Re[2]: [Full-Disclosure] ASN.1 telephony critical infrastructure warning - VOIP

[3APA3A]

Dear Florian Weimer,

It's different thing. Any infrastructure based on Windows is under risk.
But it's not because VoIP uses ASN.1.

--Wednesday, February 18, 2004, 12:32:10 AM, you wrote to 3APA3A@SECURITY.NNOV.RU:

FW> 3APA3A wrote:

>> ASN.1 is used by many services, but all use different underlying
>> protocols. It's not likely NetMeeting or MS ISA server to be primary
>> attack targets. Attack against MS IPSec implementation, Exchange,
>> SMB/CIFS, RPC services, IIS and specially IE will no have impact to VoIP
>> infrastructure (except connectivity degradation because of massive
>> traffic).

FW> I wish your assessment were true, but it's not. Cisco Call Manager is
FW> based on Windows, and Cisco still has to certify the patches Microsoft
FW> released.

FW> It's sad that Microsoft apparently hasn't used those six months to
FW> properly coordinate the issue with OEM vendors.


--
~/ZARAZA
Íó à òåïåðü, Óèëüÿì, õîðîøåíüêî ïîðàçìûñëèòå íàä äàííûì ïèñüìîì. (Òâåí)

[RJ Auburn]

I would say that this is somewhat misleading. First of all not all VoIP
services use ASN.1 encoding for the protocol. While H.323 does SIP does
not.

Additionally I suspect that not many of the carrier deployment of H.323
are using the MS ASN.1 libs as most of them are unix based (many of
them will be running SPARC/Solaris).

Now that being said if companies are allowing VoIP to the desktop for
services like netmeeting there could be problems.

RJ

---
RJ Auburn
CTO, Voxeo Corporation
tel:+1-407-418-1800


On Feb 17, 2004, at 07:37, Gadi Evron wrote:

> I apologize, but I am using these mailing lists to try and contact the
> different */CERT teams for different countries.
>
> As we all know, ASN.1 is a new very easy to exploit vulnerability. It
> attacks both the server and the end user (IIS and IE).
>
> We expect a new massive worm to come out exploiting this vulnerability
> in the next few days.
>
> Why should this all interest you beyond it being the next blaster?
>
> ASN is what VOIP is based on, and thus the critical infrastructure for
> telephony which is based on VOIP.
>
> This may be a false alarm, but you know how worms find their way into
> every network, private or public. It could (maybe) potentially bring
> the system down.
>
> I am raising the red flag, better safe than sorry.
>
> The two email messages below are from Zak Dechovich and myself on this
> subject, to TH-Research (The Trojan Horses Research Mailing List). The
> original red flag as you can see below, was raised by Zak. Skip to his
> message if you like.
>
> Gadi Evron.
>
>
>
> Subject: [TH-research] */CERT people: Critical Infrastructure and
> ASN.1 - VOIP [WAS: Re:
> [TH-research] OT: naming the fast approaching ASN.1 worm]
>
> Mail from Gadi Evron <ge@linuxbox.org>
>
> All the */CERT people on the list:
> If you haven't read the post below, please do.
>
> Anyone checked into the critical infrastructure survivability of an ASN
> worm hitting? phone systems could possibly go down. We all know how
> worms find their way into any network, private or otherwise. and VOIP
> systems (which phone systems are based on nowadays) could go down.
>
> Heads-up! Finds them contingency plans.. :o)
>
> Any information would be appreciated, or if you need more information
> from us: +972-50-428610.
>
> Gadi Evron.
>
>
> Zak Dechovich wrote:
>
> > Mail from Zak Dechovich <ZakGroups@SECUREOL.COM>
> >
> > May I suggest the following:
> >
> > ASN1 is mainly used for the telephony infrastructure (VoIP),
> > any code that attacks this infrastructure can be assigned with 'VoIP'
> > prefix, followed by the attacked vendor (cisco, telrad, microsoft,
> etc.).
> >
> > for example, if (when) Microsoft's h323 stack will be attacked, the
> name
> > should be VoIP.ms323.<variant>, or if Cisco's gatekeepers will
> crash, lets
> > call it VoIP.csgk.<variant>
> >
> > Your thoughts ?
> >
> > Zak Dechovich,
> >
> > Zak Dechovich,
> > Managing Director
> > SecureOL Ltd.
> > Mobile: +972 (53) 828 656
> > Office: +972 (2) 675 1291
> > Fax: +972 (2) 675 1195
>
> -
> TH-Research, the Trojan Horses Research mailing list.
> List home page: http://ecompute.org/th-list
>

[Michael Samuel]

Hi,

I work for a VoIP provider, and I thought I'd clear up a few points:

If desktop PCs have access to the PSTN via VoIP, it's entirely
possible for a worm (or intruder) to use the PSTN as that VoIP user.
(That could be used for a telemarketing worm or a DDoS on somebody's
phone pool, I guess) This is regardless of which vulnerability the worm
uses.

