Slashdot Mirror
Call Interception Demonstrated On New Cisco Phones
mask.of.sanity writes "Researchers have demonstrated a series of exploits that turn Cisco IP phones into listening bugs, and could allow a denial of service attack capable of silencing a call center. It allows internal staff and competitors with a little publicly-available information to hijack the phones, wiretap calls and eavesdrop on confidential meetings. The attacks work through a sequence of exploits against the latest Cisco phones enabled to run off the shelf. Most people are vulnerable, the researchers say, because they do not harden their systems in line with recommended security requirements."
Do we need any more evidence that 'enterprise level' is nothing more than a euphemism for 'poorly understood clusterfuck' ?
hold me closer frosty poster
Most people using Cisco phones are vulnerable
FTFY!
There have been so many security holes in all sorts of hardware and for so long, that I have to think that there is a basic failure of top management to understand and grasp the issues involved in the trust people place in their products.
Having top managers make decisions on whether a program gets top flight security implemented from day 1 of a program's inception would be a big mistake.
Security today ought to be #1. Ask Sony for instance, or any one of the other dozen recent companies who have failed basic updates to their servers even after the lack of updates was published publicly online.
Sheesh. What does it take to get top management "on board".
Glad I only run cisco phones that are outdated and run a SIP firmware.
Cisco makes great hardware, but their phone system software (and pricing) utterly sucks. I am doing things with asterisk here at the office that makes the cisco rep's jaw drop.
Do not look at laser with remaining good eye.
My naive inexperienced self presume 'Enterprise' to mean rock-solid, if not crufty software like Solaris, AIX, etc. Not shiny by any stretch of the imagination, but solid.
Now I know the truth, that by and large 'Enterprise' software is entirely convoluted fragile pieces of crap that mandates large amounts of work to maintain. They do not win because of quality, they win based on smoozing salespeople and executives and/or architects intentionally sabotaging things for the sake of job security.
A Cisco spokesman said the networking vendor was serious about security and advised users to apply the relevant recommendations in the manual to secure their systems.
[...]
The weaknesses result from Cisco's reliance on web functions that gave users functions at the cost of easier penetration for hackers.
[...]
“The book says to shut off web services,” Wesley said
So why the hell is Cisco shipping devices with features that they themselves recommend disabling for security reasons, unless you have specific need for them, enabled by default?
There's a phone just like the one in that pic on my desk.
I have been working on the open source softswitch FreeSWITCH http://www.freeswitch.org/ for almost 6 years now.
During that time I have seen SIP continuously evolve to try to cover its own shortcomings which all stemmed from the simple concept of "If we base it on HTTP, we can use proxys and never have to worry about media" Of course this is not true and the amount of complexity that is put into each SIP device is much too great which is probably why Cisco prefers its own lighter "skinny" protocol. Sadly they own Sipura and Linksys and have SIP on their devices using countless hacks that make interop a nightmare. I am sure you can do many of these same attacks on any brand of phone. There are much better reasons out there to curse Cisco for being involved in VoIP. =D
1. Does your system use software? /not/ been subject to significant public attack/repair/analysis.
2. Is it connected to a network, or does it have any kind of outward-facing attack surface?
3. Is it an embedded system?
4. Is it based on Windows?
5. Is it based on another commercial OS?
6. Does it use a significant number of standard libraries?
7. Is it proprietary, or has it
8. Does it handle any kind of sensitive data, have a microphone that could overhear things, or is it connected to a network that has other kinds of sensitive data on it.
If you answered 'yes' to question 8 and any one of the previous questions, then your system has a critical vulnerability that could lead to a total compromise. Finding that vulnerability will require varying degrees of effort, from 'almost none' to 'a year of with a fuzzing framework and IDA'.
If you answered yes to 3, 4 and 5, possibly 6, definitely 7, then it'll be closer to the easier side than the hard side.
I work in the security industry, so I perhaps I'm just a bit jaded. But I have to say that the novelty of these stories has worn off for me --- we could probably save everyone a lot of trouble by setting up a cron job that generates 'random system of the day has vulnerability' new stories.
(And yes, I realize that it's important to keep vendors on their toes, etc. But this will be handled like every other story: a few holes will be patched, the vendor will brush off the concerns, and it'll be business as usual.)
The article says that this exploits the web access on the IP phones. Also, there are several references to it having to be 'out-of-the-box.'
IP phones registered to CUCM automatically upgrade the firmware to what matches the CUCM device pack. All recent firmware releases (9.x) have webAccess disabled by default, and that firmware is used for recent CUCM 7.1 and 8.0 releases. And upgrading firmware on a cluster in bulk is a pretty quick/easy task.
On top of that, the attacker would need to be in the LAN (assuming the presence of a FW at the border of the network) and on a network route-able to the voice network.
I'm not saying it isn't a concern, but this is less of an issue than the article makes it seem.
