Modern "Enterprise" VoIP solutions are complex beasts. They usually encompass application servers (e.g. for mailboxes and to provide CTI functions), "infrastructure systems" for authentication or crypto stuff and "intelligent" phones.
In the end of the days the inherent complexity means that - while "traditional" VoIP attacks (like re-directing, sniffing and reconstructing calls) might no longer work - we've been able to severely compromise any enterprise VoIP environment we've pentested in the last twelve months. Based on a number of warstories, in this talk we'll first lay out the relevant attack vectors and the protocol or device level vulnerabilities enabling those.
We will then focus on Cisco's Unified Communications solution that seemingly disposes of a mature, certificate based crypto framework protecting both the signaling and the media transport. Well, seemingly. When closely inspecting the relevant parts and messages, it turns out that at some point all the key material can be replaced by attacker chosen keys. Which effectively means that we're down to cleartext-like attacks again...
For the first time we'll publicly provide a detailed technical explanation of the underlying vulnerabilities, show a live demo sniffing calls in a presumably fully encrypted environment and - of course ;-) - release a tool automating a number of steps of the complex overall attack. A discussion of potential mitigating controls, both on a technical and on the provisioning process level, completes the talk.
Žádné komentáře:
Okomentovat