Sjur Usken

Its a while since patch Tuesday has taken down any communication system. For those who can’t remember, Skype went down because of this. Now it is Microsoft to learn a lesson. The patch KB974571 “Vulnerabilities in CryptoAPI could allow spoofing” will actually render your Microsoft Office Communications Server useless. It will think that you will just have a demo license and then stop. Luckily it should only be to uninstall the patch and you are up and running again. Tom Keating has more on the topic.
[ad]

There is a lot of people trying to make money illegal. Some are good at it, some are not that good. Like this guy “Tony” trying to sell “Vedio Phone”. He sent a word document with cut’n’paste pictures and spec’s from several very different SIP Video phones as a reply to my account at www.alibaba.com. There were several strange issues. The high-end phones were 1/20 of the normal price and mostly the same price.

The e-mail was first sent to Julan Wang, e-mail jiayifeng20090909@yahoo.cn, then forwarded to another e- mail fengfeng20090703@yahoo.cn and then to royyang1986@yahoo.cn where “Tony” answered.

He used a company which I found out was in the textile industry, definley not in the VoIP business.

I asked for a quote to check out what this really was, and got another word document with nice “stamp” on and I was promised free shipping (great for a fraud…!). I got tired of playing around and told him I needed more information about his business for suspicion of fraud. I never heard any more…

If you want to check up who this actually is, here is where the “performa” invoice (another great spelling!) was supposed to be paid to:

Payee : Zhihao Wang
Account NO : 495282020014901
Beneficiary Institution : BANK OF CHINA  ANHUI BRANCH
Beneficiary’s Address: NO.313 CHANGJIANG MIDDLE ROAD, HEFEI, CHINA .
SWIFT CODE : BKCHCNBJ780

The SIP attack yesterday hit several Norwegian IP addresses, where several insecure IP PBXes were located. The attacker managed to several of these ringing the Citibank number. I have confirmed from different sources that minimum four PBXes were abused the last 24 hours. These were Cisco and Asterisk PBXes, but configured insecure. There were no abuse of security holes or similar, only totally insecure configuration.

I will recommend all IP PBX owners and VoIP Service Providers to check if it is tried calling to the Citibank number (+442075005000). The attacker has tried different prefixes in front, so search for the digits “%442075005000”.

Also check my previous blog about how to secure your VoIP equipment.
[ad]

Citibank is or has been under a telephone calling attack latest 12 hours. Here I will explain the attack and how it was done.

Have you seen the movie “lawnmower man”, when in the end, all phones rings in the who city? This was the aim for todays attack on Citibank in UK. The attack was simple, but probably effective when it was active. Send SIP INVITE to open SIP gateways and PBXs, who then will actually use the traditional phonesystem (POTS) to call the target. Suddenly you need DoS protection on your traditional POTS lines….

The SIP INVITE looks like this.

INVITE sip:00442075005000@x SIP/2.0
Via: SIP/2.0/UDP 217.23.7.47:58585;branch=z9hG4bKaergjerugroijrgrg
To: <sip:x>
From: <sip:217.23.7.47:58585>;tag=Zerogij34
Call-ID: 213948958-34384780214-384748@217.23.7.47
CSeq: 1 INVITE
Max-Forwards: 69
Contact: <sip:sip@217.23.7.47:58585;transport=udp>
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,NOTIFY,REFER,MESSAGE
Content-Type: application/sdp
Content-Length: 520
Session-Expires: 3600;
Allow-Events: refer..
       v=0
       o=sip 2147483647 1 IN IP4 1.1.1.1
       s=sip
       c=IN IP4 1.1.1.1
       t=0 0
       m=audio 29784 RTP/AVP 8 0 4 18 18 18 18 96 3 98
       a=rtpmap:96 telephone-event/8000
       a=sendrecva=ptime:20
       a=rtpmap:18 G729AB/8000
       a=rtpmap:18 G729B/8000
       a=rtpmap:18 G729A/8000
       a=rtpmap:18 G729/8000
       a=rtpmap:4 G723

Lets walk through the SIP packet and see what info we can get from it:

A quick google search on the tag: Zerogij34  reveals that this attack has been around since at least 6th of August.

