1 00:00:44,380 --> 00:00:45,420 Hi there! 2 00:00:45,420 --> 00:00:52,880 So we are live with the speakers who presented on practical VoIP hacking using Mr. 3 00:00:52,880 --> 00:00:53,640 Sip. 4 00:00:53,640 --> 00:00:56,640 And welcome, welcome to DEF CON Safe Mode. 5 00:00:56,640 --> 00:01:00,540 Not quite what you would normally have expected probably for coming to Vegas, right? 6 00:01:00,540 --> 00:01:05,880 But glad that you're able to join us and share some information with us. 7 00:01:06,060 --> 00:01:09,860 I understand though that you are both first-time speakers at DEF CON. 8 00:01:09,860 --> 00:01:10,860 Is that correct? 9 00:01:11,520 --> 00:01:13,040 Yes, that's correct. 10 00:01:13,040 --> 00:01:13,520 Thank you. 11 00:01:13,520 --> 00:01:14,920 Thank you for the opportunity. 12 00:01:15,340 --> 00:01:16,620 Yeah, that's great. 13 00:01:16,620 --> 00:01:28,040 Yeah, so we have a tradition here at DEF CON for first-time speakers where really it's a historical tradition of where we kind of do a shot or a drink with someone on stage to kind of welcome them to DEF CON. 14 00:01:28,040 --> 00:01:36,420 So as your first-time speakers, I'd like to, you know, hold up a cup and have a drink here with you both and say cheers and say welcome to DEF CON. 15 00:01:37,160 --> 00:01:38,160 Okay. 16 00:01:38,160 --> 00:01:39,480 Yep, cheers. 17 00:01:48,960 --> 00:01:50,760 That was strong. 18 00:01:51,120 --> 00:01:53,100 A little early where you are. 19 00:01:53,100 --> 00:01:54,280 Strong coffee. 20 00:01:55,440 --> 00:01:57,040 Awesome, awesome. 21 00:01:57,320 --> 00:01:58,380 Yeah, so that's great. 22 00:01:58,380 --> 00:02:01,840 So let's get into a couple of the questions and everything. 23 00:02:02,060 --> 00:02:05,820 First off, right, so we recorded the talk a little bit ago. 24 00:02:06,080 --> 00:02:09,600 Really, right, like since you recorded and kind of presented on Mr. 25 00:02:09,600 --> 00:02:15,000 Sip here at DEF CON, are there any major changes or updates you kind of want to share with the audience? 26 00:02:17,180 --> 00:02:26,580 So first of all, so inside this presentation, DEF CON, we actually show most of the new updates. 27 00:02:26,580 --> 00:02:28,360 So they were not published before. 28 00:02:28,360 --> 00:02:33,440 So exclusively we presented many other modules and all these demos. 29 00:02:33,440 --> 00:02:38,120 They're all new and we first time showed them in DEF CON. 30 00:02:38,120 --> 00:02:54,040 Since the video published, like in a week's time, we are still updating the documentation and the YouTube channel we have, Twitter page we have, people can follow, and the GitLab page we use to host the website for the pro version. 31 00:02:54,040 --> 00:02:56,540 So these are the recent updates we can say. 32 00:02:56,540 --> 00:03:00,360 But other than that, the whole DEF CON experience is the new update. 33 00:03:00,360 --> 00:03:05,180 So everything we show is the new content, all these pro features, the new modules. 34 00:03:05,180 --> 00:03:11,320 They were not published before and then right now we just introduced them. 35 00:03:12,380 --> 00:03:13,620 Awesome, awesome. 36 00:03:14,120 --> 00:03:23,200 Yeah, so kind of, I guess also to kick things off here, so kind of what drew you to like VoIP research and SIP security and like kind of the origin for Mr. 37 00:03:23,200 --> 00:03:23,920 SIP? 38 00:03:24,860 --> 00:03:27,760 Okay, that's a big question, I think. 39 00:03:28,660 --> 00:03:34,160 Millie, I would like to answer that and if you would like to add something after that, you're welcome. 40 00:03:34,460 --> 00:03:35,200 So Mr. 41 00:03:35,200 --> 00:03:57,600 SIP goes back to 2011 and one of our meetings with Millie also goes back to one of like 2012 or 2013 interviews because like once I had a job application in Millie's company and he was interviewing me, but there was no SIP at that time, but that is just once we came to meet each other. 