones done at the same time or 2
frequencies. And people are

00:08:29.292-->00:08:36.375
pretty familiar with these.
These can be easily generated.
And that’s what happens when you

00:08:36.375-->00:08:40.500
press a button on your phone.
And so when yeah somebody says
“We wanna test our phone

00:08:40.500-->00:08:44.083
systems.” the first thing, I say
“you gotta figure out what
you’re testing,”‘cause the phone

00:08:44.083-->00:08:47.833
system could be anything.
Alright there’s there’s a ton of
stuff to test and the first step

00:08:47.833-->00:08:54.625
is to find out what you want to
test. So your hardware,
software, all the user agents,

00:08:54.625-->00:09:00.208
PBXs, SoftPhones. The apps
protocols codex and each of
those is gonna require their own

00:09:00.208-->00:09:07.083
specialized skill set to get
down into the nitty gritty. And
it’s a uh diverse set of skills

00:09:07.083-->00:09:11.792
is needed. So. Once you’ve
figured out what you’re testing,
you’ve got your black box your

00:09:11.792-->00:09:16.042
white box, you know determine
the scope, are you trying to be
stealthy? Are you trying to

00:09:16.042-->00:09:21.333
avoid detection? Or are you
trying to test your detection
capabilities. Uh what is outer

00:09:21.333-->00:09:25.583
limits? You don’t want to go
treading on people's people’s
feet when you’re testing this

00:09:25.583-->00:09:29.958
because it’s not the system you
thought you were testing ‘cause
you dialed into something and it

00:09:29.958-->00:09:35.000
turns out you don't own that
product. So you do your
information gathering and that

00:09:35.000-->00:09:41.417
consists of right- uh OSINT.
Right you can grab phone numbers
from the web that the company

00:09:41.417-->00:09:47.333
you’re testing’s website. They
generally list a bunch of phone
numbers there. Or you can use

00:09:47.333-->00:09:50.667
corporate directories and look
for patterns in the phone
numbers because you can find ‘em

00:09:50.667-->00:09:57.292
there. Um do port scans. It’s
not easy on the web if you’re
looking for like SIP traffic um

00:09:57.292-->00:10:04.833
it’s very noisy. So you should
kind of throttle that down a
bit. And when I say use the web

00:10:04.833-->00:10:10.333
I mean just google and use like
free carrier lookup tools to
see. Um when I’m talking about

00:10:10.333-->00:10:15.417
looking for patterns you see a
red- a company will register a
block of phone numbers but they

00:10:15.417-->00:10:20.167
may not publish. They may not
publish all of them because
there’s something in them they

00:10:20.167-->00:10:25.500
don’t want you to see. Um Whois
has information. I was trying to
contact google and I was

00:10:25.500-->00:10:30.458
googling for the google’s phone
number which is really
difficult. But they list it in

00:10:30.458-->00:10:35.167
their Whois if you ever need to
call google plex just Whois them
and then you can you can find

00:10:35.167-->00:10:40.083
their phone number. So.
Externally testing for through
POTS. You can sit there with a

00:10:40.083-->00:10:46.625
regular telephone like any
telephone, a cell phone or your
landline. And press buttons.

00:10:46.625-->00:10:50.375
Right. That’s that’s what we’re
talking about here is testing
someone said “I wanna test my

00:10:50.375-->00:10:56.167
phone system” and you would say
“OK”. Or you could maybe use a
modem with AT command some uh

00:10:56.167-->00:11:00.417
script that way you can script
it out a little bit. You could
use a SoftPhone any of the major

00:11:00.417-->00:11:05.583
ones are gonna do that uh test
functionality. Uh getting more
advanced you can use the

00:11:05.583-->00:11:11.208
automatable or scriptable ones
these are really interesting but
there’s a big learning curve to

00:11:11.208-->00:11:17.625
those. I mean you have to really
get into it. Or you can use uh
just a PBX like Asterisk um

00:11:17.625-->00:11:27.625
that’s what I chose to do for an
engagement that we got to do. Um
I used uh Orange Pi 2E if

00:11:27.625-->00:11:31.542
anybody’s familiar with those.
IVery similar to uh Rasberry
where you can use a VM but I

00:11:31.542-->00:11:35.833
used it ‘cause it has really
decent specs. It can handle
Asterisk really well. It’s

00:11:35.833-->00:11:39.708
fairly portable if you need to
show it to somebody, you just
take it with you. People like to

