1
00:00:04,230 --> 00:00:06,250
Hello, this is Ismail Mejitas.

2
00:00:06,490 --> 00:00:11,490
I will present practical web pan testing using the most up-to-date version of Mr.SIP Pro.

3
00:00:11,910 --> 00:00:14,110
Mr.SIP is a SIP-based audit and attack tool.

4
00:00:14,110 --> 00:00:20,910
It's a software product that helps organizations to manage their communication infrastructure to perform web-specific security tests.

5
00:00:21,410 --> 00:00:23,970
The companies can also measure their risks.

6
00:00:24,530 --> 00:00:26,530
Please do start in our GitHub.

7
00:00:26,530 --> 00:00:28,870
Please follow our Twitter account for updates.

8
00:00:28,870 --> 00:00:33,810
And please subscribe our YouTube channel if you need 100 subscribers to update the URL.

9
00:00:40,500 --> 00:00:42,740
Let's talk about our agenda here.

10
00:00:42,860 --> 00:00:44,820
I will have a very short introduction.

11
00:00:44,820 --> 00:00:48,140
Then I will briefly talk about the timeline and the story of Mr.SIP.

12
00:00:48,440 --> 00:00:52,200
I would like to mention about some facts about voice over IP security.

13
00:00:52,420 --> 00:00:56,420
I will then share some information about Pro version modules of Mr.SIP.

14
00:00:56,600 --> 00:00:59,440
I will explain the functionalities and interaction between the modules.

15
00:00:59,440 --> 00:01:01,960
We will also look at our roadmap.

16
00:01:02,380 --> 00:01:09,840
And after briefly showing some basics of voice over IP and SIP, I will mention about today's voice over IP security threats.

17
00:01:09,840 --> 00:01:13,320
Then I will show the lab setup we will use during the demo.

18
00:01:13,640 --> 00:01:15,860
And the interesting part begins here.

19
00:01:16,300 --> 00:01:20,900
I will talk about three cool hacking stories which I will demonstrate using Mr.SIP Pro.

20
00:01:20,980 --> 00:01:24,160
The first story is actually based on a real incident.

21
00:01:24,160 --> 00:01:30,580
And we will show you how hackers made millions of dollars in large-scale cold fraud.

22
00:01:30,720 --> 00:01:40,660
For each hacking story, I will give baseline information, lab setup, steps to perform, the demo itself and the short conclusion.

23
00:01:40,820 --> 00:01:45,120
In addition, I will talk about how we developed advanced novel attacks.

24
00:01:45,120 --> 00:01:48,440
These novel attacks appear in academic literature using Mr.SIP.

25
00:01:48,440 --> 00:01:54,060
Finally, we will review how Mr.SIP fits to the overall voice over IP methodology.

26
00:01:58,690 --> 00:02:01,010
And here I will mention about my profile.

27
00:02:01,010 --> 00:02:02,130
You can call me Mele.

28
00:02:02,290 --> 00:02:04,890
I am a security researcher from Istanbul, Turkey.

29
00:02:05,010 --> 00:02:08,110
I mostly do offensive security research about voice over IP.

30
00:02:08,510 --> 00:02:14,470
I work as a principal pentest in a private bank and I have a PhD in computer engineering.

31
00:02:14,790 --> 00:02:16,210
I am an entrepreneur.

32
00:02:16,210 --> 00:02:18,030
In my free time, I do bug hunting.

33
00:02:18,110 --> 00:02:21,730
If you want to reach me out, please find me on LinkedIn, Twitter or GitHub.

34
00:02:23,770 --> 00:02:25,990
And here is my friend Kubilay.

35
00:02:25,990 --> 00:02:28,450
We gathered together since 2016.

36
00:02:28,670 --> 00:02:30,770
He is a PhD from Oxford University.

37
00:02:30,770 --> 00:02:33,350
He works at the cyber security center there.

38
00:02:33,350 --> 00:02:36,490
And he is an alumni from ETH3.

39
00:02:36,670 --> 00:02:43,010
He is mainly working in trusted computing, hardware-assisted security and Intel's SGX technology.

40
00:02:43,650 --> 00:02:47,810
You can reach him on LinkedIn for your questions or projects.

41
00:02:49,090 --> 00:02:53,050
Mr.SIP is a web security product that started as a hobby project.

42
00:02:53,050 --> 00:02:57,010
Mr.SIP resulted several academic research papers and journal articles.

43
00:02:57,010 --> 00:03:00,750
It is the most comprehensive attack-oriented voice over IP product ever.

44
00:03:00,750 --> 00:03:02,530
And you will see the reasons today.

45
00:03:04,170 --> 00:03:08,070
First time Mr.SIP appeared in a private company where I worked before.

46
00:03:08,570 --> 00:03:13,890
We have raised about 8 million Turkish Liras, near to 2 million Euros in research funds.

