[SPAM] RE: [VOIPSEC] Actual Attacks

Fri Feb 25 20:18:58 CST 2005

I totally agree...but I also personally believe that these are near term
threats subject only to increased exposure and knowledge of the
infrastructures...just because it doesn't exist today doesn't mean it won't
tomorrow. 

Also with respect to the Eavesdropping issue, I also agree with your
comments. I believe that the threat, at least to business networks (with
switched environments) is an internal issue requiring physical access and
knowledge (I think I stated that before, but I will paraphrase: 70% of
threat is employee related). 

It is a risk though, how it is prioritized is a different story...we should
work on a risk factor scale to use in prioritizing risks say on a scale of
1-5, 5 being highest risk 1 being lowest. This could provide a
prioritization scale for projects. 

Most organizations will hold that information at arms length if they have
any security or business sense at all. It's like saying "I don't have a
firewall and all of my data is open for anyone to get at". You just don't do
that, even with close friends. But I suspect the occurrences are lower today
and would not dispute this fact either. 

I think it would be prudent to take a position as a group that we are not
only looking to defeat the existing attacks which often have common sense
existing mitigation techniques (though we should ensure that we include and
update these best practices to include VoIP specific mitigations), but that
we should be determining the future potential threats as if they exist today
and identify why these potential risks exist. 

Many of you that know me, know that I am always looking to mitigate the
future unknown risk...we already know how to handle the existing
risks...doesn't mean that everyone does it. :(

I believe that identifying future risk should be a requirement because the
protocols and applications are emerging and becoming more popular and
widespread...with exposure new exploits will become not only prevalent, but
also will begin to leverage these emerging protocols and applications into
the new forms of exploit that very well may be speculation today.

I think spish is a good near term example that I am sure some shop in a
sheltered country (The same makers of spyware and those loveable viruses
that do exist today) is just waiting to address...if they haven't already.

The talent available to this group today can provide a perfect unbiased,
logical avenue to: 
1. Brainstorm the potential risk or exploit
2. Prove it to be an actual risk or exploit or merely speculation by testing
(if it can't be tested it must be bogus, or is it?)  :)
3. Brainstorm the mitigation or develop mitigating factors
4. Possibly in the open source frame of mind develop the mitigation for the 
   requirement and publish the mitigating factors

With all of that said, how does a Risk assessment group sound? It would mean
following the emerging standards and determining how they fit into existing
infrastructure(s)...and would be a more globally focused (birdseye) group
until testing begins. One warning: This type of endeavor is however loosely
focused/multi-scoped as the risks may lead in many directions.

Christopher A. Martin
P.O. Box 1264
Cedar Hill, Texas 75106
Chris at InfraVAST.com