00:11:39.708-->00:11:43.625
look at shiny things, right, it
turns out. And it doesn’t take
much to run a demo. So the

00:11:43.625-->00:11:51.167
software used Armbien and
Asterisk and a bunch of
scripting utilities. We we- get

00:11:51.167-->00:11:57.667
more into this a bit later. So
this comes the fun part, or the
time consuming part of going

00:11:57.667-->00:12:03.250
through the issues you’ll find
with the OS Top 10. So let’s
take a look. This is the uh list

00:12:03.250-->00:12:09.917
a lot of you’ll probably be
familiar with the OS Top 10 2017
which just came out, right? I’ll

00:12:09.917-->00:12:18.083
give you a minute to look over
that in case you haven’t seen it
yet, ‘cause everybody’s still

00:12:18.083-->00:12:28.208
using the what version from 5
years ago. The first one is
injection. And we all know the

00:12:28.208-->00:12:33.708
injection points for for web app
but so for a phone system you
have very similar ones. Web

00:12:33.708-->00:12:39.583
Voice, SIP, DTMF and there’s XMO
injection in there which I guess
falls into a web injection and

00:12:39.583-->00:12:44.500
the result is cross site
scripting sql injection you get
uh buffer overflows or log

00:12:44.500-->00:12:52.625
contamination. Um there was one
with Cisco phones where uh they
were injecting XML or a CV for

00:12:52.625-->00:12:57.750
it where they inject some XML
and you could monitor phone
calls or even initiate phone

00:12:57.750-->00:13:06.750
calls from these softphone- er I
guess SIP phones which is kind
of scary um. So there’s that’s

00:13:06.750-->00:13:11.250
injection we know that. We’ve
seen it before. Broken auth and
session management is very

00:13:11.250-->00:13:18.875
rampant in uh phone systems. I
mean it’s mostly authentication
but a lot of session management

00:13:18.875-->00:13:23.583
too. You can do core tear down
texts where you're breaking up
and just telling it to hang up,

00:13:23.583-->00:13:30.667
kind of like a WiFi de-off
attack. Then there’s the lack of
SL um I mean SSO has been and

00:13:30.667-->00:13:39.792
TLS has been in Asterisk since 1
point 6 version which was
released in 2008. And if SIP is

00:13:39.792-->00:13:45.875
open and controls aren’t in
place you can, you know, do your
brute forcing of that. That’s

00:13:45.875-->00:13:53.417
that’s very common. If anybody
runs PBX you’ll see that with
someone trying to hammer your

00:13:53.417-->00:13:56.042
server all day long. All day
long it never stops and if and
if it does stop and you ban them

00:13:56.042-->00:14:01.750
they’ll come from somewhere
else, yeah. Let’s move on to a
free cross site scripting. And

00:14:01.750-->00:14:04.875
who would have thought that
phones would have cross site
scripting, right? It’s a

00:14:04.875-->00:14:10.125
telephone. But believe it or not
they have it. This um screenshot
is from the previous

00:14:10.125-->00:14:16.417
presentation I’ve done but it’s
still a thing. We see a pop up
box and they’re somewhat covered

00:14:16.417-->00:14:21.875
inni- from an injection. I mean
it’s an outcome of injection.
It’s you get a cross site

00:14:21.875-->00:14:27.250
script. Uh this could be very
interesting with some payloads
with some custom payloads, or if

00:14:27.250-->00:14:33.167
you’re using a company's like
portal and you find a cross site
scripting on there you can maybe

00:14:33.167-->00:14:39.708
use that cross site scripting to
kind of map out some phone
stuff. So this uh demo is from

00:14:39.708-->00:14:45.375
an XXS that was on a system. And
it’s used what what happened is
I created a, it was

00:14:45.375-->00:14:57.458
unauthenticated XXS and but the
same software had an
unauthenticated LFI so, take a

00:14:57.458-->00:15:03.292
look at the demo. And basically
you’re using the XXS to
facilitate the LFI from an

00:15:03.292-->00:15:11.542
administrator, if you were
targeting them. So let’s take a
look. Is it playing yet? Let me

00:15:11.542-->00:15:16.625
press play. Alright so this is
the unauthenticated and that’s
they payload and I’m sorry for

00:15:16.625-->00:15:28.750
the jerkiness it’s just the way
the video recorded. So there is
the payload. It’s sent. And

00:15:28.750-->00:15:34.375
that's’ to prove that it’s
unauthenticated. So we delete
the file on the server, this is

00:15:34.375-->00:15:41.000
a shell, and this is the
authenticated user. Alright so
that’s the actual payload that

00:15:41.000-->00:15:52.875
you would s- send to them. And
when they move their mouse over
the page, what’s it doing? Huh.