This is made worse because some VoIP software (well, at-least one SIP
based VoIP package) disables authentication by default when adding a
user, and makes you jump through hoops to enable it.

Yet this is mostly mitigated because almost all VoIP infrastructure is
on a separate network (generally controlled by vlans and some sort of
VPN technology), which can't be accessed by desktop PCs. I beleive this
is pretty-much standard with Cisco equipment. So, assuming the router
and switching hardware is secure and properly configured, an Internet
worm can't get to your VoIP network (or even DoS it).

That's not much comfort for those accessing a Internet->PSTN VoIP
provider (rather than just an IP Centrix or IP PBX VoIP network), but
the risk there is no greater than online shopping/banking. (Assuming
you're using a secured VoIP protocol - and you're probably NOT)

[Michael H. Warfield]

--DBIVS5p969aUjpLe
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Feb 17, 2004 at 05:37:53PM +0200, Gadi Evron wrote:
> I apologize, but I am using these mailing lists to try and contact the=20
> different */CERT teams for different countries.

Then contact FIRST.

Forum of Incident Reaction Security Teams.

<http://www.first.org>

Many, if not most, CERTs are members.

> As we all know, ASN.1 is a new very easy to exploit vulnerability. It=20
> attacks both the server and the end user (IIS and IE).

> We expect a new massive worm to come out exploiting this vulnerability=20
> in the next few days.

This I seriously doubt. We have no indicators leading in that
direction.

> Why should this all interest you beyond it being the next blaster?

> ASN is what VOIP is based on, and thus the critical infrastructure for=20
> telephony which is based on VOIP.

No. ASN.1 (not ASN) may be used in VoIP, but it's not what it's
"based on". I won't rehash what other have refuted, here. If it's
possible, it's likely we'll see other indicators pointing in that
direction.

> This may be a false alarm, but you know how worms find their way into=20
> every network, private or public. It could (maybe) potentially bring the=
=20
> system down.

> I am raising the red flag, better safe than sorry.

Better to be informed than alarmist.

> The two email messages below are from Zak Dechovich and myself on this=20
> subject, to TH-Research (The Trojan Horses Research Mailing List). The=20
> original red flag as you can see below, was raised by Zak. Skip to his=20
> message if you like.

> Gadi Evron.

:

Mike
--=20
Michael H. Warfield | (770) 985-6132 | mhw@WittsEnd.com
/\/\|=3Dmhw=3D|\/\/ | (678) 463-0932 | http://www.wittsend.com/=
mhw/
NIC whois: MHW9 | An optimist believes we live in the best of all
PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!

--DBIVS5p969aUjpLe
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQCVAwUBQDLOEuHJS0bfHdRxAQFgbgQAs6QjY2rwneLCUvf1TA ClfXXVsJvXwQ0D
/mR19OLPN29FCUXCvnLymknWb5LHmyzfux0FF/RZ6y99/2PKTbvRNtiPiMU4q5cM
6kry61BzAj7q8lxC3QxgScfAJ7fEbUItv0dZ20RgX+iIJ1t3n7 HX31aUiujWuJNp
jP/7tqysw4c=
=IhiW
-----END PGP SIGNATURE-----

--DBIVS5p969aUjpLe--

[Florian Weimer]

3APA3A wrote:

> ASN.1 is used by many services, but all use different underlying
> protocols. It's not likely NetMeeting or MS ISA server to be primary
> attack targets. Attack against MS IPSec implementation, Exchange,
> SMB/CIFS, RPC services, IIS and specially IE will no have impact to VoIP
> infrastructure (except connectivity degradation because of massive
> traffic).

I wish your assessment were true, but it's not. Cisco Call Manager is
based on Windows, and Cisco still has to certify the patches Microsoft
released.

It's sad that Microsoft apparently hasn't used those six months to
properly coordinate the issue with OEM vendors.