Re: [Full-Disclosure] ASN.1 telephony critical infrastructure warning

[Michal Zalewski]

On Tue, 17 Feb 2004, Gadi Evron wrote:

> ASN is what VOIP is based on, and thus the critical infrastructure for
> telephony which is based on VOIP.
>
> This may be a false alarm, but you know how worms find their way into
> every network, private or public. It could (maybe) potentially bring the
> system down.

Balooney. ASN.1 is not a network service, is a notation standard used in,
among other things, some network protocols. A worm that targets one of the
protocols, if is going to show up at all - some disagree with your
assessment the vulnerability is "very easy to exploit", so perhaps it
would be good to substantiate your claim - would not magically start
attacking a wholly different protocol, where ASN.1 is used in a different
way, just like this.

Such a worm would have to target VoIP specifically to attack it
successfully (and this is unlikely, as this is not a vector commonly open
on desktop systems), for starters. Even then, a relatively small
percentage of all VoIP applications, particularly the mission-critical
ones, are running off of Windows, I suppose. The world is not going to end
tomorrow.

That is no say there is no risk; quite the opposite. An aggressive worm
may quite efficiently bring down large parts of critical infrastructure by
simply overloading systems and networks. But then, it would be no
different from Nachi and whatnot, and there's nothing about ASN.1 to it.

--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-02-17 17:17 --

http://lcamtuf.coredump.cx/photo/current/

[Zak Dechovich]

I would like to answer you all together, as I was the one who started this
thread,

ASN1 is a simple data encapsulation, the problem occurs when the
decapsulation procedure fails because of any reason.
in the case at hand, the data slips into the code segment.

My intention was not a worm that spreads by ASN1 but one that locates VoIP
based communication and attacks it !
you can do a lot by inserting code into these devices that are software
driven !

Here is a simple description of the h323 protocol, BASED ON ASN1, feel free
to access any one of these items and use the exploit :-)

End-Point:

q931 - port 1720 - initial hand shake
h225 - port 1720 - media capabilities negotiations for h245
h235 - port 1720 - negotiate security
h245 - dynamic port - negotiate media real-time protocol, and data channel
h45x - Waiting call, pressed keys (to save line bandwidth), etc.
.. RTP - (Real Time Protocol) dynamic ports UDP/TCP- transfer media codecs
(video and audio), T38 (fax), T120 (data)

T120 - Send files, share documents, etc. - implemented in netmeeting

GateKeeper:

H324 - Authenticate user for call

* Long time didn't touch the VoIP so forgive me if I had a mistake somewhere
in the Hxxx.

Companies today have introduced the VoIP into their systems to save
telephony resources, calls between offices and to manage&control their
equipment (Telephony Service Providers)
a worm can nest until it will find a VoIP infrastructure and attack, if it
is "smart" it will take access of the infrastructure !

There is usualy a DIRECT CONNECTION between the internet --> LAN --> VoIP
equipment !

In my humble opinion, we're not going to see an outbreak but some surgical
attacks.

I must underline that I don't know if all use the same parser, BUT, let me
refer you to Berkley's SNMP protocol precedent that was copied and pasted
everywhere with the exploit inside ...

Sincerely,

Zak Dechovich,
Managing Director
SecureOL Ltd.
Mobile: +972 (53) 828 656
Office: +972 (2) 675 1291
Fax: +972 (2) 675 1195


-----Original Message-----
From: Michal Zalewski [mailto:lcamtuf@ghettot.org]
Sent: Tuesday, February 17, 2004 6:23 PM
To: Gadi Evron
Cc: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com; Zak
Dechovich
Subject: Re: [Full-Disclosure] ASN.1 telephony critical infrastructure
warning - VOIP


On Tue, 17 Feb 2004, Gadi Evron wrote:

> ASN is what VOIP is based on, and thus the critical infrastructure for
> telephony which is based on VOIP.
>
> This may be a false alarm, but you know how worms find their way into
> every network, private or public. It could (maybe) potentially bring the
> system down.

Balooney. ASN.1 is not a network service, is a notation standard used in,
among other things, some network protocols. A worm that targets one of the
protocols, if is going to show up at all - some disagree with your
assessment the vulnerability is "very easy to exploit", so perhaps it
would be good to substantiate your claim - would not magically start
attacking a wholly different protocol, where ASN.1 is used in a different
way, just like this.

Such a worm would have to target VoIP specifically to attack it
successfully (and this is unlikely, as this is not a vector commonly open
on desktop systems), for starters. Even then, a relatively small
percentage of all VoIP applications, particularly the mission-critical
ones, are running off of Windows, I suppose. The world is not going to end
tomorrow.

That is no say there is no risk; quite the opposite. An aggressive worm
may quite efficiently bring down large parts of critical infrastructure by
simply overloading systems and networks. But then, it would be no
different from Nachi and whatnot, and there's nothing about ASN.1 to it.