The IP (217.23.7.47)from this packet should be located in Portugal but the other attacks originate from both UK and Netherlands.
There is no User-Agent listed, so the packet is very likely crafted from tools like sipsak or sipp.
The codec list seems real, but they use an obscure address (1.1.1.1) for the RTP. If they would use their own IP address, it could case a small DoS with RTP traffic for every successful call. The port 29784 is within the range of Cisco units (26 000-32 000)

The other INVITES reveals that the attacker is trying to figure the extension to get a dial-tone:

• INVITE sip:00442075005000@67.170.104.216 SIP/2.0
• INVITE sip:011442075005000@67.170.104.216 SIP/2.0
• INVITE sip:0442075005000@67.170.104.216 SIP/2.0
• INVITE sip:0000442075005000@67.170.104.216 SIP/2.0
• INVITE sip:0011442075005000@67.170.104.216 SIP/2.0
• INVITE sip:900442075005000@67.170.104.216 SIP/2.0
• INVITE sip:9011442075005000@67.170.104.216 SIP/2.0
• INVITE sip:90442075005000@67.170.104.216 SIP/2.0
• INVITE sip:442075005000@67.170.104.216 SIP/2.0
• and several more…

But is this a DoS attack on Citibank? I doubt it. Why call the Citibank on a Sunday 5 a.m.? This is more likely that Citibank has lots of lines and therefore the SIP INVITES does not generate an error (busy or others). The attacker does not hear any ringtone, but he/she should see the 180 Ringing / 180 Session in Progress. Then he or she knows that he could actually get through to the PSTN on this SIP proxy. If it would be a ringing attack, why does the attacker just send one single SIP INVITE through each gateway that actually calls this destination?

The machines with the attacking IP addresses should be put under surveillance to see who connects to these. They are probably just some bots in a larger network, but they need to relay back which gateways actually responded successfully.

Sad to say, but I believe this is only the small beginning….
[ad]

I’m a gadget person and I like cool technologies. I get a lot of e-mails with new products and I let my mind spin around this product how it can be used the best way and in which situations.

I do notice that there is a lot of copy products. All from an iPhone with dual SIM and a lot of other features not on the regular one, to one special that caught my eye, the Planet Unified Office Gateway (which IMHO is a UC500 copy…)

Some background:
Cisco is trying to capture the SMB market (In US it is probably just called the Small Business Market) with their Cisco Unified Communications 500 series. This product has everything in one unit and can be quite complex to sell and install, but gives the buyer (the business) most services in one unit.

Planet has then launced their own version of this “all-in-a-box” solution with their UMG-2000. It has a lot of the same features as well, but I haven’t seen the interface for admin or what firmware it is running on. But as in most cases, you get what you pay for. Wish both Planet and Cisco good luck!

I started using Cain&Abel for so many years ago for analyzing and troubleshoot WLAN. It has rich support for different WLAN protocols and also general network protocols. Visiting their webpage today, reveals that they are definitely keeping the speed up on the updates, especially on VoIP. From www.oxid.it

Cain & Abel v4.9.31 released

• SIPS Man-in-the-Middle Sniffer (TCP port 5061; successfully tested with Microsoft Office Communicator with chained certificates).
• Added support for RTP G726-64WB codec (Wengo speex replacement ) in VoIP sniffer.
• X509 certificate’s extensions are now preserved in chained fake certificates generated by Certificate Collector.
• Extended ASCII characters support for SSID in Passive Wireless Scanner.

This tool makes “The Man in the Middle” attack easy. Redirect the DNS address for a SIP Server to this tool, then proxy the traffic to the right server. You will gather all passwords for all clients “passing by”. So,  always, always use proper signed certificates on your servers. The VoIP client (SIP UA) should not (easily) accept connections from a SIP TLS server where the certificate can not be validated.

Older release news are interested for those handling the Microsoft OCS:

• Added support for the following codecs in VoIP sniffer: G722, Speex-16Khz, Speex-32Khz, AMR-NB, AMR-WB.
• Added SIREN codec support in VoIP sniffer (the default one used by Windows Messenger).  (from 207…)

Cain&Abel is an excellent tool for debugging voice problems in the full HD voip world as well now!
Thanks to MAO in Oxid for providing this great tool!
[ad]