00:15:52.875-->00:15:55.917
Just testing this is- you I mean
you’d have to change it if it
was running a real attack but

00:15:55.917-->00:16:04.042
then when you look on the
server, there’s a a shell. So
there’s the shell, it’s been

00:16:04.042-->00:16:08.958
owned. And it’s not rocket
science it’s cross site
scripting but it just happens to

00:16:08.958-->00:16:20.083
be a phone system so that’s why
I wanted to show that. Broken
access control A4. This is new

00:16:20.083-->00:16:26.375
for 2017 or they moved it
around. But the example is not
my account. You see that you

00:16:26.375-->00:16:32.667
have access to or you access
something and it has a string
and you change it. Uh Victoria’s

00:16:32.667-->00:16:38.667
Secret was very uh famous for
this when they had the you- you
place an order and you change

00:16:38.667-->00:16:41.958
the order number and you could
see whatever someone else had
ordered with the full account

00:16:41.958-->00:16:49.292
information. So and it that can
be translated for phone systems
into a back configuration and

00:16:49.292-->00:16:53.792
this happens when sometimes you
dial into a system and then you
dial an extension and maybe you

00:16:53.792-->00:16:57.833
can dial an external extension
which happens to be a phone
number that is externally

00:16:57.833-->00:17:04.458
routed. Maybe you can commit
toll fraud with that. So it’s
related to the next one which is

00:17:04.458-->00:17:09.000
a security misconfiguration.
Which is very common. Pretty
common. Uh SIP allowguest is

00:17:09.000-->00:17:14.792
you’re allowing anybody with a
SIP, er that wants to connect to
a SIP client to connect, and

00:17:14.792-->00:17:21.000
that’s difficult to control the
context therein within it. The 4
digit password for SIP clients

00:17:21.000-->00:17:25.708
which may happen to be the same
as the extensions is pretty
common. You’ll want to change

00:17:25.708-->00:17:32.167
that. Don’t have your, your-
your username the same as the
authentication username, there’s

00:17:32.167-->00:17:37.458
2 separate ones in there for a
reason. And conferencing
misconfigurations, maybe you

00:17:37.458-->00:17:42.375
allow somebody to dial into the
conference and then dial out.
Default passwords, weak

00:17:42.375-->00:17:48.375
passwords, those eh I consider
those misconfigurations. And
then misconfigured dial plans

00:17:48.375-->00:17:53.292
and AGI’s are probably er the
most common misconfiguration.
AGI is like the CGI of Asterisk

00:17:53.292-->00:18:04.042
system. So. There’s that.
Sensitive data exposure. Depends
who you talk to but voicemail

00:18:04.042-->00:18:10.083
conferencing, pretty sensitive
information may get talked about
on those. Uh corporate

00:18:10.083-->00:18:15.000
directories. If you're dialing
in may not, you know maybe
there's some information in

00:18:15.000-->00:18:21.792
there that shouldn’t be. Uh
we’ve seen it before. Of uh, uh
I think like Nick is probably

00:18:21.792-->00:18:26.125
the most famous that exploited
that. Uh the and then the
information I’ll use that as

00:18:26.125-->00:18:31.667
well, like the username password
combination enumeration. That’s
this is all I could come up

00:18:31.667-->00:18:36.792
with, for the math that leads to
the OS Top 10 so it's kind of,
once you’re on the system

00:18:36.792-->00:18:41.708
there’s a ton of information in
there. Um username passwords,
voicemail passwords, um you

00:18:41.708-->00:18:46.625
credit card numbers, account
numbers, verification pe- I mean
all of this is once you’re on a

00:18:46.625-->00:18:51.875
system is there but if you’re
just talking externally testing
maybe there’s some sensitive

00:18:51.875-->00:18:59.250
information maybe not. You have
to dig in and find, find it.
Missing function, level access

00:18:59.250-->00:19:02.417
contr- you- these kind of
overlap together because, when
you're talking about phone

00:19:02.417-->00:19:09.750
systems. But uh the company or
the place I used to work had a
system that you would uh the

00:19:09.750-->00:19:16.083
offender had the system that
they would dial into and the
only access control they had

00:19:16.083-->00:19:23.583
around this was the caller
ID.They trusted the caller ID.
And you could, if you did your