42 00:03:57,980 --> 00:04:07,560 And around that time, so Millie was working for a big telecom company, one of the biggest in the world, and they had the SIP team and security team there. 43 00:04:07,560 --> 00:04:29,080 They were developing one internal tool and with that internal tool, they were also hiring somebody like a research supporter and then in 2012, I think they didn't have NDA and one of that guy who was not hired forked the project and also published some open source modules, 44 00:04:29,080 --> 00:04:35,700 but I think the project didn't go too deep because it doesn't have any like... also that's a comparison, I think. 45 00:04:35,700 --> 00:04:40,940 We can't say it doesn't have any noble or unique exploits vulnerabilities inside, but Mr. 46 00:04:40,940 --> 00:04:46,200 SIP stands out that it is both scientific and practical. 47 00:04:47,000 --> 00:04:50,600 It is very interdisciplinary, I would say. 48 00:04:53,300 --> 00:05:08,140 It has full automatic modules that does all the vulnerability search, but then in the real world attacks, it is utilizing novel exploits, CVEs that is even just not published before Mr. 49 00:05:08,140 --> 00:05:12,500 SIP, so it contains a lot if you compare with other things. 50 00:05:12,880 --> 00:05:21,620 But if we go back again 2012 to 2015, Melih worked on a closed source project, different version of Mr. 51 00:05:21,620 --> 00:05:26,340 SIP that was kept always private and closed under the company. 52 00:05:26,700 --> 00:05:34,720 And by 2015, Melih left the company and he was thinking and by coincidence, we met in Black Hat London 2016. 53 00:05:34,980 --> 00:05:38,920 We said, oh, hi, you interviewed me four years ago and I said, oh, how's it going? 54 00:05:38,920 --> 00:05:41,340 He said, oh, I quit that company, et cetera. 55 00:05:41,480 --> 00:05:42,920 And then this was the story. 56 00:05:42,920 --> 00:05:44,560 We said, okay, what is happening, Mr. 57 00:05:44,560 --> 00:05:44,860 SIP? 58 00:05:45,040 --> 00:05:51,140 He said, I want to program it from scratch, make it bigger, make it like Perp Suite. 59 00:05:51,140 --> 00:05:59,840 We had the idea that we could make it just like a real application that every penetration tester is using. 60 00:06:00,240 --> 00:06:02,660 That was a dream in 2016. 61 00:06:02,800 --> 00:06:06,420 Nowadays, after four years, we have about 10 modules. 62 00:06:06,420 --> 00:06:08,500 It is becoming a reality. 63 00:06:09,080 --> 00:06:14,540 So we work hard on those programming, software engineering, because it is a big project. 64 00:06:14,540 --> 00:06:19,060 It is not one time published application, but it's evolving all the time. 65 00:06:19,060 --> 00:06:21,820 And we have lots and lots in the roadmap. 66 00:06:22,380 --> 00:06:32,840 First, it appeared many times in arsenals, Black Hat arsenals and some other technical conferences, practitioners conferences. 67 00:06:32,980 --> 00:06:38,500 And also many published several research articles during his PhD. 68 00:06:38,840 --> 00:06:39,380 So Mr. 69 00:06:39,380 --> 00:06:45,280 SIP actually gave him both, I would say, almost like a startup company and a PhD. 70 00:06:45,280 --> 00:06:54,520 So there are a lot of, I think, events happened through the history of Mr. 71 00:06:54,520 --> 00:06:54,800 SIP. 72 00:06:54,800 --> 00:06:56,480 It is a small application. 73 00:06:57,400 --> 00:07:02,860 It has several journals behind a PhD work, like a four years of PhD work. 74 00:07:03,100 --> 00:07:06,000 Plus, it is becoming almost like a startup. 75 00:07:06,000 --> 00:07:19,040 But the main idea is that we keep it open source and we want community to use it and see that how SIP is important, VoIP attacks are important, and how they can just have a reliable tool. 76 00:07:19,860 --> 00:07:20,080 Cool. 77 00:07:20,080 --> 00:07:20,660 That's awesome. 78 00:07:20,660 --> 00:07:24,640 Yeah, there actually is a question in the chat about why does the website for Mr. 79 00:07:24,640 --> 00:07:26,820 SIP Pro require signing into GitLab? 80 00:07:26,820 --> 00:07:28,920 Is that maybe one of the other ones? 81 00:07:29,440 --> 00:07:31,240 Oh, it is, I think, not ready. 