PDA

Bekijk Volledige Versie : Re: Lingo VoIP ATA / UTStarcom iAN-02EX remote access vulnerability


Atom Smasher
08/03/05, 20:55
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Mon, 7 Mar 2005, Atom Smasher wrote:

> an attacker may change the default password (the ATA doesn't appear to
> have a customer accessible hardware reset, which could compound a
> password problem).
=========================

(responding to self)

the ATA can be reset by dialing *#26845# from a connected phone. this
presents another problem. an attacker can reset the password (and then
gain unauthorized access to the ATA) by gaining access to any phone
connected to the ATA. this can be easily accomplished at a party or by
wireless beige-boxing which could be done from some distance away.

of course this type of reset seems to wipe out most info that would be
useful to an attacker (LAN config, speed-dial list, etc) but still
facilitates DoS and other types of attack.

solution: a pinhole button in the back of the ATA would require physical
access to the device in order to reset the password.


- --
...atom

_________________________________________
PGP key - http://atom.smasher.org/pgp.txt
762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
-------------------------------------------------

"Our enemies are innovative and resourceful, and so
are we. They never stop thinking about new ways to
harm our country and our people, and neither do we"
-- George "dubya" Bush, 5 Aug 2004

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
Comment: What is this gibberish?
Comment: http://atom.smasher.org/links/#digital_signatures

iQEcBAEBCAAGBQJCLUPxAAoJEAx/d+cTpVci5cMIAL3OtgwgC9V5k7h9rOb4e1Qt
+yLNzPqml9ea/whzGeb/01KEWZ665WWYPALLf7SbkeNLr2Z3fMs8AlTjb5Uc5+v3
rnXH8vvYjb62uXHbMD8WAWj4HeVbzBMojeL1rwT/kE+fIwH25OQ/DnRRnrI0/5OS
1zBPhbzAMeej4FYyZtxxEJsySI1rWQSz8XA5FpZ3Dp/C7a4k4/gWLmcp3NJCsBFZ
YH64Oe4h1EvAK9S3d0CyJPFSwZKXRalIa0WlL6reJN4SZW/PeCs+L/8ydmr7XDN5
M6cHwQ/HhKnnHXreQn/8/N40X8oKx59/jZGfH1ypzJVKSp+NKAg4XBm7lsXfJP8=
=xE6p
-----END PGP SIGNATURE-----
Atom Smasher
11/03/05, 01:05
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

thinking out loud....

1) does the ATA connect to the server by resolving a hostname?

2) how do the ATA and server authenticate each other? is there any
authentication?

3) is traffic between the ATA and server encrypted? how is key-exchange
handled?

part of the ATA configuration allows one to select DNS servers. this is
normally done via DHCP, but may be entered manually. it may be possible
for an attacker to change the DNS servers (to point to compromised DNS
servers), become the "VoIP service provider" and intercept phone calls.
this is, of course, a version of the man in the middle attack. depending
on what (if any) authentication and/or encryption is done between the ATA
and the server this may well be practical in the real-world.

if anyone has access to one of these ATAs (or similar) and some time do to
any packet sniffing and traffic analysis i'm sure we'd all be curious what
you find...

references:
http://securityfocus.com/archive/1/392628/2005-03-06/2005-03-12/1


- --
...atom

_________________________________________
PGP key - http://atom.smasher.org/pgp.txt
762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
-------------------------------------------------

An Inuit hunter asked the local missionary priest: "If I
did not know about God and sin, would I go to hell?"
"No," said the priest, "not if you did not know."
"Then why," asked the Inuit earnestly, "did you tell me?"
-- Annie Dillard, Pilgrim at Tinker Creek

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
Comment: What is this gibberish?
Comment: http://atom.smasher.org/links/#digital_signatures

iQEcBAEBCAAGBQJCL04GAAoJEAx/d+cTpVcivvMH/2imMlEyp6lZS1NuQnJGcl5f
yO9HzfhlInkkGbiLV/zjdjZ2xiYwABG/01n1ZOEsyNeWvC+lG1ceS3K2utq7TRJj
gYujoox4YRq3fzUDQyFxlN8aHm5h+1urD2AXqxXJjEPd7bMaZO VoCI4Y5Kk45OB4
IOeXj2WcCa3vXLQ0a2LpuydhsaPK0fzut+XjmGolquVEMBwYru hsRS0ysEKD9+SE
snAB4T08bJScDMOoAYGgQ2nTmMKDeBdEdZPHxOgdaGtuRBoNWL tFl3KAyWNs2TLP
Mqo8DvoEF34gTd2apF8J2M6xKfgg4XS5gDRUZ9/SpuP+Dc69NdKraLyTZh2grVM=
=f03j
-----END PGP SIGNATURE-----
Ryan Cummings
11/03/05, 19:55
Lingo only uses UDP ports 5060-5065, 1020-1030, 10000-20000. You can
set your ATA device up behind a firewall/router just as long as your
forward these ports to it. This will take care of the remote access
and still allow your normal VoIP service to work. I'm away from home
right now but when I get back I'll take some time to analyze the
traffic it creates and report my findings.