00:19:23.583-->00:19:28.792
reconnaissance and knew who the
vendors were, you could pretty
much just dial into this system

00:19:28.792-->00:19:34.583
and you'd have full telenet
access with no password, because
they trusted the caller ID but

00:19:34.583-->00:19:41.250
everybody knows you can spoof
your caller ID. Ha ha. So that
was kind of a big fail, but it

00:19:41.250-->00:19:50.083
was very difficult to get them
to say “We really need to change
this.” So let’s see what else

00:19:50.083-->00:19:56.667
we’ve got for missing function.
Uh level access control. And
then like I was saying these are

00:19:56.667-->00:20:02.542
ce- do overlap uh A5
misconfiguration is very related
to missing function level access

00:20:02.542-->00:20:06.875
control ‘cause if it’s
configured properly you would
uh, if it’s configured properly,

00:20:06.875-->00:20:14.000
you wouldn't have these issues.
Uh misconfiguration with if
you’re putting people back into

00:20:14.000-->00:20:20.750
a different context once they’ve
authenticated. Uh maybe they
have access now to something

00:20:20.750-->00:20:26.083
that they didn’t have access to
before. And reasonable use is
boiling down to don’t let people

00:20:26.083-->00:20:31.208
sit and camp on your phone lines
all day long going through menus
and maybe if they’re 5 levels

00:20:31.208-->00:20:37.083
deep you find a combination and
it gets you back to the first
level. You know that’s an issue.

00:20:37.083-->00:20:44.417
So have session timeouts for
trunking cause you don't want to
let too many people connect, and

00:20:44.417-->00:20:50.542
you’ve lost your trunks which
you have to pay for. Cross site
request forgery is very common

00:20:50.542-->00:20:58.125
for vendor uh apps and products
because not everybody patches
those. Um it’s the web portals

00:20:58.125-->00:21:05.208
and configuration pages are very
common and often vulnerable and
really from a phone since this

00:21:05.208-->00:21:10.000
this one doesn't really apply
right. There’s no CSRF or
dialing in to phone systems. But

00:21:10.000-->00:21:15.000
if you did your enumeration
properly you would know which
products a vendor was using and

00:21:15.000-->00:21:20.417
you'd be able to maybe target
them more specifically. And
we'll get into a situation kind

00:21:20.417-->00:21:25.875
of similar to CSRF ‘cause all
CSRF is is you’re exploiting the
user’s trust in a service. And

00:21:25.875-->00:21:30.875
this is A9 the next one. I did a
pivot chart in Excel which you
probably can't really see.

00:21:30.875-->00:21:36.208
Actually it comes out better on
that screen than it does on
mine. And it looks like really

00:21:36.208-->00:21:41.875
the best way into a phone system
is through code execution
overflow go figure. If you want

00:21:41.875-->00:21:47.542
a good level of access. I um I
put as many as I could
vulnerabilities as I could in

00:21:47.542-->00:21:52.333
there, and that’s what it came
up with. But I’m sure somebody
with more Excel furor more risk

00:21:52.333-->00:21:57.833
uh experience could probably
come up with something really
fancy for that so. It’s just a

00:21:57.833-->00:22:02.583
little thing I’ve been working
on. Um but it's, when you’re
talking about components with

00:22:02.583-->00:22:06.667
known vulnerabilities you’re not
talking about just PBX you have
everything in the stack, right?

00:22:06.667-->00:22:12.375
Your Softphones all the user
agents and everything in
between. So it’s really hard to

00:22:12.375-->00:22:17.083
patch everything. Everybody
knows you can’t patch
everything. But we wish we

00:22:17.083-->00:22:23.333
could. So one of the examples
for a known vulnerability is
this little box this is a Cisco

00:22:23.333-->00:22:29.083
ATA 182 they still sell these on
you know what is it 40 60 bucks.
And that’s what translates your

00:22:29.083-->00:22:38.625
analog phone to a to BOT SIP.
And in 2002 they had a bug on it
but that’s what it looks like if

00:22:38.625-->00:22:44.500
you find one on the web, that’s
what it looks like when you log
in, and if you try and connect

00:22:44.500-->00:22:52.083
with SSL you you can’t connect.
And that’s Cisco's uh end of
life announcement for 2010 but

00:22:52.083-->00:22:57.333
these are still used. And the
bug actually was you could
bypass the authentication

00:22:57.333-->00:23:02.333
completely by sending a few
headers with the HTTP request
which is which is great because