> -----Original Message-----
> From: Brian Rosen [mailto:br at brianrosen.net]
> Sent: Friday, February 25, 2005 7:19 PM
> To: Chris at sip1.com; 'Mark Teicher'; voipsec at voipsa.org
> Subject: [SPAM] RE: [VOIPSEC] Actual Attacks
> 
> Chris
> 
> I'm pretty heavily involved in SIP standards development, and have been
> for
> some time.  I talk regularly with the kind of folks that I think would
> know
> if their stuff had been "hit".  I know about plenty of attacks on the
> underlying infrastructure, including the platform attacks.  I have NEVER
> heard even a whisper of an actual attack on VoIP equipment that used
> exploits specifically related to SIP (which I don't think is substantially
> better or worse than other VoIP protocols).  There is one exception, which
> is when the Uppsala tests came out, some folks saw script kiddies using
> the
> test scripts against some devices.  As we know, most devices did crash
> first
> time out with those tests.  So agree that there have been attacks,
> primarily
> using platform vulnerabilities, but don't think there have been many
> attacks
> directly on the VoIP stuff.
> 
> With regard to eavesdropping, it's not very easy to eavesdrop within a
> corporate network unless you have physical access to the switches, or, for
> a
> really knowledgeable hacker, passwords to the network management systems.
> The nature of the switched architecture is that packets come in one port
> and
> go out ONE other port; it's not a bus or broadcast system any more.
> 
> Now, I always assume it's possible when designing systems; assume that
> every
> switch is a bridge..., but the reality is that sniffing packets for VoIP
> is
> much harder than most people think it is.
> 
> Brian
> 
> > -----Original Message-----
> > From: Christopher A. Martin [mailto:chris at sip1.com]
> > Sent: Friday, February 25, 2005 6:51 PM
> > To: 'Brian Rosen'; 'Mark Teicher'; voipsec at voipsa.org
> > Subject: RE: [VOIPSEC] Actual Attacks
> >
> > Hi Brian,
> > Just a little comment on your question...
> >
> > Many of these attacks do involve the use of protocols other than SIP to
> > perform, such as DNS poisoning, which is a real existing threat today
> due
> > to
> > complacency or resource issues (in terms of staff and time).
> >
> > The reason you won't hear much about any real exploits is that no one
> > wants
> > this to get out. Even in existing non VoIP implementations, until
> > regulatory
> > stepped in (Sarbanes Oxley, etc...) no one wanted this dirty laundry to
> go
> > public...and I suspect even with regulations secrets will be kept as
> long
> > as
> > possible.
> >
> > You are correct though on the eavesdropping, this typically will be an
> > insider attack (which as statistics show is about 70% of actual
> enterprise
> > threat) or kiddies on wifi and cable modems as you noted.
> >
> > This is one of the reasons that I focus on the big picture when
> developing
> > the preventive measures for an infrastructure. SIP is one piece, but it
> > can
> > easily be the facilitator that was missing in the past for true
> > exploitation. This is however at the moment an unfounded comment...to
> > date.
> >
> > Christopher A. Martin
> > P.O. Box 1264
> > Cedar Hill, Texas 75106
> > Chris at InfraVAST.com
> >
> > > -----Original Message-----
> > > From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org]
> On
> > > Behalf Of Brian Rosen
> > > Sent: Friday, February 25, 2005 4:32 PM
> > > To: 'Mark Teicher'; voipsec at voipsa.org
> > > Subject: RE: [VOIPSEC] Actual Attacks
> > >
> > > Are you aware of this actually happening, or is this all theoretic?
> > >
> > > I've never heard of actual incidents of any of this.
> > >
> > > The latter (eavesdropping) is actually the reverse; when we do
> testing,
> > we
> > > have to go through all kinds of grief to allow the sniffers to get at
> > the
> > > packets.  Someone has to actually bring a hub (not a switch) so we can
> > > sniff
> > > the packets.  You can, of course, run Etherreal on some of the actual
> > > devices.  It's amazingly hard to sniff packets in a typical switched
> > > architecture.  When we implement CALEA (legal wiretap), it takes a
> > special
> > > box that we force all the traffic to go through so we can copy the
> > packets
> > > to the LEA.
> > >
> > > WiFi and your neighbor's cable modem excepted, of course.
> > >
> > > Brian
> > >
> > > > -----Original Message-----
> > > > From: Voipsec-bounces at voipsa.org [mailto:Voipsec-bounces at voipsa.org]
> > On
> > > > Behalf Of Mark Teicher
> > > > Sent: Friday, February 25, 2005 4:37 PM
> > > > To: voipsec at voipsa.org
> > > > Subject: RE: [VOIPSEC] Actual Attacks
> > > >
> > > > Actual Attacks
> > > >
> > > > SIP Proxy Impersonation
> > > > SIP Proxy Hijacking
> > > > Message Tampering - hard to devise an common exploit across VOIP
> > > > platforms, but most likely possible
> > > > Denial of Service - depends on the packet, usually just causes a
> phone
> > > to
> > > > reset, or a port to shutter on the gateway, call server more
> > vulnerable
> > > > due to the underlying operating system
> > > > Session Attack - hard to devise a common exploit applicabel across
> all
> > > > VOIP platforms, possible on some of the well known vendors
> > > > Eavesdropping - more feasible than most, especially if some of the
> > > default
> > > > features of the particular VOIP equipment is not configured
> properly.
> > > >
> > > > -----Original Message-----
> > > > From: Robert Moskowitz <rgm at icsalabs.com>
> > > > Sent: Feb 25, 2005 1:56 PM
> > > > To: Brian Rosen <br at brianrosen.net>, 'Simon Horne'
> > <security at isvo.net>,
> > > > 	voipsec at voipsa.org
> > > > Subject: RE: [VOIPSEC] Actual Attacks
> > > >
> > > > At 09:36 AM 2/24/2005, Brian Rosen wrote:
> > > >
> > > > >"Web of Trust" is a failed concept.  It works, but we have not been
> > > able
> > > > to
> > > > >successfully deploy in a large scale.
> > > >
> > > > But it CAN work for groups of friends.
> > > >
> > > > >Certificate authority chains work only within an enterprise.  We
> have
> > > not
> > > > >really made them work well outside of that.
> > > >
> > > > Check out ACES.
> > > >
> > > > Check out the Federal PKI and work being done to duplicate it in
> > > > commercial
> > > > settings (drug industry for one).  Note I am the author of the
> Bridge
> > CA
> > > > model in the federal PKI.
> > > >
> > > > Thing is you REALLY need a reason to get PKi s to work together.
> Mail
> > > was
> > > > never one.  Bout VoIP could be.
> > > >
> > > >
> > > > Robert Moskowitz
> > > > Senior Technical Director
> > > > ICSA Labs, a division of Cybertrust, Inc.
> > > > W:      248-968-9809
> > > > F:      248-968-2824
> > > > E:      rgm at icsalabs.com
> > > >
> > > > There's no limit to what can be accomplished
> > > > if it doesn't matter who gets the credit
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Voipsec mailing list
> > > > Voipsec at voipsa.org
> > > > http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
> > > >
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Voipsec mailing list
> > > > Voipsec at voipsa.org
> > > > http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
> > > >
> > >
> > >
> > >
> > >
> > > _______________________________________________
> > > Voipsec mailing list
> > > Voipsec at voipsa.org
> > > http://voipsa.org/mailman/listinfo/voipsec_voipsa.org
> >
> >