VoIP Security* Professor Patrick McDaniel CSE545 - Advanced Network - - PowerPoint PPT Presentation

▶
voip security
SMART_READER_LITE
LIVE PREVIEW

VoIP Security* Professor Patrick McDaniel CSE545 - Advanced Network - - PowerPoint PPT Presentation

Sep 08, 2023 581 likes •944 views

VoIP Security* Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011 *Thanks to Prof. Angelos Keromytis for materials for these lecture slides. CSE545 - Advanced Network Security - Professor McDaniel Page 1 Example of

slide-1
SLIDE 1

CSE545 - Advanced Network Security - Professor McDaniel Page

VoIP Security*

Professor Patrick McDaniel CSE545 - Advanced Network Security Spring 2011

1

*Thanks to Prof. Angelos Keromytis for materials for these lecture slides.

slide-2
SLIDE 2

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Example of toll fraud attack

  • Break into company PBX
  • use them to route calls of your customers
  • this has actually happened

http://www.theregister.co.uk/2006/06/08/voip_fraudsters_nabbed/ http://www.theregister.co.uk/2009/02/11/fugitive_voip_hacker_arrested/

“Federal authorities yesterday arrested a Miami man who they said made more than $1 million in a

hacking scheme involving the resale of Internet telephone service.” “In all, more than 15 Internet phone companies, including the one in Newark, were left having to pay as much as $300,000 each in connection fees for routing the phone traffic to other carriers without receiving any revenue for the calls, prosecutors said.”

2

slide-3
SLIDE 3

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 3

What is VoIP/IMS?

  • Protocol(s) for voice communication over IP-based

infrastructures

  • use of the Internet itself is dependent on operator
  • Voice over IP: catch-all term for numerous kinds of media
  • Generally applied to voice and conference oriented products and

services, e.g., Skype

  • IP Multimedia Subsystem: industry standard for IP-based

multimedia communications

  • Video,
  • Calendaring/scheduling
  • File-sharing
  • Collaborative editing, ...

2

slide-4
SLIDE 4

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VoIP in the marketplace

  • Basis for many products/services
  • commercial:

Vonage, 3, T

  • Mobile/UMA, T
  • Mobile@Home, ...
  • free/semi-free: Skype, GTalk, MSN,

Yahoo! IM, AIM, Gizmo, ...

  • Both enterprise- and consumer-oriented
  • management simplification
  • cost reduction
  • Various architectural models
  • centralized vs. P2P
  • open vs. closed

4

slide-5
SLIDE 5

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Useful Terms

  • codec - coder/decoder
  • Program (not format) used to process media-specific data
  • SDP - session description protocol
  • Standard for describing media session parameters

5

slide-6
SLIDE 6

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VoIP Protocols

  • Signaling
  • Responsible for call setup and

management

  • Architectural and operational

components

  • Principal/endpoint naming, IP

mapping, proxying, billing, access control, device configuration/management, customer support, QoS

  • Data transport
  • Codecs, transport protocols

(typically RTP), QoS, content security signaling

6

  • Dominant mechanisms
  • Session Initiation Protocol (SIP)
  • Unlicensed Mobile Access (UMA)
  • Others: Skype, Asterisk, GTalk/

AIM ...

  • Useful terms
  • codec - “coder/decoder” program

(not format) used to process media-specific data

  • SDP - session description protocol is

a standard for describing media session parameters

slide-7
SLIDE 7

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Session Initiation Protocol (SIP)

  • IETF Standardized signaling for IMS (among others)
  • Similar to HTTP
  • Text-based
  • Request/response structure
  • Stateful - highly complex state machine
  • TCP or UDP (port 5060)
  • Devices
  • End-points (soft phones or hardware devices)
  • Proxy servers (local services acting on behalf of phone)
  • Registrars (local point to register with network)
  • Redirect servers (redirects calls)
  • Location server (VoIP HLR)

7

slide-8
SLIDE 8

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

SIP Flow

8

slide-9
SLIDE 9

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

SIP/RTP Call progress

  • 1. Locate endpoint* [SIP]
  • 2. Establish call [SIP]
  • 3. Data Transfer [RTP]
  • 4. Hangup [SIP]

9

*not shown

slide-10
SLIDE 10

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Call forwarding

10

slide-11
SLIDE 11

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

SIP Call Flow

11

slide-12
SLIDE 12

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Real-time Transport Protocol (RTP)

  • RTP is a pair of protocols designed to support

applications with latency and jitter constraints

  • Supports the tightly controlled delivery of stream data,
  • E.g., require some hard or soft QoS (quality of service)
  • Protocols using ephemeral ports (1025-65535)
  • RTCP (Real-Time Control Protocol) provides signaling between

peers that measures and adjusts session to compensate for changing conditions

  • RTP - the data channel that delivers the data
  • SDP sometimes used to describe the session

requirements, as negotiated through SIP

  • Standards support a range of codecs, e.g., RFC 3016 ..,

12

slide-13
SLIDE 13

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 13

In reality...