00:23:02.333-->00:23:09.542
you know everybody updates this
box that's in on their network
right? Nope. So I’m pretty sure

00:23:09.542-->00:23:14.500
that CSRF would work on that
portal too if you really wanted
to. So you you really can’t

00:23:14.500-->00:23:21.083
patch everything. And then this
is the last one for the OS top
10. Under protected APIs which

00:23:21.083-->00:23:27.458
is new. The AGI is your gateway
interface um that sits internal
to the PBX. That, really isn’t

00:23:27.458-->00:23:37.208
an externally facing API but it
may be underprotected or there
may be not be controls in place

00:23:37.208-->00:23:43.250
for that. And the ARI is your
Asterisk rest interface. That is
often sitting on the web and it-

00:23:43.250-->00:23:49.875
I’m sure other vendors have all
their own APIs. And webRTC is
coming up more and more you’ll

00:23:49.875-->00:23:54.833
see a lot of these with web
sockets misconfigured there's a
huge huge uh attack surface for

00:23:54.833-->00:24:00.250
websockets ‘cause not everybody,
it’s not had as much testing.
And then user agents being able

00:24:00.250-->00:24:06.167
to be have their own APIs like
the Softphone or, in the SIP
Phone in the picture actually

00:24:06.167-->00:24:15.708
runs JavaScript natively on the
phone and has JSON and JS and
I’m sure that API is Digium uh,

00:24:15.708-->00:24:21.625
they do a pretty good job of, of
securing their stuff they have a
pretty good security team so I’m

00:24:21.625-->00:24:25.792
sure it works good. This is what
I would say the mapping for
phone systems would look like.

00:24:25.792-->00:24:33.667
Just reordered it a little bit.
Um misconfiguration probably
being the top one and going down

00:24:33.667-->00:24:38.250
those you can all read those.
There’s really no evidence or
research into this this is what

00:24:38.250-->00:24:42.375
I think and I’d love to debate
or get people who would like to
debate that and kind of do a

00:24:42.375-->00:24:48.083
good list for it because the
VoIP security alliance is kind
of dead at this point. I think

00:24:48.083-->00:24:53.792
they’ve been dead for, I know
their website... >>[unclear
voice from crowd] >>...went

00:24:53.792-->00:24:57.708
down. Do what? >>You’re not
wrong! >>I’m not wrong! Thank
you. I mean I was looking at the

00:24:57.708-->00:25:01.375
d-, man, it’s been how many
years since they’ve done
anything? But and they were

00:25:01.375-->00:25:10.208
doing a good job before, but.
Let’s move let’s move on past
that so. Using Asterisk to test.

00:25:10.208-->00:25:15.708
I made a vagrant machine and
it’s in the GitHub repo. You can
do it you just have to configure

00:25:15.708-->00:25:21.042
a few things the extensions dot
com from the sip dot com. And
once you do it you get a console

00:25:21.042-->00:25:27.625
and then you can configure
things like your AGIs and it’s
very similar to you know a- a

00:25:27.625-->00:25:33.458
router or metasploit you know.
You can see the the great syntax
there “core show help core show

00:25:33.458-->00:25:38.000
help” and that will show you the
help ‘em , on the help. It’s
it’s very easy to use trust me.

00:25:38.000-->00:25:44.542
[laughs] But no, it’s it’s not
very easy to use there’s a lot.
And the best thing you can do to

00:25:44.542-->00:25:49.750
kind of learn it is, is at the
bottom, the command reference,
if you wanna kind of get into

00:25:49.750-->00:25:56.167
it. Uh you use any of the
SoftPhones to connect once you
have it configured. So this is

00:25:56.167-->00:26:08.458
more of the fun stuff um. So for
my job uh they said they wanted
to test the phone systems. So

00:26:08.458-->00:26:13.500
okay I got actually put on as a
secondary to it because one of
the other testers had snapped it

00:26:13.500-->00:26:18.333
up from the que. And they said
ok what do you wanna test? Well
we wanna we’ll give you the

00:26:18.333-->00:26:23.875
phone number and you can just
dial in [chuckles] and you can
test it, right? Ok well it

00:26:23.875-->00:26:29.750
sounds a lot like QA to me
[chuckles] doesn't really sound
like testing, but the other

00:26:29.750-->00:26:35.458
tester he was using modem and
ATM- AT commands and going
though and he actually developed

00:26:35.458-->00:26:42.167
a twitch because he heard the
the uh intro the the music too
many times now if if he hears it

