E.T. Cant Phone Home Security Issues with VoIP
Ofir ArkinManaging Security Architect
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
AgendaVoIP OverviewThe VoIP Threat ModuleThe Session Initiation
ProtocolThe Session Initiation Protocol Threat ModuleThe RTP
ProtocolThe RTP Threat Module
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
OverviewIP Telephony, VoIP and VON
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
OverviewIP Telephony is defined as the use of IP networks to
transmit both voice and data packetsVON (or Internet Telephony) is
used to describe the usage of the Internet to transmit both voice
and data packetsVoIP is used to describe the usage of managed IP
networks to transmit both voice and data packets (usually
associated with Carrier-Class networks)In the course of History VON
was the predecessor of VoIP, and its success led to the interest
and development of IP Telephony and VoIPDo you remember VocalTECs
Internet Phone?
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
OverviewThe IETF has defined many standard track IP Telephony
protocolsMany IP Telephony protocols are still under a development
/ draft stage at the IETFThe IP Telephony protocols defined by the
IETF can be used with different IP Telephony architectures:Internet
Telephony Internet Telephony Service Providers (ITSPs)Corporate
LANsConverged Network Architecture
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
OverviewThe protocols combining any IP Telephony architecture
are divided into the following roles:Signaling ProtocolsMedia
Transport ProtocolsSupporting Protocols
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview Signaling ProtocolsThe VoIP Signaling Protocols perform
the following services:Locate a User The ability to locate another
user which whom a user wish to communicate withSession
Establishment The ability of the called party to accept a call,
reject a call, or redirect the call to another location or
serviceSession Setup Negotiation The ability of the communicating
parties to negotiate the set of parameters to use during the
session, this includes, but not limited to, Audio encodingModify a
Session The ability to change a sessions parameters such as using a
different Audio encoding, adding/removing a session participant,
etc.Teardown a Sessions The ability to end a session
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview Media Transport ProtocolsThe Media Transport Protocols
are used to carry voice samples (such as the Real Time Transport
Protocol RTP) The media transport protocols are able to use a codec
to digitize voice and to compress it into small samples that will
be encapsulated within an IP transport protocol (usually UDP) and
transported using an IP network
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview Supporting ProtocolsThese are the protocols which
supports the various IP Telephony architectures:For example:Quality
of Service (QoS) protocols (DiffServ, IntServ, RSVP, MPLS,
802.1q)DNS (with or without extensions)Routing TRIP (Telephony
Routing over IP)Etc.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
OverviewIETFs VoIP ArchitectureThe IETFs VoIP architecture is
based on a number of protocols, each of which is only a small part
of the complete solutionTherefore the IETFs VoIP architecture is a
very flexible oneA Telephony Architecture which connects the PSTN
with VoIPbased Network(s) has to have elements which will translate
signaling and voice samples between the PSTN and the VoIP IP
Network and vice versa. Therefore some gateways are introduced with
the infrastructure
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview VoIP Signaling Protocols, Definitions IETFs VoIP
ArchitectureMedia Gateway (MG) A network element which converts
audio signals carried on telephone circuits into data packets
carried in packet switched networks, and vice versaMedia Gateway
Controller (MGC) Used to control a Media GatewaySignaling Gateway
(SG) A network element which converts SS7 signaling information
from the PSTN into formats understood by the network elements in
the IP network, and presents an accurate view of the elements of
the IP network to the SS7 network (and vice versa)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview VoIP Signaling ProtocolsIETFs VoIP ArchitectureThe VoIP
signaling protocols with the IETFs VoIP Architecture can be divided
into the following categories:Protocols used between the Media
Gateway and the Media Gateways Controllers (such as MGCP and the
Megaco protocols), known as Gateway Control Protocols
(GCP)Protocols used between the Media Gateway and the Signaling
Gateway (such as SCTP, M2UA, M3UA)Protocols used between Media
Gateway Controllers (MGCs) to initiate a session between users
(such as SIP)Protocols used within the IP Network (SIP)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The IETFs VoIP Architecture
IP Network
MG
MG
PSTN
PSTN
MGC
MGC
SIP
SIP
SIP
SG
SG
SS7
SS7
TCAP, ISUP
TCAP, ISUP
RTP
RTP
M3UA, M2UA/SCTP
M3UA, M2UA/SCTP
Megaco/H.248
Megaco/H.248
ISUP, Q.931
ISUP, Q.931
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Internet Telephony Architecture Using SIP
SIP
Network A
Network B
SIP UA
SIP UA
SIP
SIP
SIP
SIP
SIP
SIP Proxy
SIP Proxy
The Internet
RTP
RTP
RTP
RTP
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview Security ...It is no longer necessary to have a
separate network for voice...