  • Much “hidden” shared infrastructure
  • DNS, web, NAT, TFTP

, DHCP/PPPoE, Int/DiffServ, firewalls,...

  • Emergent properties
  • example: web-based UI poisoning through SIP-field manipulation
  • Live aspect makes problems harder
  • e.g., how can we filter voice spam based on content?

2

slide-14
SLIDE 14

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

SIP Security

  • Largely the ad hoc application of existing general-purpose

security mechanisms

  • Authentication uses HTTP-style digest authentication
  • TLS - when TCP is used
  • S/MIME - used to encode/secure payloads
  • IPsec - can be used to secure any protocols run over IP
  • Secure Real-time Transport Protocol (SRTP) - crypto extensions

to protect real-time sessions, e.g., encrypt the voice channel

  • Implication: security largely pushed on infrastructure

14

slide-15
SLIDE 15

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 15

SIP authentication

2

slide-16
SLIDE 16

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 16

Unlicensed Mobile Access (UMA)

  • Route GSM calls over the Internet (or a public network)
  • (usually) transparent handover between GSM and UMA
  • Popular with cellphone providers
  • T
  • Mobile USA, Orange France, ...
  • Benefits
  • reduce need to install expensive cell towers / upgrade capacity
  • reduce spectrum needs / utilization
  • improve “reception” in difficult locations
  • depending on billing, avoid roaming charges (think

international!)

  • Not to be confused with pico-/micro-/femto-cells

2

slide-17
SLIDE 17

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 17

UMA deployment

2

Source: http://www.umatechnology.org/

slide-18
SLIDE 18

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 18

UMA details

  • Encapsulation of GSM/3G inside IP
  • complete frame, minus the on-the-air crypto
  • can transfer voice, IM and (in the future) video
  • Typically, devices are WiFi-supporting cellphones
  • not strictly necessary, e.g., T
  • Mobile@Home in USA
  • GSM frames are not natively protected
  • A5/2 is anyway weak (i.e., broken)

2

slide-19
SLIDE 19

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

UMA Security

  • Handset-to-provider IPsec
  • Strong crypto and integrity protection
  • Key management (IKE, IKEv2) is a different story altogether
  • Authentication done via EAP-SIM (based on shared secret)
  • The key management protocol (IKE/IKEv2) is complex
  • Perhaps “too big” to be trusted
  • More importantly, easy to misconfigure
  • not as big a problem in a tightly managed environments (cellphones)
  • but, UMA+smartphones spells trouble
  • Provider must interface internal network with Internet
  • higher risk of compromise by external attackers
  • large numbers of potentially malicious insiders

19

slide-20
SLIDE 20

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Threat in VoIP systems

  • Everyone thinks of the traditional C/I/A threats
  • Loss of communication confidentiality and privacy (C)
  • traffic analysis, content privacy
  • Loss of communication integrity (I)
  • impersonation (inbound, outgoing calls), modification of content,

falsification of call records

  • Loss of communication availability (A)
  • accidental or intentional denial of service (DoS)

20

slide-21
SLIDE 21

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Unique VoIP characteristics

  • Elaborate billing infrastructure in place
  • Users are used to paying for telephony services
  • Most charges are for relatively small amounts
  • Large number of charges per billing cycle
  • unlikely that small unauthorized charge will be noticed or

challenged

  • Phone infrastructure is “trusted” by average user
  • perception carried over from PSTN
  • not grounded on facts or experience

21

slide-22
SLIDE 22

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VoIP-Specific Threats and Risks

  • Theft of service, e.g., toll fraud, billing fraud
  • Social engineering, e.g., phishing/spear-phishing
  • Direct charge-back, e.g., immediate monetization
  • Risks
  • Some in common with other types of systems (software

vulnerabilities)

  • Some are very specific to IMS (protocol vulnerabilities)
  • Some are common, but are amplified by some IMS feature,

e.g., large-scale phishing through impersonation or call hijacking

  • Q: are these substantially different than in cell networks?