47
00:03:14,470 --> 00:03:17,710
First prototypes are funded and used by Turkish government.

48
00:03:19,450 --> 00:03:25,130
Between 2011 and 2015, Mr.SIP remained as a closed source.

49
00:03:25,390 --> 00:03:28,910
One independent project sequence began in a similar timeline.

50
00:03:29,390 --> 00:03:32,590
In 2012, we planned to employ Fatih.

51
00:03:33,030 --> 00:03:37,330
After some meetings and due to no NDA, he forked our project.

52
00:03:37,950 --> 00:03:40,750
It was our mistake that we did not have an NDA.

53
00:03:41,110 --> 00:03:45,970
In rest of the years, all the tools remained closed source and I left the company.

54
00:03:47,710 --> 00:03:49,970
We gathered a new team in 2016.

55
00:03:50,630 --> 00:03:55,850
We dedicated to reprogram all the tools utilizing all of our past experiences.

56
00:03:56,370 --> 00:03:58,190
The open source period began.

57
00:03:58,510 --> 00:04:01,770
We published the first open source version in 2017.

58
00:04:02,170 --> 00:04:06,490
And Mr.SIP appeared in Black Hat USA, Europe and Asia arsenals.

59
00:04:06,650 --> 00:04:08,690
And also the off-zone Moscow.

60
00:04:09,670 --> 00:04:14,110
We currently have 10 modules and we plan to add 5 new more modules.

61
00:04:14,890 --> 00:04:18,930
We will be gradually open sourcing more modules once they are mature.

62
00:04:18,930 --> 00:04:22,130
We aim to integrate in Kali Linux and Metasploit.

63
00:04:22,130 --> 00:04:26,230
And we look for collaboration from big Voice over IP vendors.

64
00:04:28,170 --> 00:04:32,350
Various reports show the current security risk in Voice over IP sector.

65
00:04:32,350 --> 00:04:39,290
According to CSCS 2019 report, the total loss of telecom fraud was $28.2 billion.

66
00:04:39,290 --> 00:04:45,550
And this corresponds to 1.74% of total telecom revenues.

67
00:04:46,230 --> 00:04:54,650
When we look at the most common weaknesses in the graphs on the left side, in the top three, we see that web users and VBA systems are targeted most.

68
00:04:55,350 --> 00:05:03,610
In the graphic on the right, we see that biggest risk for communication systems are denial of service attacks and caller ID information fraud.

69
00:05:05,690 --> 00:05:09,850
InstaSip is evolving and actively being used by researchers and practitioners.

70
00:05:10,110 --> 00:05:13,730
This demand from the sector confirms that we should make InstaSip better.

71
00:05:14,430 --> 00:05:19,310
It was shared on various popular forums and news sources including Black Hat's homepage.

72
00:05:19,430 --> 00:05:21,830
InstaSip was cited in Cisco publications.

73
00:05:21,830 --> 00:05:30,770
It was used in caller ID scoping tests as part of Turkish Standards Institute collaboration for national Voice over IP standard setting studies.

74
00:05:30,770 --> 00:05:35,450
It also has been used in various prestigious academic publications.

75
00:05:38,210 --> 00:05:41,950
Voice over IP technologies have unavoidable security threats.

76
00:05:41,950 --> 00:05:44,490
Voice over IP protocols are not designed securely.

77
00:05:44,490 --> 00:05:48,790
The products developed so far could not catch today's security requirements.

78
00:05:49,270 --> 00:05:56,830
Voice over IP security cannot be addressed correctly in corporate information security policies because they have low awareness about Voice over IP security.

79
00:05:56,830 --> 00:06:01,410
We foresee that Voice over IP security will gain more importance in the near future.

80
00:06:01,410 --> 00:06:04,610
And InstaSip is here to solve all the problems.

81
00:06:07,250 --> 00:06:09,970
InstaSip contains 10 modules in three categories.

82
00:06:09,970 --> 00:06:13,570
Information Gathering, Vulnerability Scanning, and Offensive modules.

83
00:06:13,830 --> 00:06:17,850
There are two helper components called IP Securing Engine and Message Generator.

84
00:06:18,190 --> 00:06:21,950
Green modules are included in the open source version, the public version.

85
00:06:21,950 --> 00:06:24,870
In pro version, we have added five more modules.

86
00:06:24,870 --> 00:06:29,310
We also extended the public modules with new features.

87
00:06:30,090 --> 00:06:33,810
Also in our roadmap, there are five new attack modules.

88
00:06:33,810 --> 00:06:37,370
In addition, we will develop an easy-to-use GUI.

89
00:06:38,030 --> 00:06:45,270
I will not go through each module one by one, but you will see in the live demos how we combine them to deploy large-scale attacks.

90
00:06:45,990 --> 00:06:50,290
If you have time in Q&A, we can discuss and explain the modules further.

