Sjur Usken and Sandro Gauci have discovered a major flaw in the SIP implementations on a wide range of IP phones. The short explanation is that the phones do not verify where a proxy authentication request is coming from and happily return the SIP authentication information. It is hashed and salted, but the salt is chosen by the attacker, so a set of rainbow tables would make cracking it trivial. For full details, check out Sjur’s blog post (which spread fairly rapidly around the VoIP world) and his latest post showing the trace as he attacked a Cisco 7940 I set up for this purpose.

Until the phone vendors release fixed firmware (if they do) the only way to defend yourself from this is to not have phones exposed on public IP addresses. If they have to be for some reason (we all know SIP and NAT really don’t get along, and proper SIP aware NAT devices cost a fair bit) set firewall rules that prevent the phones from speaking SIP to any IPs that aren’t part of your VoIP system. Alternatively, in the event that every single phone on your system is statically addressed, the reverse could be done at the registrar side. It wouldn’t stop the attackers from finding the password, but it would prevent them from using it in any way.

The implications of an attacker gaining the SIP authentication information are of course severe, once they have that they can imitate the attacked phone and make calls to any number of regions potentially costing thousands of dollars in the course of a single night.

It’s been quite some time since I last posted…

Here’s a quick summary of what’s gone on in my life:

• The bastard Probe is still in the garage, status really unchanged since August.
• I got bored after doing an install in Columbus and wandered in to a used car dealer.  Somehow I drove home in a 2002 BMW 325i…
• Charlie and Mary both quit at MV (this was over the course of a few months, not at the same time), which threw me in to a situation I really did not want to be in.  I kinda paniced and nearly quit to do contract work.  Fortunately, when I went to discuss my 2 weeks the boss offered me a significant raise, and after sleeping on it I decided sticking with what I knew and continuing to ride out the bad towards the good (which seems to be getting closer) was the better plan.
• My parents moved to Virginia, making me the primary “support” for my brother when he’s in Toledo at school.

I might go in to detail on some of those later.  Anyways, what I came to post follows:

I’ve been getting in to a few blogs recently, and this one I just discovered today.  All I’ve read so far is interesting and well written, here’s a few favorites in no particular order…

http://www.violentacres.com/archives/319/just-say-no-to-bastard-children

http://www.violentacres.com/archives/59/two-phrases-that-destroyed-american-culture

http://www.violentacres.com/archives/48/four-rookie-mistakes-people-make-that-keep-them-poor

http://www.violentacres.com/archives/250/the-pentecostal-church-and-the-holy-ghost-want-you-to-wear-pig-panties

http://www.violentacres.com/archives/279/a-pedophile-lurking-behind-every-dark-corner

edited for linkification…stupid wordpress, what else does it think i might want when I post a URL?