With VoIP the Internet Protocol (IP) is the vessel for voice
transmission, therefore we inherit the security problems associated
with the IP protocolThe security issues are more complex because of
the nature of speech (voice quality), and other conditions VoIP
needs to meet in order to fulfill its promise as the next
generation in TelecommunicationOther security issues arise from the
VoIP protocols themselves and from the different architectures in
which IP Telephony can be deployed
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Mr. Zerga and the IP PhoneOceans Eleven (The Coca-Cola vs. Pepsi
wars of the 80s is back with VoIP Phones?)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat Module
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleOverview [1]The VoIP (and IP Telephony)
threat module is combined from different number of issues:The Usage
of IP: The IP protocols security weaknesses are inherited
(sniffing, spoofing, reply attacks and all the rest of the
family)There is no separation of networks: The signaling and media
share the same network (they are not separated as with the PSTN).
It lowers the bar regarding potentially misuse of IP TelephonyThe
nature of speech: Issues such as Delay, Latency, Jitter, Packet
Loss, Speech Coding Techniques, Network Availability, Managing
Access & Priority, etc. There is a burden on maintaining
adequate speech quality
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleOverview [2]ContinuedThe VoIP Protocols
themselvesSupporting Protocols (DNS)VoIP Infrastructure (Phones,
Servers, Special Servers)Supporting Infrastructure (Switches,
Routers)Different IP Telephony Architectures (leads to different
security risks)Physical Securityand Supporting Technologies
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based ProtocolsWe wish to
maintain:IntegrityConfidentialityAuthenticationNonRepudiation We
face issues like:Call TrackingCall HijackingEavesdropping Active
modificationsDenial of Service
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based Protocols (& Architecture)The placement of the
intelligenceWith the PSTN today the signaling intelligence is with
the SwitchesThe phones are just dumb devicesIn the future
everything we know today will be changed (we see the signs today
with the VoIP technology)With some of the VoIP signaling protocols
(like SIP) the intelligence is placed at the edges the IP phones
themselvesThis opens up a wider window opportunity for problems
initiated by an end userAs we know, not all clients are born equal
a.k.a. some will be malicious
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based Protocols Authentication An IBM Executive Quote from
the early days of the PCs: Our goal is to make the computer as easy
to use as the telephone Authenticationof what exactly? Importance
of Device authentication vs. the failure of user authentication Or
Who the hack wants to authenticate each time he needs to use the IP
phone?Especially not good if you wish to call 911 servicesWhen you
have a heart attack you do not wish to authenticate to call the
Ambulance servicesRe-Authentication at predetermined intervals
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based InfrastructureThe devicesPhones (usually are not that
powerful devices)Servers (SIP Proxy, SIP Registrar, SIP Redirect,
Gatekeepers, Media GWs, Media GW Controllers, Signaling GWs,
etc)Gaining Unauthorized AccessRemote Access (not on the same local
LAN)Management interfacesAbusing Authentication issuesManipulation
of settingsPerform Call tracking Etc.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based InfrastructurePhysical AccessTo the PhoneHard resets
(using a button) Soft resets (using the phones software)Device
configuration and manipulation of settingsCall trackingUploading
firmware, adding changing functionality and/or adding a permanent
backdooretc.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based InfrastructurePhysical Access (continued) To the
Network (more later)Free Phone CallsEavesdroppingBypassing
FilteringBypassing QoS restrictionsEtc.To other VoIP-based devices
(you get the picture)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based InfrastructureAvailabilityShared infrastructure is
bad!Do you really wish to put the tag of critical infrastructure on
a shared infrastructure?Knock the Switches Off (from the regular
data network) and you knocked the Voice network as wellDo you trust
