start	end	text
44380	51220	Hi there! So we are live with the speakers who presented on practical VoIP
51220	57580	hacking using Mr. Sip. And welcome, welcome to DEF CON Safe Mode. Not quite what you would
57580	63320	normally have expected probably for coming to Vegas, right? But glad that you're able to join
63320	69200	us and share some information with us. I understand though that you are both first-time speakers at
69200	74920	DEF CON. Is that correct? Yes, that's correct. Thank you. Thank you for the opportunity.
75340	80800	Yeah, that's great. Yeah, so we have a tradition here at DEF CON for first-time speakers where
81200	85440	really it's a historical tradition of where we kind of do a shot or a drink with someone on stage
85440	91060	to kind of welcome them to DEF CON. So as your first-time speakers, I'd like to, you know,
91060	96420	hold up a cup and have a drink here with you both and say cheers and say welcome to DEF CON.
97160	99480	Okay. Yep, cheers.
108960	118380	That was strong. A little early where you are. Strong coffee. Awesome, awesome. Yeah, so that's great.
118380	123900	So let's get into a couple of the questions and everything. First off, right, so we
123900	128840	recorded the talk a little bit ago. Really, right, like since you recorded and kind of
128840	133300	presented on Mr. Sip here at DEF CON, are there any major changes or updates you kind of want to
133300	143860	share with the audience? So first of all, so inside this presentation, DEF CON, we actually
143860	150240	show most of the new updates. So they were not published before. So exclusively we presented
150740	158120	many other modules and all these demos. They're all new and we first time showed them in DEF CON.
158120	163400	Since the video published, like in a week's time, we are still updating the documentation
164000	170700	and the YouTube channel we have, Twitter page we have, people can follow, and the GitLab page we
170700	176540	use to host the website for the pro version. So these are the recent updates we can say.
176540	181540	But other than that, the whole DEF CON experience is the new update. So everything we show is the
181540	186820	new content, all these pro features, the new modules. They were not published before and then
186820	197000	right now we just introduced them. Awesome, awesome. Yeah, so kind of, I guess also to kick
197000	201820	things off here, so kind of what drew you to like VoIP research and SIP security and like kind of
201820	209680	the origin for Mr. SIP? Okay, that's a big question, I think. Millie, I would like to answer
209680	216980	that and if you would like to add something after that, you're welcome. So Mr. SIP goes back to 2011
217740	225760	and one of our meetings with Millie also goes back to one of like 2012 or 2013 interviews because
225760	231220	like once I had a job application in Millie's company and he was interviewing me, but there
231220	239700	was no SIP at that time, but that is just once we came to meet each other. And around that time,
239700	245580	so Millie was working for a big telecom company, one of the biggest in the world, and they had the
245580	251520	SIP team and security team there. They were developing one internal tool and with that
251520	258600	internal tool, they were also hiring somebody like a research supporter and then in 2012,
258600	265000	I think they didn't have NDA and one of that guy who was not hired forked the project
265000	271000	and also published some open source modules, but I think the project didn't go too deep
272080	276500	because it doesn't have any like... also that's a comparison, I think. We can't say it doesn't
276500	282880	have any noble or unique exploits vulnerabilities inside, but Mr. SIP stands out that it is
283840	290600	both scientific and practical. It is very interdisciplinary, I would say.
293300	299120	It has full automatic modules that does all the vulnerability search,
299120	304680	but then in the real world attacks, it is utilizing novel exploits, CVEs that is
305660	312500	even just not published before Mr. SIP, so it contains a lot if you compare with other things.
312880	320280	But if we go back again 2012 to 2015, Melih worked on a closed source project,
320280	326340	different version of Mr. SIP that was kept always private and closed under the company.
326700	332820	And by 2015, Melih left the company and he was thinking and by coincidence, we met in Black Hat
332820	338920	London 2016. We said, oh, hi, you interviewed me four years ago and I said, oh, how's it going?
338920	343460	He said, oh, I quit that company, et cetera. And then this was the story. We said, okay,
343460	349440	what is happening, Mr. SIP? He said, I want to program it from scratch, make it bigger,
349440	356940	make it like Perp Suite. We had the idea that we could make it just like a real application
356940	364660	that every penetration tester is using. That was a dream in 2016. Nowadays, after four years,
364660	371800	we have about 10 modules. It is becoming a reality. So we work hard on those programming,
371800	377020	software engineering, because it is a big project. It is not one time published application,
377020	381820	but it's evolving all the time. And we have lots and lots in the roadmap.
