SecurityTube

Description: https://media.blackhat.com/bh-eu-12/Rey/bh-eu-12-Rey-Call_Belong_to_Us-WP.pdf
https://media.blackhat.com/bh-eu-12/Rey/bh-eu-12-Rey-Call_Belong_to_Us-Slides.pdf
Modern Enterprise VoIP solutions are complex beasts. They usually encompass application servers (e.g. for mailboxes and to provide CTI functions), infrastructure systems for authentication or crypto stuff and intelligent phones.

In the end of the days the inherent complexity means that - while traditional VoIP attacks (like re-directing, sniffing and reconstructing calls) might no longer work - we've been able to severely compromise any enterprise VoIP environment we've pentested in the last twelve months. Based on a number of warstories, in this talk we'll first lay out the relevant attack vectors and the protocol or device level vulnerabilities enabling those.

We will then focus on Cisco's Unified Communications solution that seemingly disposes of a mature, certificate based crypto framework protecting both the signaling and the media transport. Well, seemingly. When closely inspecting the relevant parts and messages, it turns out that at some point all the key material can be replaced by attacker chosen keys. Which effectively means that we're down to cleartext-like attacks again...

For the first time we'll publicly provide a detailed technical explanation of the underlying vulnerabilities, show a live demo sniffing calls in a presumably fully encrypted environment and - of course ;-) - release a tool automating a number of steps of the complex overall attack. A discussion of potential mitigating controls, both on a technical and on the provisioning process level, completes the talk.

Tags: securitytube , conference , hacking , hackers , information security , convention , computer security , blackhat12 , blackhat-2012 ,

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Comments:

Login to post a comment