82 00:07:31,240 --> 00:07:31,760 That's why. 83 00:07:31,760 --> 00:07:41,040 So we didn't want Google to index something that is like a demo content because we have the template now imported in GitLab and it is getting updated. 84 00:07:41,040 --> 00:07:41,940 We are keeping it. 85 00:07:41,940 --> 00:07:44,720 But we didn't want to show it half missing. 86 00:07:44,720 --> 00:07:46,020 So it is just ongoing. 87 00:07:46,020 --> 00:07:47,060 It's very new. 88 00:07:47,060 --> 00:07:57,160 And we wanted to include the link because the DEF CON video will remain online and maybe next week it will be open, the website, the Mr. 89 00:07:57,160 --> 00:07:58,480 SIP Pro website. 90 00:07:58,560 --> 00:08:02,640 But right now, it is still ongoing. 91 00:08:02,640 --> 00:08:05,100 That's why it requires sign-in. 92 00:08:05,100 --> 00:08:07,780 Even if you sign in, it will say you're not authorized. 93 00:08:07,960 --> 00:08:11,200 But I think I'm happy if people go and sign up to GitLab. 94 00:08:11,200 --> 00:08:12,400 GitLab is cool. 95 00:08:13,340 --> 00:08:15,920 It's free and it allows a lot of things. 96 00:08:15,920 --> 00:08:17,560 Awesome, awesome. 97 00:08:17,560 --> 00:08:19,240 Yeah, so we'll move on to... 98 00:08:20,060 --> 00:08:21,060 Yep, so... 99 00:08:21,060 --> 00:08:26,300 Sorry, I was just saying sorry for those users who are trying to get into the website. 100 00:08:26,300 --> 00:08:30,100 I'm sorry that we are struggling because of this. 101 00:08:30,100 --> 00:08:31,540 Sorry, I interrupted you. 102 00:08:31,540 --> 00:08:32,940 You're good. 103 00:08:32,940 --> 00:08:34,380 No, that shows interest, right? 104 00:08:34,380 --> 00:08:34,780 It's good. 105 00:08:34,780 --> 00:08:35,960 Everyone's excited. 106 00:08:36,820 --> 00:08:39,280 Yeah, so another question from the chat. 107 00:08:39,480 --> 00:08:43,360 So if you're aware that someone's going to use an attack using Mr. 108 00:08:43,360 --> 00:08:45,300 SIP, so imagine you're on a blue team, right? 109 00:08:45,300 --> 00:08:51,200 Or in the SOC, what would you suggest as the first line of defense to protect yourself or your company? 110 00:08:54,860 --> 00:08:59,040 I think... Okay, I will say something maybe, but feel free. 111 00:08:59,040 --> 00:09:03,040 I take the first sentence and feel free to add after me. 112 00:09:03,420 --> 00:09:10,920 I think when they do penetration testing inside the company, let's say they are using Mr. 113 00:09:10,920 --> 00:09:24,420 SIP and they are trying to find vulnerabilities and all tests, one of the defense they could do is, like we also mentioned in the presentation, that awareness, the password policy awareness. 114 00:09:24,420 --> 00:09:30,680 So usually it is the lowest priority in the companies and security policies. 115 00:09:30,740 --> 00:09:34,340 And a strong password policy is really necessary. 116 00:09:34,340 --> 00:09:38,060 But when we look at SIP itself, it is vulnerable. 117 00:09:38,060 --> 00:09:49,220 So there are some of the aspects that are unavoidable, like there will be VoIP attacks and there will be almost no defense if you deploy a sophisticated attack. 118 00:09:49,220 --> 00:10:03,880 So there is not much to do, but they could do the standards like monitoring and actively having some security researchers looking at things and lots of awareness, I think, inside the company, strong policy for passwords. 119 00:10:04,180 --> 00:10:08,520 All these things are, I think, good for defense, but I'm not sure. 120 00:10:08,520 --> 00:10:10,640 Maybe you want to add something, maybe? 121 00:10:10,760 --> 00:10:24,820 Yeah, using VoIP specific security parameters like VoIP application firewall or VoIP IPS should be beneficial. 122 00:10:25,820 --> 00:10:26,620 Yeah. 123 00:10:28,800 --> 00:10:30,200 Cool, cool. 124 00:10:30,280 --> 00:10:31,200 Appreciate that. 125 00:10:31,200 --> 00:10:31,480 Yeah. 126 00:10:31,480 --> 00:10:34,400 So we'll go one other question here. 127 00:10:34,940 --> 00:10:35,440 Right. 