00:26:42.167-->00:26:50.042
again he, he winces but I I
didn’t like uh umm I didn’t
wanna sit there dialing the same

00:26:50.042-->00:26:54.792
thing all day and just hopefully
coming across something so I had
this idea from some previous

00:26:54.792-->00:26:59.333
things we’ve done to kind of do
a man in the middle. And uh I
didn’t have any idea if it would

00:26:59.333-->00:27:05.083
work but I kind of had a hunch
that it would s- and so I worked
on that. And it’s nothing new

00:27:05.083-->00:27:10.250
from an attack perspective but
it sure beat sitting there and
dialing numbers all day. So what

00:27:10.250-->00:27:17.250
happened was we c- came up with
2 vectors for it. And we called
the first one the fat finger

00:27:17.250-->00:27:22.542
squat and the second one’s the
spoof target vish. And the first
one anybody who is familiar with

00:27:22.542-->00:27:28.917
like Crank Yankers or pranksters
will kind of know this one. And
then the spoof target phish is

00:27:28.917-->00:27:38.042
really just an extension of
that. So vector A, the fat
finger squat. What we have there

00:27:38.042-->00:27:44.500
is this guy this um he’s he
looks like a pirate with one
hand it’s only a hook. So when

00:27:44.500-->00:27:49.500
he dials who he thought he was
dialing he actually dials the
grim reaper in this case who

00:27:49.500-->00:27:56.000
just goes ahead and patches that
to the person he thought he was
calling, based off of say, in

00:27:56.000-->00:28:00.917
the Crank Yankers right you
heard that like the lady that
dials in trying to get the Honda

00:28:00.917-->00:28:06.583
dealership but it wasn’t the
Honda dealership. So in this
case it’s a little bit more

00:28:06.583-->00:28:10.333
malicious, instead of pranking
her they just patch her through
and then listen to everything

00:28:10.333-->00:28:17.375
so. Let’s test the audio for
this um. What I did was I
forwarded my home phone number

00:28:17.375-->00:28:23.792
to our corporate line. Let’s
see. For the demo I did not use
our corporate line. ‘Cause well

00:28:23.792-->00:28:29.208
yeh- any company would be
vulnerable to this because
really there’s nothing you can

00:28:29.208-->00:28:46.542
do. See if we have any audio. No
audio. It’s very quiet. I’ve got
my volume up max, it’s plugged

00:28:46.542-->00:28:56.500
in. >>[inaudible off mic] >>We
we could do that. We could
unplug it and use the mic, we’ll

00:28:56.500-->00:29:02.208
try. Since, since we kind of
have to do something cause this
very much relies on sound. Now

00:29:02.208-->00:29:13.458
I’m not, now I don’t have any
sound. This is great! It won’t
let me do anything. Let me plug

00:29:13.458-->00:29:21.958
it back in. What a demo fail.
And it wasn’t even a hard demo.
Let’s see now if we have sound.

00:29:21.958-->00:29:32.292
Uh the audio guy is coming. It’s
alright, we’ve got some time.
There’s not much left to cover,

00:29:32.292-->00:29:58.917
so. What’s going on with this?
It’s plugged in. Oh it’s that
plug there. >>Try it now >>K

00:29:58.917-->00:30:08.958
hold up. Nothing. >>[off mic
inaudible] >>Stuff just goes
crazy. And now the signal is

00:30:08.958-->00:30:18.083
gone. Don’t you love it when
things go so smoothly. >> [from
the crowd] Have you tried

00:30:18.083-->00:30:23.083
turning it off and on again?
>>Have I tried turning it off
and on again? [chuckles]

00:30:23.083-->00:30:33.042
[audience laughs] Ok that’s the
HDMI. Nope. That’s the best. The
best sound ever. >>Did you plug

00:30:33.042-->00:30:41.708
in HDMI? >>I just plugged in
HDMI. >>[unclear offmic] >>Yeah.
>>I just heard something play.

00:30:41.708-->00:30:46.792
>>Yeah I just unplugged the HDMI
so I lost uh audio uh lost
everything but it’s coming back

00:30:46.792-->00:30:58.708
on now so. Let’s take a look.
Sorry guys. >>[unclear off mic]
>>They told me to do it for a 3

00:30:58.708-->00:31:15.500
quarter inch jack, so.
[chuckles] This is weird. >>Are
you logged in? >>No, it’s frozen

00:31:15.500-->00:31:21.792
now. >>Oh what? >>It’s great
>>Uh you wanna reboot? Let’s get
this thing going. >>Yeah.

