Hi there! So we are live with the speakers who presented on practical VoIP
hacking using Mr. Sip. And welcome, welcome to DEF CON Safe Mode. Not quite what you would
normally have expected probably for coming to Vegas, right? But glad that you're able to join
us and share some information with us. I understand though that you are both first-time speakers at
DEF CON. Is that correct? Yes, that's correct. Thank you. Thank you for the opportunity.
Yeah, that's great. Yeah, so we have a tradition here at DEF CON for first-time speakers where
really it's a historical tradition of where we kind of do a shot or a drink with someone on stage
to kind of welcome them to DEF CON. So as your first-time speakers, I'd like to, you know,
hold up a cup and have a drink here with you both and say cheers and say welcome to DEF CON.
Okay. Yep, cheers.
That was strong. A little early where you are. Strong coffee. Awesome, awesome. Yeah, so that's great.
So let's get into a couple of the questions and everything. First off, right, so we
recorded the talk a little bit ago. Really, right, like since you recorded and kind of
presented on Mr. Sip here at DEF CON, are there any major changes or updates you kind of want to
share with the audience? So first of all, so inside this presentation, DEF CON, we actually
show most of the new updates. So they were not published before. So exclusively we presented
many other modules and all these demos. They're all new and we first time showed them in DEF CON.
Since the video published, like in a week's time, we are still updating the documentation
and the YouTube channel we have, Twitter page we have, people can follow, and the GitLab page we
use to host the website for the pro version. So these are the recent updates we can say.
But other than that, the whole DEF CON experience is the new update. So everything we show is the
new content, all these pro features, the new modules. They were not published before and then
right now we just introduced them. Awesome, awesome. Yeah, so kind of, I guess also to kick
things off here, so kind of what drew you to like VoIP research and SIP security and like kind of
the origin for Mr. SIP? Okay, that's a big question, I think. Millie, I would like to answer
that and if you would like to add something after that, you're welcome. So Mr. SIP goes back to 2011
and one of our meetings with Millie also goes back to one of like 2012 or 2013 interviews because
like once I had a job application in Millie's company and he was interviewing me, but there
was no SIP at that time, but that is just once we came to meet each other. And around that time,
so Millie was working for a big telecom company, one of the biggest in the world, and they had the
SIP team and security team there. They were developing one internal tool and with that
internal tool, they were also hiring somebody like a research supporter and then in 2012,
I think they didn't have NDA and one of that guy who was not hired forked the project
and also published some open source modules, but I think the project didn't go too deep
because it doesn't have any like... also that's a comparison, I think. We can't say it doesn't
have any noble or unique exploits vulnerabilities inside, but Mr. SIP stands out that it is
both scientific and practical. It is very interdisciplinary, I would say.
It has full automatic modules that does all the vulnerability search,
but then in the real world attacks, it is utilizing novel exploits, CVEs that is
even just not published before Mr. SIP, so it contains a lot if you compare with other things.
But if we go back again 2012 to 2015, Melih worked on a closed source project,
different version of Mr. SIP that was kept always private and closed under the company.
And by 2015, Melih left the company and he was thinking and by coincidence, we met in Black Hat
London 2016. We said, oh, hi, you interviewed me four years ago and I said, oh, how's it going?
He said, oh, I quit that company, et cetera. And then this was the story. We said, okay,
what is happening, Mr. SIP? He said, I want to program it from scratch, make it bigger,
make it like Perp Suite. We had the idea that we could make it just like a real application
that every penetration tester is using. That was a dream in 2016. Nowadays, after four years,
we have about 10 modules. It is becoming a reality. So we work hard on those programming,
software engineering, because it is a big project. It is not one time published application,
but it's evolving all the time. And we have lots and lots in the roadmap.
First, it appeared many times in arsenals, Black Hat arsenals and some other technical
conferences, practitioners conferences. And also many published several research articles
during his PhD. So Mr. SIP actually gave him both, I would say, almost like a startup company
and a PhD. So there are a lot of, I think, events happened through the history of Mr. SIP. It is
a small application. It has several journals behind a PhD work, like a four years of PhD work.
Plus, it is becoming almost like a startup. But the main idea is that we keep it open source and
we want community to use it and see that how SIP is important,
VoIP attacks are important, and how they can just have a reliable tool.