382380	390100	First, it appeared many times in arsenals, Black Hat arsenals and some other technical
390100	396960	conferences, practitioners conferences. And also many published several research articles
396960	403960	during his PhD. So Mr. SIP actually gave him both, I would say, almost like a startup company
403960	415000	and a PhD. So there are a lot of, I think, events happened through the history of Mr. SIP. It is
415140	422860	a small application. It has several journals behind a PhD work, like a four years of PhD work.
423100	429000	Plus, it is becoming almost like a startup. But the main idea is that we keep it open source and
429000	434360	we want community to use it and see that how SIP is important,
434360	439040	VoIP attacks are important, and how they can just have a reliable tool.
439860	442300	Cool. That's awesome. Yeah, there actually is a question in the chat
442300	446820	about why does the website for Mr. SIP Pro require signing into GitLab?
446820	451880	Is that maybe one of the other ones? Oh, it is, I think, not ready. That's why. So
451880	457580	we didn't want Google to index something that is like a demo content because we have the template
457580	463500	now imported in GitLab and it is getting updated. We are keeping it. But we didn't want to show it
463500	469980	half missing. So it is just ongoing. It's very new. And we wanted to include the link because
469980	476840	the DEF CON video will remain online and maybe next week it will be open, the website,
476840	485100	the Mr. SIP Pro website. But right now, it is still ongoing. That's why it requires sign-in.
485100	489920	Even if you sign in, it will say you're not authorized. But I think I'm happy if people
489920	495920	go and sign up to GitLab. GitLab is cool. It's free and it allows a lot of things.
495920	499240	Awesome, awesome. Yeah, so we'll move on to...
500060	501060	Yep, so...
501060	506460	Sorry, I was just saying sorry for those users who are trying to get into the website. I'm
506460	511540	sorry that we are struggling because of this. Sorry, I interrupted you.
511540	515960	You're good. No, that shows interest, right? It's good. Everyone's excited.
516820	522380	Yeah, so another question from the chat. So if you're aware that someone's going to use an attack
522380	528220	using Mr. SIP, so imagine you're on a blue team, right? Or in the SOC, what would you suggest as
528220	531200	the first line of defense to protect yourself or your company?
534860	541160	I think... Okay, I will say something maybe, but feel free. I take the first sentence and
541160	549560	feel free to add after me. I think when they do penetration testing inside the company,
549560	555380	let's say they are using Mr. SIP and they are trying to find vulnerabilities and all
556360	561780	tests, one of the defense they could do is, like we also mentioned in the presentation,
561780	568420	that awareness, the password policy awareness. So usually it is the lowest priority in the
568420	575340	companies and security policies. And a strong password policy is really necessary. But when
575340	581860	we look at SIP itself, it is vulnerable. So there are some of the aspects that are unavoidable,
581860	588040	like there will be VoIP attacks and there will be almost no defense if you deploy a sophisticated
588040	595620	attack. So there is not much to do, but they could do the standards like monitoring and actively
596140	600780	having some security researchers looking at things and lots of awareness, I think, inside
600780	607320	the company, strong policy for passwords. All these things are, I think, good for defense,
607320	610640	but I'm not sure. Maybe you want to add something, maybe?
610760	618520	Yeah, using VoIP specific security parameters like VoIP application firewall or
621020	624820	VoIP IPS should be beneficial.
625820	626620	Yeah.
628800	634400	Cool, cool. Appreciate that. Yeah. So we'll go one other question here.
634940	638660	Right. So if you have a lot of experience, obviously looking at kind of SIP and VoIP
638660	642880	attacks and everything, would you say that there's any device or companies out there
642880	646800	you'd recommend over another to kind of do a better job of protecting against like the
646800	648760	attacks that are in Mr. SIP?
649620	657920	Okay. I think I will give this question to Mili by adding some on that. So maybe when we recommend
657920	662220	or think about the company, it is the client applications and the server applications we can
662220	669800	talk about. I would think they're mostly similar, but Mili, what do you think about the companies
669800	675480	like SIP servers or other companies deploying SIP products? What do you think about them?