00:31:21.792-->00:31:34.375
Normally I just...did somebody
put a magnet under here?
>>[laughs] Right. Classic Def

00:31:34.375-->00:31:42.917
Con tradition >> [unclear off
mic] >>He’s he’s frozen right
now >>It’s it’s it’s busted now

00:31:42.917-->00:31:44.583
[chuckles]. >>Yeah ‘cause when
you plug in the HDMI it will
send it... >>Yeah, it was set to

00:31:44.583-->00:31:49.583
the cord. S- uh we’ll give it
uh, if you can be patient, we’ll
give it a minute. >>[unclear off

00:31:49.583-->00:31:55.625
mic] >>It was stuck on the other
one and when I tried to do it
it >>Yeah we’ll change the

00:31:55.625-->00:32:03.125
audio out, get it working.
>>When it boots uh yeah we’ll
we’ll give it a shot [chuckles]

00:32:03.125-->00:32:11.458
>> Hooray. >>Well it’s your
first time speaking, I mean this
has to happen. >>One and a half

00:32:11.458-->00:32:21.292
I guess. >>Ok yeah, okay
[chuckles] >>Alright. Not that
big of a deal right? >>Here we

00:32:21.292-->00:32:28.833
go. Umm you wanna jump into to
some preferences and hit the
speaker up here? And then we can

00:32:28.833-->00:32:44.792
choose the output device? K show
volume in bar. Okay so now umm
you can just do internal

00:32:44.792-->00:32:51.292
speakers >>Yeah >> And use the
mic, ‘cause this.. >>That’s
fine, yeah. >>Alright. Got it?

00:32:51.292-->00:33:02.375
>>Let’s get give that shot.
Alright sorry about that. Now I
have to switch the monitors

00:33:02.375-->00:33:11.958
again. Bah. Right there. It’s
alright let’s let’s use the mic.
How we doing on time now? I lost

00:33:11.958-->00:33:18.792
it. Alright so again yeah this
is the, the demo for it so I had
to call the New York Public

00:33:18.792-->00:33:23.250
Library because I didn’t know
who else to call that wouldn’t
get me in trouble. So let’s see.

00:33:23.250-->00:33:33.667
And that’s not working either.
Alright that’s great. Alright we
will skip the recorded demo

00:33:33.667-->00:33:41.750
[chuckles] and you can trust me
that it works. So yeah. I have a
recording of it, so I’ll put

00:33:41.750-->00:33:46.958
that in the GitHub too. So the
spoof target vish is pretty much
the same thing but it was an add

00:33:46.958-->00:33:51.625
on for it. Because basically
what you have now is the
attacker is taking taking it

00:33:51.625-->00:33:58.292
into their own hands and calling
the guy with one hand. And maybe
he has a context maybe he

00:33:58.292-->00:34:02.333
doesn’t. Maybe there’s someone
complaining on Twitter how the
service isn’t working so the

00:34:02.333-->00:34:09.292
attacker goes “hey I’m gonna
call this guy and kind of calm
him down. And then after- I’ll

00:34:09.292-->00:34:15.542
patch him in to the real the
real place.’” So if the demo
worked what you would left be

00:34:15.542-->00:34:22.917
left with is a recording which
would contain, what would that
contain? Maybe DTMF tones or

00:34:22.917-->00:34:33.333
maybe voice authentication that
would be relevant, something you
might have an interest in. And

00:34:33.333-->00:34:39.875
yeah you if you got DTMF tones
in there you could potentially
decode those. It’s pretty

00:34:39.875-->00:34:44.625
difficult to decode them, to be
honest, ‘cause of codexing. It
can be done and it could

00:34:44.625-->00:34:49.958
possibly be done better with
like a hardware decoder or maybe
an ATA. Or if somebody with more

00:34:49.958-->00:34:55.875
skills comes in and actually
writes something so that when
it’s incepted the call it fully

00:34:55.875-->00:35:04.750
disconnects if from the other
side. But that would be uh a
problem right? If you’re

00:35:04.750-->00:35:11.917
entering account numbers you can
see that. What happens a lot of
items is when you type uh a

00:35:11.917-->00:35:17.125
number in it will repeat it back
to you. If you’re not using an
IVOC when they say “Please enter

00:35:17.125-->00:35:24.417
your account number” and you say
“1 2 3 4 5” if you know it says
“You entered 1 2 3 4 5 is this

00:35:24.417-->00:35:32.458
correct?” You know that’s kind
of a problem. So let’s see if uh
this one works ’cause. That one

00:35:32.458-->00:35:41.750
works. >>[from video] That was
account number 1 2 0, right?
>>So yeah if you can’t decode

00:35:41.750-->00:35:49.000
the DTMF sometimes it just plays
it back to you. Which is I mean
m- maybe a problem for you.