22

slide-23
SLIDE 23

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 23

VoIP/IMS risk vectors

  • Variety of risk vectors
  • some in common with other types of systems
  • software vulnerabilities
  • some are very specific to IMS
  • protocol vulnerabilities
  • some are common, but are amplified by some IMS feature
  • large-scale phishing through impersonation or call hijacking

2

slide-24
SLIDE 24

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VoIP Security Alliance

24

6

Interruption of services

5

Physical access

4

Service abuse

3

Denial of Service

2

Eavesdropping, interception, modification

ID misrepresentation SPIT/SPAM

1

Social threats

VoIPSA Threat Taxonomy

slide-25
SLIDE 25

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 25

VoIP vis. risks

  • Confidentiality
  • in some protocols, attackers can easily eavesdrop
  • variety of available attack tools, e.g.,

VoMIT

  • particularly a problem with SIP/RTP
  • S-RTP defined, but largely unused
  • key management problem still unsolved (where’s my PKI?)
  • Integrity
  • software vulnerabilities
  • for example, as vulnerable to buffer overflows as any other piece of

software

  • silver lining: even simple devices are generally designed for

updateability

  • mixed blessing, update mechanism can be hijacked (usually based on TFTP!)

2

slide-26
SLIDE 26

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

VoIP vis. risks

  • Availability
  • susceptibility of equipment to denial of service
  • general network-borne DoS attacks, powerline, ...
  • how do you call someone to fix your problem?!

26

slide-27
SLIDE 27

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 27

IMS-specific problems

  • Architectural and protocol vulnerabilities
  • SIP device interactions (see following slides)
  • silent “snooping” via multipresence
  • fraud
  • bill bypassing
  • hijacking of someone else’s account/PBX
  • protocol-specific denial of service attacks
  • malformed messages
  • call routing games
  • separation between signaling/data transport can be leveraged
  • induce someone’s phone device to act as a DoS zombie

2

slide-28
SLIDE 28

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Trivial protocol-specific

  • Single packet “phone kill”

28

slide-29
SLIDE 29

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 29

Privacy attack

  • Call someone, then report “call in progress” before ring
  • turns phone into eavesdropping device!

2

slide-30
SLIDE 30

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Billing avoidance and XSS

  • SQL injection that targets

the PBX’s billing records

  • SQL-enabled XSS attack

that targets administrator or user viewing call logs with browser!

30

slide-31
SLIDE 31

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Reminder: call forwarding

31

slide-32
SLIDE 32

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Protocol games: toll fraud

32

draft-state-sip-relay-attack

(Attacker on hold) Attacker OK ACK Media (RTP) INVITE Attacker 407 Authentication needed ACK 407 Authentication needed ACK INVITE Attacker (auth) INVITE +1900PREMIUM (auth) INVITE +1900PREMIUM Media (RTP) (reverse rewrite, relay authentication request) (call setup) (rewrite INVITE from Alice) (rewrite INVITE from Alice) PSTN call SIP proxy/PSTN bridge Domain D1 Alice@D1 INVITE Alice@D1 +1900PREMIUM

slide-33
SLIDE 33

Systems and Internet Infrastructure Security Laboratory (SIIS) Page 33

Hybrid threats

  • Generic threats made easy/enabled by IMS architecture
  • more realistic phishing/spear-phishing
  • common attack: call by “bank officer” asking for personal

information

  • remember: CallerID easy (trivial) to spoof
  • (somewhat) more complicated attack: compromise SIP signaling to

catch the “callback” from customer to the bank!

  • compromise of company SIP-PBX or end-device
  • router- and routing-based attacks
  • DNS poisoning
  • SPIT - SPAM for voice
  • Configuration problems
  • many options, many devices: easy to misconfigure

2

slide-34
SLIDE 34

Systems and Internet Infrastructure Security Laboratory (SIIS) Page

Wrapup

  • The ubiquity and quality of IP-based networks is going to

lead to increasing growth of VoIP/IMS services

  • However, like much of the systems themselves, security

has been patched together from a loose collection of

  • ther general purpose mechanisms
  • This is likely to lead to more opportunities for adversaries to

exploit security failures and vulnerabilities

  • Standards process like the IETF may help, but it is unclear if the

market will embrace any new broad techniques

  • Bottom line: this is not likely to get better soon.

34