677260	683040	I couldn't get the exact question, but could you put a summary?
683700	691800	Yeah. Like I think, what I think is, so at the end, our attacks are against the SIP protocol.
691800	696900	It is not for products. And I think every product is vulnerable over there. So it is not product
696900	702560	based thing. Also because I think inside the clients or servers, they don't have any
706800	713480	defense mechanisms deployed in the server. So they have to get additional defense mechanism.
713800	718960	But Mili, what I'm thinking is, do you have more experience on that? What do you think
718960	726160	if any SIP servers, some brands or products are better than other ones? Do you recommend any of
726160	738150	them? It's not appropriate to say to bring some vendors.
739990	747570	Yep. Yeah. No worries. No worries. That's fine. Yeah. So for someone who's kind of, let's say,
747570	753750	isn't as familiar with the SIP space or VoIP attacks, maybe they're more used to using some
753750	758750	standard things against Windows or Linux. I guess, how would you recommend someone start to
758750	763990	learn and kind of experiment or come into, what kind of resources would you recommend for someone
763990	773990	starting to look at SIP or VoIP style of attacks? Other than just saying, use Mr. SIP.
774910	780170	Oh, okay. Yeah. I think one of the things they can definitely deploy the environment,
780170	786650	the lab environment, where they can simulate or emulate the SIP servers and the client.
786810	793150	So they can have, because nobody has this all SIP deployment at home, but every company has it. So
793150	799830	my university at Oxford, we have this SIP servers, clients, and it would be really easy, I think,
799830	805670	to hijack the professor's phone and then do these things. But at the end, for a new starter to
805670	811870	experiment, it is not going to be possible to deploy or have a SIP deployment at home. Nobody
811870	818070	does that, but they can definitely emulate something on their computer. And there are
818070	823190	many tools for that, that they can start generating SIP messages on their local server
823190	829070	and they can run virtual machines. So you take some virtual box, few instances, one of them is
829070	834430	server, it has an IP address, other one is few clients, et cetera. And then imagine one virtual
834430	840070	box is calling another one. And while doing so, you have another virtual box, which is Kali Linux.
840070	844770	And then this one is that hacker machine, gets access to network and they can play with it. So
844770	850890	they can watch the start, watching the network messages and play with it. I think new beginners
850890	861450	could do that and that would be fun. Yeah. Also reading the first SIP RFC is very beneficial.
862970	869850	As a virtual SIP PBX, they can use any kind of Asterix-based SIP PBX, such as
870410	873110	Trixbox or FreePBX, et cetera.
875390	886310	Awesome. Yeah. So there's a question in the chat from RPTK2015. Can you expand a little bit
886310	892330	about Wholesale VoIP, Carrier Voice, and Call Shop, the attacks that were mentioned in the
892330	900370	talk in context of registration hijacking? Yeah. So I would like to give some quick summary on
900370	907390	that because it is a real incident, first of all. And Millie was also one of the investigators
908070	914730	and an expert preparing technical reports on it, like in a real million dollar
914730	920630	hijacking. So they found out how the hackers did it. And now also in DEF CON, we show how they did
920630	927990	it. So what happens is the steps are simple, I think. So the hackers should get into the
927990	934750	company network. That is, I think, one of the preconditions. And then with using MrSIP,
934750	942410	they can enumerate the users, break the passwords, get into or collect all the user's
944070	949630	credentials. That is the step. And that is not difficult by using MrSIP. Everything is automatic.
949630	956870	Once the hackers collect enough information about the users, what they do is that they can
956870	964910	start selling whenever the users are sleeping or not using their lines or the accounts, let's say.
964910	971070	The hackers can start selling their accounts and just charge all these things into the company
971070	977210	because the company has the infrastructure that is running. And if they allow calls to,
977210	981530	let's say, other countries, the hackers can just, without running any infrastructure,
981530	987270	telecom infrastructure, they can just charge them and make calls on behalf of all these stolen
987270	993430	users. And at the end, maybe three months later, the company will realize, okay, there were all
993430	999910	these frauds going on. They will detect, but it will be too late because the guys, the hackers,
999910	1006350	already make, I think, millions easily by selling a few months of utilizing this telecom
1006350	1012850	infrastructure for a few months. So what they can do, they can, for example, run a local phone call
1012850	1018390	shop. Imagine one of the corner shops that says, okay, you can make international calls.