91
00:06:50,490 --> 00:06:52,830
You can also read the documentation in our GitHub.

92
00:06:57,600 --> 00:07:01,040
It offers many innovative and competitive features.

93
00:07:01,040 --> 00:07:08,580
For example, high-performance multi-training, IP superfing, smart SIP message generation, self-hiding and intervention skills.

94
00:07:08,780 --> 00:07:13,820
MrSIP has also a customizable scenario development framework for stateful attacks.

95
00:07:14,500 --> 00:07:19,680
We have seen practitioners also use MrSIP as a client simulator and traffic generator.

96
00:07:21,860 --> 00:07:27,560
Banks, service providers and public institutions who has weighted infrastructure use MrSIP.

97
00:07:27,980 --> 00:07:32,740
Service integrators and consulting firms serving in the security field use MrSIP.

98
00:07:33,160 --> 00:07:36,480
We welcome if you have any novel use case of MrSIP.

99
00:07:39,140 --> 00:07:43,620
MrSIP is a tool that should be in every PAN testers' and red teamers' toolbox.

100
00:07:43,860 --> 00:07:49,220
It is also used to perform unit tests during the development of voice-over IP and security products.

101
00:07:50,120 --> 00:07:55,500
It is also useful at quality checking stage before purchasing such voice-over IP products.

102
00:07:57,880 --> 00:08:03,480
Now, before we go into technical details of MrSIP, let's understand how SIP works.

103
00:08:03,760 --> 00:08:08,620
There are three approaches of how voice-over IP is deployed and configured within organizations.

104
00:08:08,620 --> 00:08:14,060
These are internal voice-over IP implementation, managed services and online SIP tracking.

105
00:08:14,320 --> 00:08:18,200
For this presentation, we will target internal voice-over IP implementations.

106
00:08:20,260 --> 00:08:23,280
SIP is a text-based protocol very similar to HTTP.

107
00:08:23,540 --> 00:08:26,300
You can see the request methods and response types here.

108
00:08:26,960 --> 00:08:30,380
If you need more information on SIP itself, please ask in the Q&A.

109
00:08:32,980 --> 00:08:36,680
This is the very basic call flow for SIP.

110
00:08:37,560 --> 00:08:40,100
Normally, call flows can be more complex.

111
00:08:40,440 --> 00:08:43,180
This is between two users and the server in the middle.

112
00:08:43,520 --> 00:08:47,560
Although SIP is similar to HTTP, it is more complex than HTTP.

113
00:08:47,560 --> 00:08:49,600
RTP means the media.

114
00:08:51,500 --> 00:08:54,360
And this is a sample of an invite message.

115
00:08:54,700 --> 00:09:00,880
There are some specific headers and parameters which need to be vendor-specific and unique for each call.

116
00:09:03,640 --> 00:09:08,320
SIP uses a similar mechanism to HTTP known as HTTP digest.

117
00:09:08,420 --> 00:09:10,920
The user password is symmetrical and pressured.

118
00:09:11,260 --> 00:09:18,560
In SIP 2.0, MD5 hashing algorithm is applied to the authentication data before they are sent to the server.

119
00:09:19,320 --> 00:09:22,340
This is a sample of SIP register method.

120
00:09:22,340 --> 00:09:25,860
It shows the packet capture of SIP authentication request.

121
00:09:26,080 --> 00:09:30,840
This packet capture contains useful information to execute the authentication attack.

122
00:09:34,800 --> 00:09:39,380
We will demonstrate the VoIP security threats over three hacking scenarios.

123
00:09:39,920 --> 00:09:43,180
We will identify SIP servers and enumerate user extensions.

124
00:09:43,420 --> 00:09:47,900
We will talk about registration hijacking using SIP digest authentication cracking.

125
00:09:48,160 --> 00:09:51,320
We will do man-in-the-middle attack and sniff the SIP traffic.

126
00:09:51,320 --> 00:09:58,760
Call ID swiping, call e-mail swiping, telephony denial-of-service attacks are other security threats we are going to demonstrate.

127
00:09:59,320 --> 00:10:03,620
We will also abuse to non-vulnerabilities and exploits specific to SIP components.

128
00:10:04,360 --> 00:10:06,640
We have several live demos.

129
00:10:06,660 --> 00:10:15,540
In the long-distance call routing crowd demo, we will show how hackers deploy large-scale attacks to telecom companies' infrastructures.

130
00:10:17,460 --> 00:10:20,820
This is our VoIP security laboratory environment.

131
00:10:21,320 --> 00:10:24,100
We have three IP PBXs on the network.

132
00:10:24,220 --> 00:10:27,160
We use three SPACs and three PBXs as SIP servers.

133
00:10:27,820 --> 00:10:32,420
We have one attacker machine, which is Kali Linux, and MrSIP Pro is installed on it.