00:35:49.000-->00:35:56.917
Maybe it’s not. The Phreak Me is
a project we’ve been working on,
it’s all on GitHub uh uh we,

00:35:56.917-->00:36:01.500
we’re messing around with
voicemail stuff uh and spoofing
caller IDs saying “Hey, if

00:36:01.500-->00:36:06.875
you’ve got a phone numb- a phone
call from your voicemail, would
you answer it? Would you enter

00:36:06.875-->00:36:12.500
your pin?” So that’s kind of
what this was spawned out of.
And I put a RTFM on there,

00:36:12.500-->00:36:17.292
‘cause there’s a, if anybody has
seen the Red Team Field manual,
there is nothing in there about

00:36:17.292-->00:36:23.250
voice so I've started compiling
tools and things you can use to
test phone systems in there. And

00:36:23.250-->00:36:29.542
I’ve done as much as I can in
there and there's more changes
to come too to it. I’ve got some

00:36:29.542-->00:36:34.833
ideas and things to do.
>>[unclear off mic] >>Whichever
demo. >>[unclear off mic] >>This

00:36:34.833-->00:36:44.833
one? >>Yeah. >> Yeah there’s not
a whole lot to it, I can try.
>>[from video] Thank you for

00:36:44.833-->00:36:50.708
calling Aster NYPL our normal
hours of operation are Monday
through Saturday from 9 to 6.

00:36:50.708-->00:36:59.500
You can email your reference
questions or chat with a
reference rep. For the hours and

00:36:59.500-->00:37:02.958
locations of the Schwarzman
building, please press 1. >>S-
>>[video trails off] >>So that

00:37:02.958-->00:37:07.458
was what happened when you
called my home phone number now
I just forward it through to

00:37:07.458-->00:37:15.250
NYPL and record it. So not much
for a demo but it’s something.
And uh coming from “Hey here’s

00:37:15.250-->00:37:20.583
your phone numb- here’s a phone
number can you test it?” That
was a kind of a cool thing to to

00:37:20.583-->00:37:25.875
do, so. Some additional things
you can look at if you’re
interested in VoIP security or

00:37:25.875-->00:37:31.292
voice security is this book by
Syngress publishing. It was
published I think in about 2005

00:37:31.292-->00:37:40.250
it is a really good book it has
a ton of information I think
it’s about 800 pages. And Fatih

00:37:40.250-->00:37:43.667
he does uh VoIp Wars he’s in a
bunch of stuff here at Def Con
and uh all around the world.

00:37:43.667-->00:37:50.167
He’s done a lot of really good
stuff. Anything from him is
pretty much awesome. And Jason

00:37:50.167-->00:37:56.125
Ostrom did VoIP Hopping the
Hotel if you wanna look at that.
His way you have a phone system

00:37:56.125-->00:38:01.667
you can hope VLans. That was
really good. And then just for
reference there’s the voipsa at

00:38:01.667-->00:38:08.500
the at the bottom there so.
That’s about all I have um. I
would I’d really like to see

00:38:08.500-->00:38:13.458
more people get interested in
phone systems again because you
know you had 26 hundred in the

00:38:13.458-->00:38:17.833
phreaks um and there’s
telephreak too. But it doesn’t
seem like a whole bunch of

00:38:17.833-->00:38:22.333
people are testing their phone
systems. So that’s really what I
was getting at with this. I mean

00:38:22.333-->00:38:29.625
I play with them for fun and I
submitted this talk and you guys
accepted it. So yeah I mean

00:38:29.625-->00:38:38.083
things have been evolving at a
rapid rate but have we been
testing? I I don’t know. So

00:38:38.083-->00:38:42.708
hopefully this has been useful
gave you guys some insight uh
some things you can do that

00:38:42.708-->00:38:47.583
might help get you interested.
And if you have any ideas or
things you you wanna suggest

00:38:47.583-->00:38:52.333
then you can catch me
afterwards. I’ll be down there
catch me on twitter, the slides

00:38:52.333-->00:00:00.000
are all on GitHub like I said.
So. That’s it, thank you very
much. [applause]