1018390	1024490	And they might be using actually one of the other big company infrastructure and underground,
1024490	1030170	like maybe stolen credentials. And you still go and pay them and make the call. And it is maybe
1030170	1035870	long distance call, super expensive thing. And they charge small money, but because they don't
1035870	1042470	pay anything for the infrastructure. And because everything is free and quickly, as much as they
1042470	1048750	can, they start selling those services and many other things. They are very creative, right?
1048750	1056270	Creative people. So that's basically it. So a few months, I think it will take until a company
1056270	1062510	realizes, okay, why our bills are much higher than usual or the traffic going on too much.
1062510	1066450	And then that will happen. I think that is the story. Like that is how...
1067570	1073470	Also, even if they understand that they need to pinpoint the problem, exact problem,
1073470	1078270	because they still don't know about the fact. This is also a very common
1079070	1083890	hacking story in the real life. So I experienced a lot.
1086830	1092230	Melih, can I ask you a quick question? So do you think not only the telecom companies,
1092230	1096590	I think the banks can have this or what other type of companies can have this type of
1096590	1101630	call fraud? Because if a bank has the infrastructure for their own use, and if
1101630	1107610	they allow with the tip trunks, external calls, so they can also be the victim of this type of
1107610	1112530	fraud, right? Yes, exactly. Banks and other companies. It's not only the telecom companies,
1112530	1117110	so many other companies can suffer. Many companies, any enterprises running
1117110	1125610	voice over IP and making outbound calls to internet can be vulnerable for that kind of attack.
1126390	1132650	Mm hmm. Cool, cool. Yes, we have another question from the chat from ThoughtSeeker.
1132650	1138810	Oh, great. Do you recommend using session border controls in front of critical SIP infrastructure?
1141770	1146490	Well, I can reply to this question. Yeah.
1147170	1154670	SPCs, the session border controllers are very common in internet service provider level
1154670	1162410	companies, not for enterprises, maybe. They are expensive as far as I know, but it's very
1162410	1168630	beneficial. It's working like a SIP firewall, SIP application firewall. So it's one of the
1169310	1182670	best SIP security firewall type, I can say. Cool. Awesome. Yeah. So something else.
1182670	1188310	So just kind of pondering, what do you think is probably the most significant attack someone
1188310	1192870	could kind of do using SIP VoIP traffic? What do you think that maybe would be the
1192870	1195950	most impactful or significant thing you could see someone trying to do?
1196750	1203810	Right. Mehdi, do you want to answer that? I have some stories, I think, but we can both,
1203810	1212650	I think, elaborate on this. What do you think? In the service provider level, there are many fraud
1212650	1225450	type attacks, but for enterprises, telephony DOS is one of the most powerful attack,
1225810	1232510	most impactful attack. So there are many different kinds of
1232510	1239790	telephony DOS attacks you can run using VoIP systems.
1240510	1248350	Mm-hmm. Yeah, I think, so in the DOS denial of service attacks,
1248350	1253550	Mr. SIP is very skilled because we have so many protocol level vulnerabilities
1254110	1259670	being published and getting also published. And that is one of the area that Mr. SIP is
1259670	1268510	very powerful. It has very unique novel attacks, built-in modules. And by doing so, I would say,
1269790	1275970	DOS is definitely one of the impactful, but at the same time, inside Mr. SIP, we have the
1277590	1282530	advanced scenarios that where you want to make an impact without knowing anything,
1282530	1286210	full automatic scenario that you want to attack to an infrastructure,
1286210	1293570	all these advanced custom scenarios. We have a mechanism to write and prepare your attack.
1293590	1298950	And then Mr. SIP will automatically follow all the attack and you will not do anything. But let's say
1298950	1305930	put a Raspberry Pi into the company network, leave it there. Maybe a month later, nobody is
1305930	1311470	there, but it will begin an attack, deploy the full automatic attack. And any of those, imagine
1311470	1317330	the fraud infrastructure running, maybe you can build a VPN server inside, make a tunnel outside
1318810	1326230	and play a lot with this. And then anytime you want to distract people, you can place a DOS attack
1326230	1335070	and any other stuff. We couldn't have a chance to make demonstration for our
1335690	1342690	attack scenario player, but it's the module of Mr. SIP, new module of Mr. SIP. And we have added
1342690	1349770	some predefined attack scenarios, including D-DOS, telephony D-DOS type of attacks. And one of them
1349770	1356090	is like, just by sending one SIP invite message, we can occupy the SIP server for
1356890	1364310	64 seconds. I just gave theoretical information about that kind of attack, which was a novel
1364310	1370270	attack and we have published it in our academic research papers.