134
00:10:33,040 --> 00:10:36,900
There are some users registered on those PBX systems.

135
00:10:36,900 --> 00:10:40,120
We use Zoeper, Jitsi, and Minfone as soft clients.

136
00:10:42,680 --> 00:10:45,160
MrSIP is a console-based Python 3 tool.

137
00:10:45,160 --> 00:10:49,420
In order to run MrSIP in your Kali, you need to install some Python libraries.

138
00:10:49,420 --> 00:10:52,660
Please see our GitHub for full instructions.

139
00:10:53,640 --> 00:10:57,580
Here we will see how MrSIP modules work together to deploy an attack.

140
00:10:57,620 --> 00:10:59,400
Green modules are core modules.

141
00:10:59,400 --> 00:11:01,100
Blue ones are attack modules.

142
00:11:01,380 --> 00:11:03,860
External inputs such as dictionaries are in yellow.

143
00:11:04,000 --> 00:11:06,880
And gray ones are outputs of MrSIP modules.

144
00:11:07,500 --> 00:11:18,140
As you can see in the graphic above, SIP message generator feeds the network scanner, enumerator, vulnerability scanner, signaling manipulator, DOS attack simulator, and attack scenario player.

145
00:11:18,140 --> 00:11:23,840
The output of network scanner is given as an input to the enumerator and vulnerability scanner.

146
00:11:24,700 --> 00:11:30,920
In the graphic below, Sniffer, along with many of the middle attack modules, feeds evilspropper and cracker.

147
00:11:30,920 --> 00:11:36,340
The list of valid SIP users are the bold output of enumerator and evilspropper.

148
00:11:36,680 --> 00:11:41,860
Then all these outputs feed the predefined user agent and SIP extension dictionaries.

149
00:11:43,000 --> 00:11:47,780
Our first hacking story is registration hijacking for long-distance co-routing fraud.

150
00:11:48,140 --> 00:11:50,600
This attack is based on fraudulent traffic carrying.

151
00:11:51,020 --> 00:11:54,000
Hackers made millions of dollars in this fraud business.

152
00:11:54,100 --> 00:11:56,560
I will expose the details right now.

153
00:11:57,000 --> 00:12:04,620
With this attack, we target an enterprise that can make voice over IP calls over the internet, which means that they have SIP trunk services.

154
00:12:05,400 --> 00:12:10,980
As a result of this attack, the voice over IP infrastructure will be abused and will hit expensive bills.

155
00:12:10,980 --> 00:12:18,740
The underlying causes of the attack are the weak or no password policies specific to voice over IP services.

156
00:12:18,900 --> 00:12:21,660
This situation is often experienced in enterprises.

157
00:12:22,220 --> 00:12:28,780
Another reason we can say is that voice over IP communication takes place over unencrypted channels using UDP.

158
00:12:29,980 --> 00:12:43,540
The attacker's motivation is to gain user access, execute voice over IP wholesale carrier voice business through the stolen user accounts, and repeat this for hundreds of enterprises, resulting in million-dollar benefits.

159
00:12:44,600 --> 00:12:48,820
Our attack scenarios are authentication attack and registration hijacking.

160
00:12:48,860 --> 00:12:56,060
The techniques we will use are man-in-the-middle sniffing, digest authentication calculation, and dictionary-based password cracking.

161
00:12:56,380 --> 00:13:00,420
When we talk about our setup and attack steps, we have two assumptions.

162
00:13:00,680 --> 00:13:04,260
First, we were hired to make an internal voice over IP process.

163
00:13:04,260 --> 00:13:07,760
Second, the target SIP server can make voice over IP calls over the internet.

164
00:13:07,960 --> 00:13:10,400
And we know our target subnet.

165
00:13:11,000 --> 00:13:15,600
We will use network scanner, enumerator, sniffer, and cracker module of MrSIP Pro.

166
00:13:15,720 --> 00:13:20,560
We will use dictionary files as external input for user extensions and passwords.

167
00:13:21,420 --> 00:13:29,080
Our steps are, first, we will discover active SIP servers on the network and identify valid users on these servers.

168
00:13:29,600 --> 00:13:34,240
Then we will need man-in-the-middle and sniffing skills to capture SIP digest authentication data.

169
00:13:34,240 --> 00:13:40,560
And we will perform the necessary calculation in order to get the hash we need to crack.

170
00:13:41,000 --> 00:13:44,680
And then crack the password real-time with our built-in module.

171
00:13:46,420 --> 00:13:50,600
Our attacker machine is Kali Linux and MrSIP Pro is installed on it.

172
00:13:52,620 --> 00:13:55,040
For this demo, we will use two terminals.

173
00:13:55,620 --> 00:14:03,300
And the first thing we want to do is to start a SIP sniffer in terminal 2 using the IP address of our attack machine.

174
00:14:04,240 --> 00:14:07,140
Here we can see the SIP traffic activities performed there.