Cool. That's awesome. Yeah, there actually is a question in the chat
about why does the website for Mr. SIP Pro require signing into GitLab?
Is that maybe one of the other ones? Oh, it is, I think, not ready. That's why. So
we didn't want Google to index something that is like a demo content because we have the template
now imported in GitLab and it is getting updated. We are keeping it. But we didn't want to show it
half missing. So it is just ongoing. It's very new. And we wanted to include the link because
the DEF CON video will remain online and maybe next week it will be open, the website,
the Mr. SIP Pro website. But right now, it is still ongoing. That's why it requires sign-in.
Even if you sign in, it will say you're not authorized. But I think I'm happy if people
go and sign up to GitLab. GitLab is cool. It's free and it allows a lot of things.
Awesome, awesome. Yeah, so we'll move on to...
Yep, so...
Sorry, I was just saying sorry for those users who are trying to get into the website. I'm
sorry that we are struggling because of this. Sorry, I interrupted you.
You're good. No, that shows interest, right? It's good. Everyone's excited.
Yeah, so another question from the chat. So if you're aware that someone's going to use an attack
using Mr. SIP, so imagine you're on a blue team, right? Or in the SOC, what would you suggest as
the first line of defense to protect yourself or your company?
I think... Okay, I will say something maybe, but feel free. I take the first sentence and
feel free to add after me. I think when they do penetration testing inside the company,
let's say they are using Mr. SIP and they are trying to find vulnerabilities and all
tests, one of the defense they could do is, like we also mentioned in the presentation,
that awareness, the password policy awareness. So usually it is the lowest priority in the
companies and security policies. And a strong password policy is really necessary. But when
we look at SIP itself, it is vulnerable. So there are some of the aspects that are unavoidable,
like there will be VoIP attacks and there will be almost no defense if you deploy a sophisticated
attack. So there is not much to do, but they could do the standards like monitoring and actively
having some security researchers looking at things and lots of awareness, I think, inside
the company, strong policy for passwords. All these things are, I think, good for defense,
but I'm not sure. Maybe you want to add something, maybe?
Yeah, using VoIP specific security parameters like VoIP application firewall or
VoIP IPS should be beneficial.
Yeah.
Cool, cool. Appreciate that. Yeah. So we'll go one other question here.
Right. So if you have a lot of experience, obviously looking at kind of SIP and VoIP
attacks and everything, would you say that there's any device or companies out there
you'd recommend over another to kind of do a better job of protecting against like the
attacks that are in Mr. SIP?
Okay. I think I will give this question to Mili by adding some on that. So maybe when we recommend
or think about the company, it is the client applications and the server applications we can
talk about. I would think they're mostly similar, but Mili, what do you think about the companies
like SIP servers or other companies deploying SIP products? What do you think about them?
I couldn't get the exact question, but could you put a summary?
Yeah. Like I think, what I think is, so at the end, our attacks are against the SIP protocol.
It is not for products. And I think every product is vulnerable over there. So it is not product
based thing. Also because I think inside the clients or servers, they don't have any
defense mechanisms deployed in the server. So they have to get additional defense mechanism.
But Mili, what I'm thinking is, do you have more experience on that? What do you think
if any SIP servers, some brands or products are better than other ones? Do you recommend any of
them? It's not appropriate to say to bring some vendors.
Yep. Yeah. No worries. No worries. That's fine. Yeah. So for someone who's kind of, let's say,
isn't as familiar with the SIP space or VoIP attacks, maybe they're more used to using some
standard things against Windows or Linux. I guess, how would you recommend someone start to
learn and kind of experiment or come into, what kind of resources would you recommend for someone
starting to look at SIP or VoIP style of attacks? Other than just saying, use Mr. SIP.
Oh, okay. Yeah. I think one of the things they can definitely deploy the environment,
the lab environment, where they can simulate or emulate the SIP servers and the client.
So they can have, because nobody has this all SIP deployment at home, but every company has it. So
my university at Oxford, we have this SIP servers, clients, and it would be really easy, I think,
to hijack the professor's phone and then do these things. But at the end, for a new starter to
experiment, it is not going to be possible to deploy or have a SIP deployment at home. Nobody
does that, but they can definitely emulate something on their computer. And there are
many tools for that, that they can start generating SIP messages on their local server
and they can run virtual machines. So you take some virtual box, few instances, one of them is
server, it has an IP address, other one is few clients, et cetera. And then imagine one virtual
box is calling another one. And while doing so, you have another virtual box, which is Kali Linux.