128 00:10:35,440 --> 00:10:47,980 So if you have a lot of experience, obviously looking at kind of SIP and VoIP attacks and everything, would you say that there's any device or companies out there you'd recommend over another to kind of do a better job of protecting against like the attacks that are in Mr. 129 00:10:47,980 --> 00:10:48,760 SIP? 130 00:10:49,620 --> 00:10:50,460 Okay. 131 00:10:50,460 --> 00:10:56,120 I think I will give this question to Mili by adding some on that. 132 00:10:56,120 --> 00:11:03,320 So maybe when we recommend or think about the company, it is the client applications and the server applications we can talk about. 133 00:11:03,400 --> 00:11:14,060 I would think they're mostly similar, but Mili, what do you think about the companies like SIP servers or other companies deploying SIP products? 134 00:11:14,060 --> 00:11:15,480 What do you think about them? 135 00:11:17,260 --> 00:11:23,040 I couldn't get the exact question, but could you put a summary? 136 00:11:23,700 --> 00:11:24,740 Yeah. 137 00:11:24,940 --> 00:11:31,800 Like I think, what I think is, so at the end, our attacks are against the SIP protocol. 138 00:11:31,800 --> 00:11:33,380 It is not for products. 139 00:11:33,380 --> 00:11:35,980 And I think every product is vulnerable over there. 140 00:11:35,980 --> 00:11:37,700 So it is not product based thing. 141 00:11:38,680 --> 00:11:42,560 Also because I think inside the clients or servers, they don't have any 142 00:11:46,800 --> 00:11:48,940 defense mechanisms deployed in the server. 143 00:11:48,940 --> 00:11:53,480 So they have to get additional defense mechanism. 144 00:11:53,800 --> 00:11:58,040 But Mili, what I'm thinking is, do you have more experience on that? 145 00:11:58,040 --> 00:12:05,040 What do you think if any SIP servers, some brands or products are better than other ones? 146 00:12:05,040 --> 00:12:07,020 Do you recommend any of them? 147 00:12:11,490 --> 00:12:18,150 It's not appropriate to say to bring some vendors. 148 00:12:19,990 --> 00:12:20,770 Yep. 149 00:12:20,770 --> 00:12:20,970 Yeah. 150 00:12:20,970 --> 00:12:21,490 No worries. 151 00:12:21,490 --> 00:12:21,810 No worries. 152 00:12:21,810 --> 00:12:22,670 That's fine. 153 00:12:22,850 --> 00:12:23,730 Yeah. 154 00:12:24,130 --> 00:12:36,550 So for someone who's kind of, let's say, isn't as familiar with the SIP space or VoIP attacks, maybe they're more used to using some standard things against Windows or Linux. 155 00:12:36,550 --> 00:12:46,710 I guess, how would you recommend someone start to learn and kind of experiment or come into, what kind of resources would you recommend for someone starting to look at SIP or VoIP style of attacks? 156 00:12:47,550 --> 00:12:53,290 Other than just saying, use Mr. 157 00:12:53,290 --> 00:12:53,990 SIP. 158 00:12:54,910 --> 00:12:55,450 Oh, okay. 159 00:12:55,450 --> 00:12:55,910 Yeah. 160 00:12:55,910 --> 00:13:06,650 I think one of the things they can definitely deploy the environment, the lab environment, where they can simulate or emulate the SIP servers and the client. 161 00:13:06,810 --> 00:13:13,070 So they can have, because nobody has this all SIP deployment at home, but every company has it. 162 00:13:13,070 --> 00:13:23,210 So my university at Oxford, we have this SIP servers, clients, and it would be really easy, I think, to hijack the professor's phone and then do these things. 163 00:13:23,210 --> 00:13:31,750 But at the end, for a new starter to experiment, it is not going to be possible to deploy or have a SIP deployment at home. 164 00:13:31,750 --> 00:13:37,450 Nobody does that, but they can definitely emulate something on their computer. 165 00:13:37,630 --> 00:13:45,770 And there are many tools for that, that they can start generating SIP messages on their local server and they can run virtual machines. 166 00:13:45,970 --> 00:13:52,810 So you take some virtual box, few instances, one of them is server, it has an IP address, other one is few clients, et cetera. 