Ryan


On Wed, 9 Mar 2005 14:26:57 -0500 (EST), Atom Smasher <atom@smasher.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> thinking out loud....
>
> 1) does the ATA connect to the server by resolving a hostname?
>
> 2) how do the ATA and server authenticate each other? is there any
> authentication?
>
> 3) is traffic between the ATA and server encrypted? how is key-exchange
> handled?
>
> part of the ATA configuration allows one to select DNS servers. this is
> normally done via DHCP, but may be entered manually. it may be possible
> for an attacker to change the DNS servers (to point to compromised DNS
> servers), become the "VoIP service provider" and intercept phone calls.
> this is, of course, a version of the man in the middle attack. depending
> on what (if any) authentication and/or encryption is done between the ATA
> and the server this may well be practical in the real-world.
>
> if anyone has access to one of these ATAs (or similar) and some time do to
> any packet sniffing and traffic analysis i'm sure we'd all be curious what
> you find...
>
> references:
> http://securityfocus.com/archive/1/392628/2005-03-06/2005-03-12/1
>
>
> - --
> ...atom
>
> _________________________________________
> PGP key - http://atom.smasher.org/pgp.txt
> 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
> -------------------------------------------------
>
> An Inuit hunter asked the local missionary priest: "If I
> did not know about God and sin, would I go to hell?"
> "No," said the priest, "not if you did not know."
> "Then why," asked the Inuit earnestly, "did you tell me?"
> -- Annie Dillard, Pilgrim at Tinker Creek
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (FreeBSD)
> Comment: What is this gibberish?
> Comment: http://atom.smasher.org/links/#digital_signatures
>
> iQEcBAEBCAAGBQJCL04GAAoJEAx/d+cTpVcivvMH/2imMlEyp6lZS1NuQnJGcl5f
> yO9HzfhlInkkGbiLV/zjdjZ2xiYwABG/01n1ZOEsyNeWvC+lG1ceS3K2utq7TRJj
> gYujoox4YRq3fzUDQyFxlN8aHm5h+1urD2AXqxXJjEPd7bMaZO VoCI4Y5Kk45OB4
> IOeXj2WcCa3vXLQ0a2LpuydhsaPK0fzut+XjmGolquVEMBwYru hsRS0ysEKD9+SE
> snAB4T08bJScDMOoAYGgQ2nTmMKDeBdEdZPHxOgdaGtuRBoNWL tFl3KAyWNs2TLP
> Mqo8DvoEF34gTd2apF8J2M6xKfgg4XS5gDRUZ9/SpuP+Dc69NdKraLyTZh2grVM=
> =f03j
> -----END PGP SIGNATURE-----
>
Atom Smasher
11/03/05, 20:15
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Thu, 10 Mar 2005, Ryan Cummings wrote:

> Lingo only uses UDP ports 5060-5065, 1020-1030, 10000-20000. You can
> set your ATA device up behind a firewall/router just as long as your
> forward these ports to it. This will take care of the remote access and
> still allow your normal VoIP service to work. I'm away from home right
> now but when I get back I'll take some time to analyze the traffic it
> creates and report my findings.
================

i've got mine running behind a firewall/router without opening any ports
to it. i plugged it in, waited a few minutes for the lights to turn green,
and started talking. the "Alternate Method" of installation confirms that
this is supported - http://lingosupport.com/install_multi_02.html


- --
...atom

_________________________________________
PGP key - http://atom.smasher.org/pgp.txt
762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
-------------------------------------------------

"If Jesus Christ were to come today, people would not
even crucify him. They would ask him to dinner, and
hear what he had to say, and make fun of it."
-- Thomas Carlyle

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
Comment: What is this gibberish?
Comment: http://atom.smasher.org/links/#digital_signatures

iQEcBAEBCAAGBQJCMRoPAAoJEAx/d+cTpVci4iUIALi83J7N7uIe0xHLdXbL3Kjr
s64lBI6O5pEUaXyqTI5oSqJq4pWM2lHtq72hB71/8XennHKx1I5bSSv13LVpvhGd
02BbWMgT3guKqFJ0POXSH4vL5VXOx69jJeSdc3QRBCeuGa1tBz LzGc53h7/MNGIl
IaP7y7BbGxhIvMf89EOn/Pvva2ZMl/6Jvm2qNUkOygM9jkl6Z7SL+XgGKEKVevXV
0o3TpVBvtgvRGw7YopbRFGF+aU9zIDe0qDKEBOVIMJQHC7dm7/Gj7FkSJDeHYTIv
y2upqLln/p79ORhgM1/VRo7GW5vebnzWLmpv6Gs28y1aOmY3fhZvsIFatDPnzqE=
=qj5E
-----END PGP SIGNATURE-----