And then this one is that hacker machine, gets access to network and they can play with it. So
they can watch the start, watching the network messages and play with it. I think new beginners
could do that and that would be fun. Yeah. Also reading the first SIP RFC is very beneficial.
As a virtual SIP PBX, they can use any kind of Asterix-based SIP PBX, such as
Trixbox or FreePBX, et cetera.
Awesome. Yeah. So there's a question in the chat from RPTK2015. Can you expand a little bit
about Wholesale VoIP, Carrier Voice, and Call Shop, the attacks that were mentioned in the
talk in context of registration hijacking? Yeah. So I would like to give some quick summary on
that because it is a real incident, first of all. And Millie was also one of the investigators
and an expert preparing technical reports on it, like in a real million dollar
hijacking. So they found out how the hackers did it. And now also in DEF CON, we show how they did
it. So what happens is the steps are simple, I think. So the hackers should get into the
company network. That is, I think, one of the preconditions. And then with using MrSIP,
they can enumerate the users, break the passwords, get into or collect all the user's
credentials. That is the step. And that is not difficult by using MrSIP. Everything is automatic.
Once the hackers collect enough information about the users, what they do is that they can
start selling whenever the users are sleeping or not using their lines or the accounts, let's say.
The hackers can start selling their accounts and just charge all these things into the company
because the company has the infrastructure that is running. And if they allow calls to,
let's say, other countries, the hackers can just, without running any infrastructure,
telecom infrastructure, they can just charge them and make calls on behalf of all these stolen
users. And at the end, maybe three months later, the company will realize, okay, there were all
these frauds going on. They will detect, but it will be too late because the guys, the hackers,
already make, I think, millions easily by selling a few months of utilizing this telecom
infrastructure for a few months. So what they can do, they can, for example, run a local phone call
shop. Imagine one of the corner shops that says, okay, you can make international calls.
And they might be using actually one of the other big company infrastructure and underground,
like maybe stolen credentials. And you still go and pay them and make the call. And it is maybe
long distance call, super expensive thing. And they charge small money, but because they don't
pay anything for the infrastructure. And because everything is free and quickly, as much as they
can, they start selling those services and many other things. They are very creative, right?
Creative people. So that's basically it. So a few months, I think it will take until a company
realizes, okay, why our bills are much higher than usual or the traffic going on too much.
And then that will happen. I think that is the story. Like that is how...
Also, even if they understand that they need to pinpoint the problem, exact problem,
because they still don't know about the fact. This is also a very common
hacking story in the real life. So I experienced a lot.
Melih, can I ask you a quick question? So do you think not only the telecom companies,
I think the banks can have this or what other type of companies can have this type of
call fraud? Because if a bank has the infrastructure for their own use, and if
they allow with the tip trunks, external calls, so they can also be the victim of this type of
fraud, right? Yes, exactly. Banks and other companies. It's not only the telecom companies,
so many other companies can suffer. Many companies, any enterprises running
voice over IP and making outbound calls to internet can be vulnerable for that kind of attack.
Mm hmm. Cool, cool. Yes, we have another question from the chat from ThoughtSeeker.
Oh, great. Do you recommend using session border controls in front of critical SIP infrastructure?
Well, I can reply to this question. Yeah.
SPCs, the session border controllers are very common in internet service provider level
companies, not for enterprises, maybe. They are expensive as far as I know, but it's very
beneficial. It's working like a SIP firewall, SIP application firewall. So it's one of the
best SIP security firewall type, I can say. Cool. Awesome. Yeah. So something else.
So just kind of pondering, what do you think is probably the most significant attack someone
could kind of do using SIP VoIP traffic? What do you think that maybe would be the
most impactful or significant thing you could see someone trying to do?
Right. Mehdi, do you want to answer that? I have some stories, I think, but we can both,
I think, elaborate on this. What do you think? In the service provider level, there are many fraud
type attacks, but for enterprises, telephony DOS is one of the most powerful attack,
most impactful attack. So there are many different kinds of
telephony DOS attacks you can run using VoIP systems.