167 00:13:52,810 --> 00:13:56,070 And then imagine one virtual box is calling another one. 168 00:13:56,070 --> 00:14:00,070 And while doing so, you have another virtual box, which is Kali Linux. 169 00:14:00,070 --> 00:14:04,690 And then this one is that hacker machine, gets access to network and they can play with it. 170 00:14:04,690 --> 00:14:09,550 So they can watch the start, watching the network messages and play with it. 171 00:14:09,550 --> 00:14:14,310 I think new beginners could do that and that would be fun. 172 00:14:14,810 --> 00:14:15,190 Yeah. 173 00:14:15,330 --> 00:14:21,450 Also reading the first SIP RFC is very beneficial. 174 00:14:22,970 --> 00:14:33,110 As a virtual SIP PBX, they can use any kind of Asterix-based SIP PBX, such as Trixbox or FreePBX, et cetera. 175 00:14:35,390 --> 00:14:36,590 Awesome. 176 00:14:38,050 --> 00:14:38,550 Yeah. 177 00:14:38,550 --> 00:14:43,830 So there's a question in the chat from RPTK2015. 178 00:14:44,130 --> 00:14:55,890 Can you expand a little bit about Wholesale VoIP, Carrier Voice, and Call Shop, the attacks that were mentioned in the talk in context of registration hijacking? 179 00:14:56,150 --> 00:14:57,470 Yeah. 180 00:14:57,510 --> 00:15:05,210 So I would like to give some quick summary on that because it is a real incident, first of all. 181 00:15:05,210 --> 00:15:15,790 And Millie was also one of the investigators and an expert preparing technical reports on it, like in a real million dollar hijacking. 182 00:15:15,790 --> 00:15:18,330 So they found out how the hackers did it. 183 00:15:18,330 --> 00:15:21,330 And now also in DEF CON, we show how they did it. 184 00:15:21,330 --> 00:15:24,810 So what happens is the steps are simple, I think. 185 00:15:25,830 --> 00:15:28,730 So the hackers should get into the company network. 186 00:15:28,730 --> 00:15:30,970 That is, I think, one of the preconditions. 187 00:15:31,630 --> 00:15:44,910 And then with using MrSIP, they can enumerate the users, break the passwords, get into or collect all the user's credentials. 188 00:15:44,910 --> 00:15:45,850 That is the step. 189 00:15:45,850 --> 00:15:48,230 And that is not difficult by using MrSIP. 190 00:15:48,230 --> 00:15:49,630 Everything is automatic. 191 00:15:49,630 --> 00:16:04,910 Once the hackers collect enough information about the users, what they do is that they can start selling whenever the users are sleeping or not using their lines or the accounts, let's say. 192 00:16:04,910 --> 00:16:14,050 The hackers can start selling their accounts and just charge all these things into the company because the company has the infrastructure that is running. 193 00:16:14,050 --> 00:16:28,490 And if they allow calls to, let's say, other countries, the hackers can just, without running any infrastructure, telecom infrastructure, they can just charge them and make calls on behalf of all these stolen users. 194 00:16:29,110 --> 00:16:35,410 And at the end, maybe three months later, the company will realize, okay, there were all these frauds going on. 195 00:16:35,410 --> 00:16:47,910 They will detect, but it will be too late because the guys, the hackers, already make, I think, millions easily by selling a few months of utilizing this telecom infrastructure for a few months. 196 00:16:47,910 --> 00:16:53,530 So what they can do, they can, for example, run a local phone call shop. 197 00:16:53,530 --> 00:16:58,390 Imagine one of the corner shops that says, okay, you can make international calls. 198 00:16:58,390 --> 00:17:06,730 And they might be using actually one of the other big company infrastructure and underground, like maybe stolen credentials. 199 00:17:06,730 --> 00:17:09,450 And you still go and pay them and make the call. 200 00:17:09,450 --> 00:17:12,930 And it is maybe long distance call, super expensive thing. 201 00:17:12,930 --> 00:17:18,150 And they charge small money, but because they don't pay anything for the infrastructure. 