VLANs?No Electricity No ServiceNo ability to call emergency
services (Violates E911 regulations) G, here goes our Carrier Grade
availabilityConnectivity to different offices in a corporate
scenario
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
VoIP-based InfrastructureAvailabilityCosts of redundancy, and
UPSs for every switch and router at the last mile (for a carrier)
or in a corporate Denial of Service Even more easy with VoIP, since
you really do not need to be that smart and use too much traffic,
but still you can cause outage in the whole network, a
neighborhood, or a building, or on a single end-user (depends on
your point of presence in the network) a corporate, etc.Last Mile
Availability problems (in a carrier-grade network)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModulePhysical SecurityWho said Physical
Security?The Last Mile is our main concern:Access to the Physical
Wire (and to equipment) If achieved all is downhill from there
(this holds true for any architecture using VoIP as well)Equipment
is likely to be stolen Routers and switches are nice decorations
for a roomPhysical Tempering Cut the cord Luke
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModulePhysical SecurityBypassing simple packet
shaping mechanismsGetting into the VoIP VLAN An end-of-game
Alices PC
Alice's IP Phone
Voice
Data
Alice's IP Phone
Voice
Data
Mikasa Sukasa
Packet Shaping for QoS (DiffServ)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModulePhysical SecurityEavesdropping can be
achieved easily if there is access to the wire, with no specialized
equipment other than a hub, a knife, and a clipper. Between the IP
Phone (or Customer Premises Gateway) and the SwitchBetween two
switchesWith both scenarios we bypassed any QoS mechanism used.
100BaseT Switch
100BaseT Switch
100BaseT
100BaseT
100BaseT
100BaseT
100BaseT
100BaseT
100BaseT Hub
100BaseT Switch
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModulePhysical Security Free Phone CallsAn
Advantage Over Phreaking of this sort because the eavesdropper can
also have free calls without the knowledge of the subscriber For
example, using a different Call-ID to differentiate between calls
destined to the phreaker to the calls destined to the owner of the
line
Alice's IP Phone
Voice
Data
Mikasa Sukasa
I am representing the physical address of the IP Phone
I am representing the physical address of the Switch
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleAccess TechnologiesThe Security issues are
not limited to traditional technologies onlyVarious Access
Technologies with a Converged Network Architecture are susceptible
to attacksOne notable example is Broadband Wireless Access Networks
using LMDS (Local Multipoint Distribution Service). When encryption
is used between the Base Station to a residential transceiver
cripples the connection so badly some manufactures of LMDS
equipment admit it is uselessAll you need to have is the right
equipment
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleAccess Technologies
Base Station
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleExampleCisco Call Manager Servers where
affected by the Nimda worm since they where install on a Windows
2000 Servers with IIS5 (default install)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The VoIP Threat ModuleExample@stake advisory Multiple
Vulnerabilities with Pingtel xpressa SIP Phones (July 12th, 2002),
http://www.atstake.com/research/advisories/2002/a071202.txt Pingtel
xpressa SIP VoIP phones model PX-1The Pingtel xpressa SIP-based
phone contains multiple vulnerabilities affecting all aspects of
the phones operation. These vulnerabilities include: remote access
to the phone; remote administrative access to the phone;
manipulation of SIP signaling; multiple denials of service; remote
telnet access (complete control of the VxWorks operating system);
local physical administrative access, and more. Using the
vulnerabilities enumerated within this advisory it is possible to
jeopardize critical telephony infrastructure based on Pingtels
xpressa SIP phones. Additionally, certain vulnerabilities present a
severe risk to an organizations entire network infrastructure.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Other RantsRegulations It is the IETF policy not to worry about
the hooks for wiretapping, but without this ability no service
provider will be able to deploy VoIP (at least in the USA, UK and