1372130	1379450	Yeah. Cool. Yeah. So we're coming near the end, but yeah. Is there anything in particular you
1379450	1383810	really wanted to add that you kind of ran out of time to cover in the talk? Anything you really
1383810	1390190	want to make sure you share with everyone here? I think I would recommend everybody and all the
1390190	1395210	SIP community to support and give us the feedback. That is one of the important things,
1395910	1401110	because Mr. SIP is not a one-time tool, it's evolving. And last four years, I think we showed
1401110	1408290	the good progress. And in the next few years, there will be a lot of new modules and novel
1408290	1414770	attacks coming up, because our roadmap is huge. Even though we still say some of the parts,
1414770	1422390	I know what Melih has, and we discuss all the night. We have huge abilities.
1422390	1429010	We will keep integrating into Mr. SIP. And we would like to tell the community
1429010	1435010	that they should definitely follow and tell us how we can cooperate, how they can join.
1435010	1442910	They are most welcome to help Mr. SIP and take a part, active role, so that we can make it
1442910	1451110	better. But the point that we should not miss is definitely follow and communicate, because there
1451110	1458490	are a lot coming. Awesome, awesome. Yeah, I guess the last kind of question, I guess, to wrap
1458490	1463870	things up. So if folks want to learn more, right, or want to contribute, like you were saying,
1463870	1469370	what's the best way for them to kind of reach out? What's the best contact, like through the GitHub
1469370	1474750	or Twitter, or what's your preferred means of communication? We can share links as well in the
1474750	1490100	chat. So definitely GitHub is our first point of contact that we have the public version,
1490100	1497300	open source version. The pro version is right now private. We are also open sourcing gradually
1497300	1504740	the pro version modules. They will get into the public domain at some point. But GitHub is
1504740	1509810	definitely useful. We have the links in the slide. Twitter is definitely a good contact.
1510140	1517020	Private mail address or Meli's personal accounts, they are definitely good contact points. We are
1517020	1522760	very active, and we will likely not miss anything that anybody uses any of the
1523780	1531260	point of contact in social media. Mr. Sip account, our personal details, personal accounts,
1531260	1539080	most welcome. I think we don't mind. There is no official or crazy strict rules on how to reach,
1539080	1545020	it's just code, like easy. Awesome. Meli, do you want to add something on?
1547020	1556460	I can add one more thing. People just asking about demo, and we will share
1557220	1562280	new demo videos on our YouTube channel most probably next week.
1563280	1571020	Yeah, I think that is very important that we should tell, yeah. Because in the Defcon video,
1571020	1577000	I think the fonts were small, that was not very readable. It's HD and high definition,
1577000	1584340	if they actually watch HD quality, they will see, they will be able to read everything. But we will
1584340	1591680	also publish the videos of all the modules and all these attacks, bigger fonts, maybe slowly in
1591780	1597320	a better quality. They will come and we recommend that, I think. Definitely, they should be watching
1597320	1601480	the YouTube channel. Awesome, awesome. Yeah, I definitely think that'd be helpful.
1603320	1607560	Cool. Well, if there's no last minute thoughts from either of you,
1608100	1612440	I would really just say thank you for joining us for Defcon. Thank you for participating
1613160	1619000	from remote places, again, not in Vegas. And yeah, and look forward to running into
1619000	1624000	you in a future Defcon, hopefully in Vegas in person. And otherwise, just really want to
1624000	1629920	thank you and stay safe out there. Thank you, guys. Yeah, we would like to thank
1629920	1637740	everybody there. Yeah. I think the Defcon team helped a lot through this online experience,
1637740	1644680	Pardus and Nikita and everybody taking role there. And thank you guys for helping and
1644680	1651760	arranging all these things, even in last minute that in all these difficult times.
1652520	1657500	Awesome. Well, thanks. And again, everyone stay safe out there. Cheers.
1657500	1658720	Thank you. Thank you.