202 00:17:18,590 --> 00:17:26,930 And because everything is free and quickly, as much as they can, they start selling those services and many other things. 203 00:17:26,930 --> 00:17:28,750 They are very creative, right? 204 00:17:28,750 --> 00:17:30,190 Creative people. 205 00:17:31,290 --> 00:17:33,090 So that's basically it. 206 00:17:33,090 --> 00:17:42,510 So a few months, I think it will take until a company realizes, okay, why our bills are much higher than usual or the traffic going on too much. 207 00:17:42,510 --> 00:17:44,430 And then that will happen. 208 00:17:44,430 --> 00:17:45,650 I think that is the story. 209 00:17:45,650 --> 00:17:46,450 Like that is how... 210 00:17:47,570 --> 00:17:56,530 Also, even if they understand that they need to pinpoint the problem, exact problem, because they still don't know about the fact. 211 00:17:56,730 --> 00:18:01,910 This is also a very common hacking story in the real life. 212 00:18:01,970 --> 00:18:03,890 So I experienced a lot. 213 00:18:06,830 --> 00:18:08,830 Melih, can I ask you a quick question? 214 00:18:08,830 --> 00:18:17,190 So do you think not only the telecom companies, I think the banks can have this or what other type of companies can have this type of call fraud? 215 00:18:17,190 --> 00:18:28,690 Because if a bank has the infrastructure for their own use, and if they allow with the tip trunks, external calls, so they can also be the victim of this type of fraud, right? 216 00:18:28,750 --> 00:18:29,750 Yes, exactly. 217 00:18:29,750 --> 00:18:31,030 Banks and other companies. 218 00:18:31,030 --> 00:18:34,490 It's not only the telecom companies, so many other companies can suffer. 219 00:18:34,610 --> 00:18:45,610 Many companies, any enterprises running voice over IP and making outbound calls to internet can be vulnerable for that kind of attack. 220 00:18:46,390 --> 00:18:47,790 Mm hmm. 221 00:18:47,790 --> 00:18:49,270 Cool, cool. 222 00:18:49,270 --> 00:18:52,650 Yes, we have another question from the chat from ThoughtSeeker. 223 00:18:52,650 --> 00:18:53,710 Oh, great. 224 00:18:53,710 --> 00:18:58,810 Do you recommend using session border controls in front of critical SIP infrastructure? 225 00:19:01,770 --> 00:19:05,770 Well, I can reply to this question. 226 00:19:05,770 --> 00:19:06,490 Yeah. 227 00:19:07,170 --> 00:19:18,290 SPCs, the session border controllers are very common in internet service provider level companies, not for enterprises, maybe. 228 00:19:18,450 --> 00:19:23,310 They are expensive as far as I know, but it's very beneficial. 229 00:19:23,310 --> 00:19:26,710 It's working like a SIP firewall, SIP application firewall. 230 00:19:26,710 --> 00:19:37,150 So it's one of the best SIP security firewall type, I can say. 231 00:19:38,470 --> 00:19:39,790 Cool. 232 00:19:39,790 --> 00:19:40,870 Awesome. 233 00:19:40,870 --> 00:19:41,250 Yeah. 234 00:19:41,250 --> 00:19:42,670 So something else. 235 00:19:42,670 --> 00:19:50,910 So just kind of pondering, what do you think is probably the most significant attack someone could kind of do using SIP VoIP traffic? 236 00:19:50,910 --> 00:19:55,950 What do you think that maybe would be the most impactful or significant thing you could see someone trying to do? 237 00:19:56,750 --> 00:19:57,710 Right. 238 00:19:58,810 --> 00:20:01,210 Mehdi, do you want to answer that? 239 00:20:01,210 --> 00:20:06,150 I have some stories, I think, but we can both, I think, elaborate on this. 240 00:20:06,270 --> 00:20:07,590 What do you think? 241 00:20:08,050 --> 00:20:28,850 In the service provider level, there are many fraud type attacks, but for enterprises, telephony DOS is one of the most powerful attack, most impactful attack. 242 00:20:28,910 --> 00:20:39,790 So there are many different kinds of telephony DOS attacks you can run using VoIP systems. 243 00:20:40,510 --> 00:20:41,450 Mm-hmm. 244 00:20:41,450 --> 00:20:48,590 Yeah, I think, so in the DOS denial of service attacks, Mr. 245 00:20:48,590 --> 00:20:57,050 SIP is very skilled because we have so many protocol level vulnerabilities being published and getting also published. 