175
00:14:17,100 --> 00:14:20,440
We are launching our network scanner in terminal 1.

176
00:14:20,740 --> 00:14:29,720
And what SIPnest does is sending SIP option messages to all IP addresses in the given subnet to identify SIP servers according to their response status and user agent headers.

177
00:14:30,720 --> 00:14:36,100
And since we scan a subnet, we want it to be completed quickly and we gave the trading count 50.

178
00:14:36,180 --> 00:14:37,640
And the default one is 10.

179
00:14:40,440 --> 00:14:43,480
We could also give another message type instead of SIP options.

180
00:14:43,480 --> 00:14:46,120
Some servers may not respond to options.

181
00:15:07,920 --> 00:15:15,200
As a result, we detected two active SIP servers by scanning the entire network in 20 seconds and both are asterisk-based.

182
00:15:28,980 --> 00:15:37,300
This automatically writes SIPnest output to the ip__list.txt file for other modules to use.

183
00:15:40,410 --> 00:15:48,570
And we will run our SIP enumerator using the predefined user extension dictionary file named from.txt to detect users on the target server.

184
00:15:55,170 --> 00:16:01,610
And what it does is sending subscribe messages to the servers by default.

185
00:16:01,610 --> 00:16:04,230
We can use different messages too such as register.

186
00:16:04,230 --> 00:16:08,190
And it identifies wallet users according to their response status.

187
00:16:08,630 --> 00:16:19,470
And as output, it found wallet users through these servers and informed us if these users require an authentication or not.

188
00:16:19,830 --> 00:16:23,290
It detected 8 users in 10 seconds in total.

189
00:16:23,290 --> 00:16:26,570
Three of them don't have passwords at all.

190
00:16:26,570 --> 00:16:28,690
We can get these users directly.

191
00:16:28,690 --> 00:16:35,530
Now our goal is to get the passwords of five others on the list.

192
00:16:42,510 --> 00:16:49,090
For this, we are running our password cracker which performs SIP digest authentication breaking operation.

193
00:16:50,290 --> 00:16:52,990
We determined one server as target.

194
00:16:52,990 --> 00:16:57,790
As input, we need a password dictionary named wordlist__test.txt.

195
00:16:58,770 --> 00:17:08,310
What it does is listening the network using man-in-the-middle and sniffing skills, capturing SIP register messages and obtaining authentication data.

196
00:17:08,310 --> 00:17:14,530
And using the data it obtains, breaking the SIP digest authentication real-time and retrieving the passwords.

197
00:17:16,010 --> 00:17:23,910
With a soft client called Zoeper, for demo purposes, I trigger register and unregister activities for different users.

198
00:17:23,910 --> 00:17:24,110
And

199
00:17:40,650 --> 00:17:46,710
so our SIP crack module instantly involves and reveals the passwords.

200
00:18:00,880 --> 00:18:09,160
In summary, we found servers and users, we listened to the server, cracked the authentication and we took the users and committed fraud.

201
00:18:09,480 --> 00:18:20,600
As a final step, in case these users may force single registration, we can perform SIP registration erasure attack and drop their existing registrations and hijack them.

202
00:18:20,600 --> 00:18:27,820
By making this process periodic, we can repeat it over a wide network and increase the number of users we hijack.

203
00:18:28,300 --> 00:18:29,900
We can operate Osu!

204
00:18:29,900 --> 00:18:41,100
IP wholesale carrier voice or call shop or prepaid postpaid card business to make calls when the users we hijack are not using their accounts according to the country they are located in.

205
00:18:41,260 --> 00:18:45,300
Indeed, this is one of the most common hacker's attack methods.

206
00:18:45,300 --> 00:18:52,560
For example, in the night time, when real users sleep, we can start selling long distance calls in their accounts.

207
00:18:53,260 --> 00:19:03,140
This type of attacks earns millions of dollars by doing business only through hijacked VoIP accounts without running any telecom infrastructure.

208
00:19:03,500 --> 00:19:09,280
More than once, I was involved in the forensic examination of this type of attack in enterprises.

209
00:19:09,500 --> 00:19:12,340
And I will not mention about the company names.

210
00:19:13,120 --> 00:19:18,140
Our second hacking story is caller ID spoofing for a spear phishing campaign.

211
00:19:18,780 --> 00:19:22,520
Our target is any enterprise with VoIP infrastructure.

212
00:19:23,180 --> 00:19:29,620
As a result of the attack, the attacker may gain access to the systems or they can leak sensitive data.

213
00:19:30,560 --> 00:19:39,620
Reasons underlying the attack, we can say that VoIP communication takes place over unencrypted channels and the security awareness in the organization is low.

214
00:19:39,620 --> 00:19:45,400
The attacker's motivation may be to infect malicious software or steal sensitive data.