\ I read the article and it provides no details on the exploit(s). How are we supposed to know if a system is vulnerable, let alone what configuration changes are required to harden security? The article links to the original Slashdot submission, which links to the article... which came first, and where is the original source?
"Don't hate the media, become the media." -Jello Biafra
There's no details about anything in that article. Aside from the single picture of one 7975 phone showing RickRolled, it doesn't list vulnerable phone models at all. (Also strange is that the 7975 is a model that doesn't handle video calls on the phone itself, so I'm not sure how a video is playing on it). Despite that, the summary here on Slashdot tells everyone that Cisco's 7900 series of phones is vulnerable with the link given for its "Latest IP Phones". There's more models of phones that Cisco makes ... 3900 series, 500 series, 8900 series, 9900 series, 6900 series to name a few more (http://www.cisco.com/en/US/products/sw/voicesw/products.html#N4FD791). Of those, the 7900 is not the newest.
At least pull your facts from the article, please.
Are these recommendations? or requirements?
Cisco IP phones are not designed to be secure out of the box. They periodically connect to an unsecured FTP site to download firmware and unencrypted password text files. They use DHCP to determine the FTP site and the phone directory. The phones accept remote commands that allow you to control them: push any button, dial calls, turn on/off the speakerphone, etc. Back in 2005 I worked in an office and we had fun telneting to each other's phones and making them quack or display funny messages or other such nonsense. The articles are light on details but it sounds like nothing has changed.
VoIP systems can be compromised/abused? I intercept calls at work ("... for quality assurance and monitoring purposes ..."); if that system was compromised someone could certainly demonstrate call interception on a two-bit Asterisk/Polycom setup too.
I read TFA and there is no mention of what the attack is. As some who actually works in this field as a Cisco VAR for Telephony we have all known for a long time how to make a bug on a line, if you are the sys admin of the Communication Manager server. However, that is more like core functionality of the system.
Imagine you need to old school push button to talk to your secretary (i said old school). You could do this on any phone that has an unused line by setting it up with No Label and and Auto Answer true. I do not see how this is going to be done remotely unless they know the admin password. That is usually only stored in the DC on a post note on that server, so it is hard to guess.
Here is the question though. is this actually a bug, or a feature for other groups of people?
Sounds to me you've not worked on UCM recently, if it all.
Call Forward No Coverage.
LCR (from the very beginning):
1. Create a Route Group containing the gateway or trunk device for the site you are configuring LCR
2. Create a Route List containing the previously created Route Group
3. Create a Route Pattern for the LCR pointing to the Route List previously created
That's all.
Cisco's Unified Communications Manager platform is extraordinarily well built once you move past version 7.1.3 (6 was a solid, but 7 introduced logical routing and other important features). Yes it is expensive. But it is robust, stable and the pool of knowledgable engineers can't be denied; if you don't understand the immediate value of that I've wasted your time and mine. Lastly, before I end this rant, one word: support. Who do you call for support at 10pm for your Asterix box? Sure, some companies provide support, but not on the same level Cisco can provide.
plus net outages don't make a satellite office useless unlike a centralized Cisco setup.
I am now certain you either have no experience with Cisco's UC platform or simply live with your head in the sand. The technology is called Survivable Remote Site Telephony (SRST).
Comparing Asterix to Cisco's UCM is disingenuous as they have entirely different markets with different requirements.
The simple fact of the matter is you don't deploy Asterix if you can afford UCM (if you can afford it, you're likely large enough to benefit from it).
So, to recap:
-Enterprises need support. They need it yesterday when problems arise.
-Knowledgable engineers to support and maintain the solution.
-UCM was built to scale. I'm talking 300 sites, 150,000 end points, 12 call processing agents (termed Super Cluster when you have more than 8), numerous MoH/TFTP servers and the like. This is easily possible with CUCM, and it's extremely stable.
-The platform is easily extended to Presence, WebEx, Contact Centers, Attendant Consoles, and numerous 3rd party applications.
-Cisco has another advantage which no other company in the world can claim: They own the network. That means a fully integrated solution, from the switch to the handset, and the numerous benefits that entails.
An aside, of the clients I have personally migrated from Asterix (of which there are 4), none had more than 5,000 end points.
Please acquire some perspective before you go around baselessly besmirch the big bad corporation and their products, and please don't try to make an argument about the feature set differences. That's never the deciding factor with these two products.
P.S: the virtual person you describe is available as a 3rd party solution.
Well, that turned out longer than I intended; apologies, as I could keep going on and on about this subject.
I discovered a similar weakness that could bring down the call center with a few lines of VXML code. It crashes the router. I discovered it by accident while programming an IVR app. I reported it to no less than 3 TAC engineers and 2 TAC managers but they said that since my code was in development and not production that they wouldn't even start a ticket. Its not a bug if it is not in production they told me.
Could it be used against telemarketers? Please?