246 00:20:57,050 --> 00:20:59,410 And that is one of the area that Mr. 247 00:20:59,410 --> 00:21:00,990 SIP is very powerful. 248 00:21:00,990 --> 00:21:05,330 It has very unique novel attacks, built-in modules. 249 00:21:05,490 --> 00:21:14,870 And by doing so, I would say, DOS is definitely one of the impactful, but at the same time, inside Mr. 250 00:21:14,870 --> 00:21:28,670 SIP, we have the advanced scenarios that where you want to make an impact without knowing anything, full automatic scenario that you want to attack to an infrastructure, all these advanced custom scenarios. 251 00:21:28,670 --> 00:21:33,570 We have a mechanism to write and prepare your attack. 252 00:21:33,590 --> 00:21:34,490 And then Mr. 253 00:21:34,490 --> 00:21:38,170 SIP will automatically follow all the attack and you will not do anything. 254 00:21:38,170 --> 00:21:43,270 But let's say put a Raspberry Pi into the company network, leave it there. 255 00:21:43,670 --> 00:21:49,310 Maybe a month later, nobody is there, but it will begin an attack, deploy the full automatic attack. 256 00:21:49,310 --> 00:22:01,030 And any of those, imagine the fraud infrastructure running, maybe you can build a VPN server inside, make a tunnel outside and play a lot with this. 257 00:22:01,030 --> 00:22:08,690 And then anytime you want to distract people, you can place a DOS attack and any other stuff. 258 00:22:09,630 --> 00:22:20,210 We couldn't have a chance to make demonstration for our attack scenario player, but it's the module of Mr. 259 00:22:20,210 --> 00:22:21,330 SIP, new module of Mr. 260 00:22:21,330 --> 00:22:21,870 SIP. 261 00:22:21,870 --> 00:22:29,150 And we have added some predefined attack scenarios, including D-DOS, telephony D-DOS type of attacks. 262 00:22:29,150 --> 00:22:38,510 And one of them is like, just by sending one SIP invite message, we can occupy the SIP server for 64 seconds. 263 00:22:38,570 --> 00:22:50,270 I just gave theoretical information about that kind of attack, which was a novel attack and we have published it in our academic research papers. 264 00:22:52,130 --> 00:22:52,950 Yeah. 265 00:22:53,370 --> 00:22:54,510 Cool. 266 00:22:54,510 --> 00:22:54,830 Yeah. 267 00:22:54,830 --> 00:22:58,370 So we're coming near the end, but yeah. 268 00:22:58,370 --> 00:23:03,190 Is there anything in particular you really wanted to add that you kind of ran out of time to cover in the talk? 269 00:23:03,190 --> 00:23:05,810 Anything you really want to make sure you share with everyone here? 270 00:23:07,130 --> 00:23:13,390 I think I would recommend everybody and all the SIP community to support and give us the feedback. 271 00:23:13,390 --> 00:23:16,710 That is one of the important things, because Mr. 272 00:23:16,710 --> 00:23:19,090 SIP is not a one-time tool, it's evolving. 273 00:23:19,250 --> 00:23:22,530 And last four years, I think we showed the good progress. 274 00:23:22,590 --> 00:23:31,790 And in the next few years, there will be a lot of new modules and novel attacks coming up, because our roadmap is huge. 275 00:23:31,790 --> 00:23:39,050 Even though we still say some of the parts, I know what Melih has, and we discuss all the night. 276 00:23:39,490 --> 00:23:42,390 We have huge abilities. 277 00:23:42,390 --> 00:23:45,510 We will keep integrating into Mr. 278 00:23:45,510 --> 00:23:46,330 SIP. 279 00:23:46,330 --> 00:23:55,010 And we would like to tell the community that they should definitely follow and tell us how we can cooperate, how they can join. 280 00:23:55,010 --> 00:23:57,590 They are most welcome to help Mr. 281 00:23:57,590 --> 00:24:03,430 SIP and take a part, active role, so that we can make it better. 282 00:24:03,430 --> 00:24:12,370 But the point that we should not miss is definitely follow and communicate, because there are a lot coming. 283 00:24:14,070 --> 00:24:15,650 Awesome, awesome. 