215
00:19:45,620 --> 00:19:49,680
Attacker may also steal credentials for remote access to the system.

216
00:19:50,520 --> 00:19:56,020
Our attack vectors, we can say caller ID spoofing attack and social engineering in combination.

217
00:19:56,540 --> 00:20:00,820
We will use techniques such as man-in-the-middle spoofing and SIP signaling manipulation.

218
00:20:04,340 --> 00:20:10,120
When we talk about our attack setup and attack steps, our assumption 1 is still valid.

219
00:20:10,120 --> 00:20:13,760
And we already know the target server IP address.

220
00:20:14,140 --> 00:20:17,840
We will use enumerator and eavesdropper modules of MrSIP Pro.

221
00:20:17,960 --> 00:20:22,580
We will use user extension dictionary file as external input.

222
00:20:23,460 --> 00:20:28,440
Our attack steps, we have already discovered the target server and wallet extensions.

223
00:20:28,800 --> 00:20:33,780
Then we will listen the active calls with our man-in-the-middle and sniffer-equipped modules.

224
00:20:34,380 --> 00:20:40,100
And we will both enumerate and use the obtained information in order to perform caller ID spoofing attack.

225
00:20:44,550 --> 00:20:46,850
Our attack setup is the same again.

226
00:20:47,050 --> 00:20:50,590
From the step in the previous attack, we target one of the SIP server.

227
00:20:51,150 --> 00:20:55,230
And let's run the enumerator and keep a record of which users are valid.

228
00:21:08,740 --> 00:21:13,140
And we have detected 5 active users and some users don't require authentication.

229
00:21:13,980 --> 00:21:18,940
However, keep in mind that with this attack method, we can guess valid users.

230
00:21:24,990 --> 00:21:30,330
Now, we will eavesdrop SIP calls by listening to the network with man-in-the-middle and sniffer.

231
00:21:30,350 --> 00:21:35,310
And we will both learn about the SIP call flow on the server.

232
00:21:35,310 --> 00:21:41,110
And we will make an alternative enumeration with the more real data.

233
00:21:46,420 --> 00:21:50,320
I made calls with two soft client applications for demo purposes.

234
00:21:50,640 --> 00:21:54,340
And when it gets, it shows the call with ongoing tag.

235
00:21:55,060 --> 00:22:01,700
And when the call ends, it can calculate the call duration.

236
00:22:05,540 --> 00:22:08,860
And we caught two calls for demo purposes.

237
00:22:08,960 --> 00:22:14,360
We know that 5,000 and 1,001 users are available to receive calls.

238
00:22:25,710 --> 00:22:28,330
Now, let's open a second terminal.

239
00:22:32,520 --> 00:22:37,760
And here, we can start our sniffer and observe our SIP traffic activities.

240
00:22:59,810 --> 00:23:04,550
Let's go back to terminal one and start the ColorID spoofing attack.

241
00:23:06,010 --> 00:23:14,230
And what we want to do is make a call from 1,000 to user 1,001.

242
00:23:21,170 --> 00:23:28,450
And when we send the custom invite package, we see that the call is taking place.

243
00:23:35,280 --> 00:23:42,960
In the same way, we have seen that we can make a call to the user 5,000.

244
00:23:51,180 --> 00:23:56,540
By using this attack systematically, we can make calls as insiders and perform phishing activities.

245
00:23:57,420 --> 00:24:06,200
As another attack scenario, we can create a list of target users, perform automatic calls to everyone, and play a pre-recorded media content to everyone.

246
00:24:06,880 --> 00:24:09,120
It may be an advertisement content.

247
00:24:09,840 --> 00:24:12,960
We carried out this demo attack on the internal network.

248
00:24:12,960 --> 00:24:22,640
But if the target server could receive and make calls over the internet, we would also be able to call and automate this job on the number we want.

249
00:24:23,120 --> 00:24:27,460
Of course, if you could make voice over IP calls over the internet on the attacker side.

250
00:24:28,680 --> 00:24:36,240
The only thing not here is to check if the voice over IP provider on the attacker side allows us to use custom invite message.

251
00:24:36,240 --> 00:24:44,540
Some countries and states may have regulation related to this and service providers may have implemented partial solutions to prevent this.

252
00:24:49,200 --> 00:24:54,320
Our third hacking story is abusing non-fluid-based telephone denial of service vulnerability.

253
00:24:54,740 --> 00:24:58,640
Our target is again any enterprise with voice over IP infrastructure.

254
00:24:59,300 --> 00:25:04,860
As a result of the attack, we can overload the capacity of the SIP server and cause a service interruption.

255
00:25:04,860 --> 00:25:11,620
Having the non-denial-of-service vulnerability of the target SIP server helps these attacks to take place.

256
00:25:12,680 --> 00:25:19,040
The attacker's motivation may be to cut off the accessibility of the target server and all the components it serves.