Mm-hmm. Yeah, I think, so in the DOS denial of service attacks,
Mr. SIP is very skilled because we have so many protocol level vulnerabilities
being published and getting also published. And that is one of the area that Mr. SIP is
very powerful. It has very unique novel attacks, built-in modules. And by doing so, I would say,
DOS is definitely one of the impactful, but at the same time, inside Mr. SIP, we have the
advanced scenarios that where you want to make an impact without knowing anything,
full automatic scenario that you want to attack to an infrastructure,
all these advanced custom scenarios. We have a mechanism to write and prepare your attack.
And then Mr. SIP will automatically follow all the attack and you will not do anything. But let's say
put a Raspberry Pi into the company network, leave it there. Maybe a month later, nobody is
there, but it will begin an attack, deploy the full automatic attack. And any of those, imagine
the fraud infrastructure running, maybe you can build a VPN server inside, make a tunnel outside
and play a lot with this. And then anytime you want to distract people, you can place a DOS attack
and any other stuff. We couldn't have a chance to make demonstration for our
attack scenario player, but it's the module of Mr. SIP, new module of Mr. SIP. And we have added
some predefined attack scenarios, including D-DOS, telephony D-DOS type of attacks. And one of them
is like, just by sending one SIP invite message, we can occupy the SIP server for
64 seconds. I just gave theoretical information about that kind of attack, which was a novel
attack and we have published it in our academic research papers.
Yeah. Cool. Yeah. So we're coming near the end, but yeah. Is there anything in particular you
really wanted to add that you kind of ran out of time to cover in the talk? Anything you really
want to make sure you share with everyone here? I think I would recommend everybody and all the
SIP community to support and give us the feedback. That is one of the important things,
because Mr. SIP is not a one-time tool, it's evolving. And last four years, I think we showed
the good progress. And in the next few years, there will be a lot of new modules and novel
attacks coming up, because our roadmap is huge. Even though we still say some of the parts,
I know what Melih has, and we discuss all the night. We have huge abilities.
We will keep integrating into Mr. SIP. And we would like to tell the community
that they should definitely follow and tell us how we can cooperate, how they can join.
They are most welcome to help Mr. SIP and take a part, active role, so that we can make it
better. But the point that we should not miss is definitely follow and communicate, because there
are a lot coming. Awesome, awesome. Yeah, I guess the last kind of question, I guess, to wrap
things up. So if folks want to learn more, right, or want to contribute, like you were saying,
what's the best way for them to kind of reach out? What's the best contact, like through the GitHub
or Twitter, or what's your preferred means of communication? We can share links as well in the
chat. So definitely GitHub is our first point of contact that we have the public version,
open source version. The pro version is right now private. We are also open sourcing gradually
the pro version modules. They will get into the public domain at some point. But GitHub is
definitely useful. We have the links in the slide. Twitter is definitely a good contact.
Private mail address or Meli's personal accounts, they are definitely good contact points. We are
very active, and we will likely not miss anything that anybody uses any of the
point of contact in social media. Mr. Sip account, our personal details, personal accounts,
most welcome. I think we don't mind. There is no official or crazy strict rules on how to reach,
it's just code, like easy. Awesome. Meli, do you want to add something on?
I can add one more thing. People just asking about demo, and we will share
new demo videos on our YouTube channel most probably next week.
Yeah, I think that is very important that we should tell, yeah. Because in the Defcon video,
I think the fonts were small, that was not very readable. It's HD and high definition,
if they actually watch HD quality, they will see, they will be able to read everything. But we will
also publish the videos of all the modules and all these attacks, bigger fonts, maybe slowly in
a better quality. They will come and we recommend that, I think. Definitely, they should be watching
the YouTube channel. Awesome, awesome. Yeah, I definitely think that'd be helpful.
Cool. Well, if there's no last minute thoughts from either of you,
I would really just say thank you for joining us for Defcon. Thank you for participating
from remote places, again, not in Vegas. And yeah, and look forward to running into
you in a future Defcon, hopefully in Vegas in person. And otherwise, just really want to
thank you and stay safe out there. Thank you, guys. Yeah, we would like to thank
everybody there. Yeah. I think the Defcon team helped a lot through this online experience,
Pardus and Nikita and everybody taking role there. And thank you guys for helping and
arranging all these things, even in last minute that in all these difficult times.
Awesome. Well, thanks. And again, everyone stay safe out there. Cheers.
Thank you. Thank you.