284 00:24:15,810 --> 00:24:19,210 Yeah, I guess the last kind of question, I guess, to wrap things up. 285 00:24:19,210 --> 00:24:26,430 So if folks want to learn more, right, or want to contribute, like you were saying, what's the best way for them to kind of reach out? 286 00:24:26,430 --> 00:24:32,570 What's the best contact, like through the GitHub or Twitter, or what's your preferred means of communication? 287 00:24:32,570 --> 00:24:35,610 We can share links as well in the chat. 288 00:24:41,800 --> 00:24:51,520 So definitely GitHub is our first point of contact that we have the public version, open source version. 289 00:24:51,520 --> 00:24:55,200 The pro version is right now private. 290 00:24:55,200 --> 00:25:00,440 We are also open sourcing gradually the pro version modules. 291 00:25:00,440 --> 00:25:03,840 They will get into the public domain at some point. 292 00:25:03,840 --> 00:25:05,720 But GitHub is definitely useful. 293 00:25:05,720 --> 00:25:07,520 We have the links in the slide. 294 00:25:07,520 --> 00:25:09,810 Twitter is definitely a good contact. 295 00:25:10,140 --> 00:25:16,820 Private mail address or Meli's personal accounts, they are definitely good contact points. 296 00:25:16,820 --> 00:25:26,380 We are very active, and we will likely not miss anything that anybody uses any of the point of contact in social media. 297 00:25:26,380 --> 00:25:26,640 Mr. 298 00:25:26,640 --> 00:25:32,100 Sip account, our personal details, personal accounts, most welcome. 299 00:25:32,100 --> 00:25:33,680 I think we don't mind. 300 00:25:33,680 --> 00:25:40,940 There is no official or crazy strict rules on how to reach, it's just code, like easy. 301 00:25:42,340 --> 00:25:43,080 Awesome. 302 00:25:43,080 --> 00:25:45,020 Meli, do you want to add something on? 303 00:25:47,020 --> 00:25:49,360 I can add one more thing. 304 00:25:49,840 --> 00:26:02,280 People just asking about demo, and we will share new demo videos on our YouTube channel most probably next week. 305 00:26:03,280 --> 00:26:08,100 Yeah, I think that is very important that we should tell, yeah. 306 00:26:08,780 --> 00:26:14,880 Because in the Defcon video, I think the fonts were small, that was not very readable. 307 00:26:14,880 --> 00:26:23,920 It's HD and high definition, if they actually watch HD quality, they will see, they will be able to read everything. 308 00:26:23,920 --> 00:26:32,880 But we will also publish the videos of all the modules and all these attacks, bigger fonts, maybe slowly in a better quality. 309 00:26:33,100 --> 00:26:36,100 They will come and we recommend that, I think. 310 00:26:36,100 --> 00:26:38,440 Definitely, they should be watching the YouTube channel. 311 00:26:39,240 --> 00:26:39,980 Awesome, awesome. 312 00:26:39,980 --> 00:26:41,480 Yeah, I definitely think that'd be helpful. 313 00:26:43,320 --> 00:26:44,280 Cool. 314 00:26:44,300 --> 00:26:51,420 Well, if there's no last minute thoughts from either of you, I would really just say thank you for joining us for Defcon. 315 00:26:51,420 --> 00:26:56,260 Thank you for participating from remote places, again, not in Vegas. 316 00:26:56,360 --> 00:27:01,920 And yeah, and look forward to running into you in a future Defcon, hopefully in Vegas in person. 317 00:27:02,020 --> 00:27:06,680 And otherwise, just really want to thank you and stay safe out there. 318 00:27:07,440 --> 00:27:08,680 Thank you, guys. 319 00:27:08,680 --> 00:27:11,360 Yeah, we would like to thank everybody there. 320 00:27:11,360 --> 00:27:12,000 Yeah. 321 00:27:12,280 --> 00:27:21,940 I think the Defcon team helped a lot through this online experience, Pardus and Nikita and everybody taking role there. 322 00:27:21,940 --> 00:27:31,760 And thank you guys for helping and arranging all these things, even in last minute that in all these difficult times. 323 00:27:32,520 --> 00:27:33,540 Awesome. 324 00:27:33,540 --> 00:27:34,380 Well, thanks. 325 00:27:34,380 --> 00:27:36,500 And again, everyone stay safe out there. 326 00:27:36,500 --> 00:27:37,500 Cheers. 327 00:27:37,500 --> 00:27:38,180 Thank you. 328 00:27:38,180 --> 00:27:38,720 Thank you.