257
00:25:19,460 --> 00:25:25,120
Hackers can manipulate company's attention and carry out other insidious attacks.

258
00:25:25,660 --> 00:25:33,240
Our attack vectors are version-based scan for non-vulnerabilities and exploits and, of course, telephone denial-of-service attacks.

259
00:25:33,240 --> 00:25:38,500
We will use fluid-based T-DOS and IP spoofing techniques when performing the attack.

260
00:25:44,830 --> 00:25:51,110
Similarly, we assume that we are hired to punctest the company or any other similar ways to match this assumption.

261
00:25:51,750 --> 00:25:54,710
We have set the target server IP address.

262
00:25:55,070 --> 00:26:00,030
We use MrSIP Pro's vulnerability scanner and DOS attack simulator modules.

263
00:26:00,130 --> 00:26:02,450
We don't need any external input.

264
00:26:03,210 --> 00:26:05,070
Our attack steps.

265
00:26:05,110 --> 00:26:07,230
We already know the target server.

266
00:26:07,230 --> 00:26:12,730
We will scan for non-vulnerabilities and exploits using the server version information.

267
00:26:12,830 --> 00:26:21,310
And we will make the server inaccessible by performing fluid-based telephone denial-of-service attacks using the DOS vulnerability we have obtained.

268
00:26:27,020 --> 00:26:29,540
Our attack setup is the same again.

269
00:26:30,480 --> 00:26:34,420
Here I will work at three terminals this time for demo purposes.

270
00:26:35,080 --> 00:26:42,900
Two are offensive callings of which MrSIP Pro is installed and one of them is the target Twixbox SIP server.

271
00:27:00,020 --> 00:27:04,860
We have investigated non-vulnerabilities and exploits for our target server.

272
00:27:04,980 --> 00:27:08,700
We discovered 22 non-vulnerabilities and one exploit.

273
00:27:09,420 --> 00:27:13,120
And some weaknesses and exploits are familiar to me.

274
00:27:14,240 --> 00:27:17,300
I want to check the details immediately.

275
00:27:19,320 --> 00:27:29,380
Yes, as I guess, we know that there is a denial-of-service vulnerability against SIP invite fluid attack that I will perform with random users.

276
00:27:33,170 --> 00:27:43,610
I want to monitor the CPU and memory usage information of Twixbox in one terminal and I want to run sniffer in another to see our SIP traffic.

277
00:27:54,520 --> 00:28:05,720
In the last terminal, I will send 1000 SIP invite messages using random spoofed source IP addresses for the target SIP server.

278
00:28:56,980 --> 00:29:00,800
I started the attack and we can see the progress on the screen.

279
00:29:02,220 --> 00:29:09,800
Invite messages are starting to go away because these messages go from spoofed IP addresses and use UDP.

280
00:29:09,800 --> 00:29:18,760
Each response was retransmitted 7 times for 32 seconds due to SIP's own retransmission mechanism.

281
00:29:22,840 --> 00:29:28,620
And we can see that the output of top command is frozen at the terminal of Twixbox.

282
00:29:29,320 --> 00:29:34,920
In fact, this shows that the SIP server is no longer able to respond.

283
00:30:03,540 --> 00:30:07,180
I want to enter the web interface from the browser to verify,

284
00:30:13,350 --> 00:30:16,650
but I see that it's not accessible.

285
00:30:33,070 --> 00:30:37,670
Ping packets are reaching, but TTL seems to be strange.

286
00:30:45,960 --> 00:30:49,800
And I'm sure now that we are overloaded the server.

287
00:31:02,320 --> 00:31:10,160
I can stop the attack and can show that web interface is accessible right now.

288
00:31:20,480 --> 00:31:30,300
Although the main problem here seems to be that the SIP server works in a vulnerable version, we know that most networks are vulnerable to TTL attacks.

289
00:31:31,340 --> 00:31:45,020
Because the current security parameters cannot manage voice over IP protocols well in the application layer, and therefore cannot distinguish them from real traffic in the face of methods such as retransmission and reflection in the UDP usage.

290
00:31:45,020 --> 00:31:53,460
On the other hand, the approach of the attackers can attract attention and perform another insidious attack at the time.

291
00:31:56,560 --> 00:31:59,960
So far, we demonstrated three hacking stories.

292
00:31:59,980 --> 00:32:02,940
Now, we will further explain specific features.

293
00:32:03,680 --> 00:32:07,660
Attack scenario player allows you to perform stateful SIP call scenarios.

294
00:32:07,660 --> 00:32:10,380
We have predefined eight attack scenarios.

295
00:32:10,380 --> 00:32:19,640
It also allows you to develop new attack scenarios such as Distributed Reflected Denial-of-Service or Retransmission-Based Distributed Denial-of-Service.

296
00:32:23,030 --> 00:32:27,350
And these are the attack scenarios are developed for our connect studies.