--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-02-17 17:17 --

http://lcamtuf.coredump.cx/photo/current/

[daniel uriah clemens]

Here are some more details on various things that use ASN.1

http://asn1.elibel.tm.fr/en/uses/rfc.htm

-Dan
On Tue, 17 Feb 2004, 3APA3A wrote:

> Dear Gadi Evron,
>
> ASN.1 is used by many services, but all use different underlying
> protocols. It's not likely NetMeeting or MS ISA server to be primary
> attack targets. Attack against MS IPSec implementation, Exchange,
> SMB/CIFS, RPC services, IIS and specially IE will no have impact to VoIP
> infrastructure (except connectivity degradation because of massive
> traffic). And these applications are more likely to be attack target.
>
> --Tuesday, February 17, 2004, 6:37:53 PM, you wrote to bugtraq@securityfo=
cus.com:
>
> GE> I apologize, but I am using these mailing lists to try and contact th=
e
> GE> different */CERT teams for different countries.
>
> GE> As we all know, ASN.1 is a new very easy to exploit vulnerability. It
> GE> attacks both the server and the end user (IIS and IE).
>
> GE> We expect a new massive worm to come out exploiting this vulnerabilit=
y
> GE> in the next few days.
>
> GE> Why should this all interest you beyond it being the next blaster?
>
> GE> ASN is what VOIP is based on, and thus the critical infrastructure fo=
r
> GE> telephony which is based on VOIP.
>
> GE> This may be a false alarm, but you know how worms find their way into
> GE> every network, private or public. It could (maybe) potentially bring =
the
> GE> system down.
>
> GE> I am raising the red flag, better safe than sorry.
>
> GE> The two email messages below are from Zak Dechovich and myself on thi=
s
> GE> subject, to TH-Research (The Trojan Horses Research Mailing List). Th=
e
> GE> original red flag as you can see below, was raised by Zak. Skip to hi=
s
> GE> message if you like.
>
> GE> Gadi Evron.
>
>
>
> GE> Subject: [TH-research] */CERT people: Critical Infrastructure and ASN=
=2E1
> GE> - VOIP [WAS: Re:
> GE> [TH-research] OT: naming the fast approaching ASN.1 worm]
>
> GE> Mail from Gadi Evron <ge@linuxbox.org>
>
> GE> All the */CERT people on the list:
> GE> If you haven't read the post below, please do.
>
> GE> Anyone checked into the critical infrastructure survivability of an A=
SN
> GE> worm hitting? phone systems could possibly go down. We all know how
> GE> worms find their way into any network, private or otherwise. and VOIP
> GE> systems (which phone systems are based on nowadays) could go down.
>
> GE> Heads-up! Finds them contingency plans.. :o)
>
> GE> Any information would be appreciated, or if you need more information
> GE> from us: +972-50-428610.
>
> GE> Gadi Evron.
>
>
> GE> Zak Dechovich wrote:
>
> >> Mail from Zak Dechovich <ZakGroups@SECUREOL.COM>
> >>
> >> May I suggest the following:
> >>
> >> ASN1 is mainly used for the telephony infrastructure (VoIP),
> >> any code that attacks this infrastructure can be assigned with 'VoIP'
> >> prefix, followed by the attacked vendor (cisco, telrad, microsoft, et=
c.).
> >>
> >> for example, if (when) Microsoft's h323 stack will be attacked, the n=
ame
> >> should be VoIP.ms323.<variant>, or if Cisco's gatekeepers will crash,
> GE> lets
> >> call it VoIP.csgk.<variant>
> >>
> >> Your thoughts ?
> >>
> >> Zak Dechovich,
> >>
> >> Zak Dechovich,
> >> Managing Director
> >> SecureOL Ltd.
> >> Mobile: +972 (53) 828 656
> >> Office: +972 (2) 675 1291
> >> Fax: +972 (2) 675 1195
>
> GE> -
> GE> TH-Research, the Trojan Horses Research mailing list.
> GE> List home page: http://ecompute.org/th-list
>
> GE> _______________________________________________
> GE> Full-Disclosure - We believe in it.
> GE> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
> --
> ~/ZARAZA
> =D1=FD=F0 =C8=F1=E0=E0=EA =CD=FC=FE=F2=EE=ED =EE=F2=EA=F0=FB=EB, =F7=F2=
=EE =FF=E1=EB=EE=EA=E8 =EF=E0=E4=E0=FE=F2 =ED=E0 =E7=E5=EC=EB=FE. (=D2=E2=
=E5=ED)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

-Daniel Uriah Clemens

Esse quam videra
=09=09(to be, rather than to appear)
=09 -Moments of Sorrow are Moments of Sobriety
{ o)2059686335 c)2055676850 }