297
00:32:27,390 --> 00:32:36,690
We named the first one Incomplete Invite Transaction DDoS with non-responding destination attack, and the second one Incomplete Invite Dialog DDoS without ACK attack.

298
00:32:37,230 --> 00:32:40,530
Both of them abuse SIP's retransmission mechanism.

299
00:32:40,530 --> 00:32:46,850
Since SIP often uses UDP in the retransmission layer, it has its own retransmission mechanism.

300
00:32:46,890 --> 00:32:55,670
In our academic research, we developed these two attack methods by using the weaknesses of the retransmission mechanism and brought them to the academic literature.

301
00:32:56,190 --> 00:33:00,930
This article was published in Elsevier's Computers and Security Journal.

302
00:33:01,830 --> 00:33:05,430
There is a prerequisite for the target in the first attack method.

303
00:33:05,430 --> 00:33:17,530
The target user should be registered to the SIP server, but they should not have access to the internet at that time, or their registration should be removed in some way at that time.

304
00:33:17,530 --> 00:33:33,910
No problem, we can provide this condition using the registration arranger attack we have added to the SIP ASP scenarios, or we can satisfy this precondition by performing Denial-of-Service attack to the target client.

305
00:33:35,110 --> 00:33:49,090
Then, what we want to do is send an invite message and wait for the SIP server to send the same invite message seven times for 32 seconds in total, using the retransmission mechanism to transmit this message to the other party.

306
00:33:49,870 --> 00:33:59,790
When no response is received from the other party, the SIP server will send us a 408 request timeout message and wait for an egg message from us.

307
00:33:59,790 --> 00:34:10,390
If we don't answer, it will assume that it cannot deliver the package and will retransmit it seven times for 32 seconds in total.

308
00:34:10,710 --> 00:34:18,390
Thus, by sending only an invite message, we occupy the source on the target server for 64 seconds.

309
00:34:19,530 --> 00:34:25,970
And we don't have a prerequisite in our attack in the second figure, the target users will be registered and accessible.

310
00:34:25,970 --> 00:34:38,450
Since we only leave the responses coming to us unanswered, we will potentially occupy server and target client resources for a minimum of 32 seconds.

311
00:34:41,020 --> 00:34:45,500
There is another attack scenario that we have developed for our academic studies.

312
00:34:45,560 --> 00:34:49,520
We named it SIP Request Reflection Attack, SR-DOS in short.

313
00:34:49,920 --> 00:34:56,740
Just like the ICMP SMURF attack, we also worked on attack methods that could reflect SIP requests and responses.

314
00:34:56,740 --> 00:35:01,920
And we brought our study results to the literature through our academic papers.

315
00:35:02,560 --> 00:35:10,980
Here, we have been able to enable these attacks by combining the weaknesses of some SIP headers priority and IP spoofing technique.

316
00:35:11,120 --> 00:35:14,420
This work was published in IEEE Access Journal.

317
00:35:15,180 --> 00:35:19,740
This is to visualize the waypoint test steps that we can do using MrSIP Pro.

318
00:35:19,760 --> 00:35:23,080
Maybe we can call it as workflow instead of methodology.

319
00:35:23,080 --> 00:35:28,180
If we call the open source version as version 1, we can call this one as version 2.

320
00:35:28,620 --> 00:35:33,980
This workflow shows what MrSIP Pro can do today and it will do more.

321
00:35:34,060 --> 00:35:37,280
Its scope will expand further with more advanced features.

322
00:35:38,240 --> 00:35:41,120
We thank our friends for their contributions.

323
00:35:41,760 --> 00:35:44,260
We also thank our lead maintainer Hakkı.

324
00:35:44,260 --> 00:35:49,660
He is a great programmer and he is available to hire for internships or full-time jobs.

325
00:35:50,440 --> 00:35:53,060
And we would like to expand our dictionaries.

326
00:35:53,080 --> 00:35:58,100
If you have any useful worklists in a related field, please share with us.

327
00:35:59,200 --> 00:36:01,740
And here are our references.

328
00:36:02,020 --> 00:36:06,740
If anyone is interested to further read, we have more details here.

329
00:36:08,480 --> 00:36:10,300
Thanks everyone for listening.

330
00:36:10,300 --> 00:36:13,500
And again, please give star in our YouTube.

331
00:36:13,500 --> 00:36:17,660
Please follow us on Twitter and please subscribe our YouTube channel.

332
00:36:17,660 --> 00:36:19,360
So we will update the world.

333
00:36:20,040 --> 00:36:22,980
These are my contact information if you want to reach out.

334
00:36:23,080 --> 00:36:24,460
I am Melih Tas on LinkedIn.

335
00:36:24,840 --> 00:36:26,020
Art and Science on Twitter.

336
00:36:26,020 --> 00:36:27,260
And Melih T on GitHub.