other countries)Fraud and more
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The Session Initiation Protocol
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP HistorySIP was developed within the mmusic working group in
the IETFThe work on SIP began in 1995Proposed Standard RFC 2543 in
February 1999Authors Handley (ACIRI), Schulzrinne (Columbia
University), Schooler (Cal Tech), & Rosenberg (Bell Labs)SIP is
part of the Internet Multimedia Conferencing SuiteNew SIP RFC 3261,
July 2002Authors Rosenberg (dynamicsoft), Schulzrinne (Columbia
University), Camarillo (Ericsson), Johnston (Worldcom), Peterson
(Neustar) , Sparks (dynamicsoft), Handley (ACIRI), Schooler
(AT&T)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
What is the Session Initiation Protocol?SIP is an
application-layer control protocol that can establish, modify, and
terminate multimedia sessions (conferences) such as Internet
telephony calls. SIP can also invite participants to already
existing sessions, such as multicast conferences. Media can be
added to (and removed from) an existing session. SIP transparently
supports name mapping and redirection services, which supports
personal mobility users can maintain a single externally visible
identifier regardless of their network location.
Text in this section was taken from RFC 3261
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
What is the Session Initiation Protocol?SIP supports five facets
of establishing and terminating multimedia communications:User
location: determination of the end system to be used for
communication; User availability: determination of the willingness
of the called party to engage in communications; User capabilities:
determination of the media and media parameters to be used; Session
setup: ringing, establishment of session parameters at both called
and calling party; Session management: including transfer and
termination of sessions, modifying session parameters, and invoking
services.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationThe example shows the basic functions of
SIP: location of an end point, signal of a desire to communicate,
negotiation of session parameters to establish the session, and
teardown of the session once established.This is a typical example
of a SIP message exchange between two users, Alice and Bob. In this
example, Alice uses a SIP application on her PC (referred to as a
softphone) to call Bob on his SIP phone over the Internet. Also
shown are two SIP proxy servers that act on behalf of Alice and Bob
to facilitate the session establishment. This typical arrangement
is often referred to as the SIP trapezoid as shown by the geometric
shape of the dashed lines
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationAlice calls Bob using his SIP identity, a
type of Uniform Resource Identifier (URI) called a SIP URI. It has
a similar form to an email address, typically containing a username
and a host name. In this case, it is sip:[email protected], where
biloxi.com is the domain of Bobs SIP service provider (which can be
an enterprise, retail provider, etc). Alice also has a SIP URI of
sip:[email protected]. Alice might have typed in Bobs URI or
perhaps clicked on a hyperlink or an entry in an address bookSIP is
based on an HTTP-like request/response transaction model. Each
transaction consists of a request that invokes a particular method,
or function, on the server and at least one response
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationIn this example, the transaction begins
with Alices softphone sending an INVITE request addressed to Bobs
SIP URI. INVITE is an example of a SIP method that specifies the
action that the requestor (Alice) wants the server (Bob) to take.
The INVITE request contains a number of header fields. Header
fields are named attributes that provide additional information
about a message. The ones present in an INVITE include a unique
identifier for the call, the destination address, Alices address,
and information about the type of session that Alice wishes to
establish with Bob.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation INVITE INVITE sip:[email protected]
SIP/2.0Via: SIP/2.0/UDP pc33.atlanta.com;branch=z9hG4bK776asdhds
Max-Forwards: 70 To: Bob From: Alice ;tag=1928301774 Call-ID:
[email protected] CSeq: 314159 INVITEContact:
Content-Type: application/sdp Content-Length: 142
(Alices SDP not shown)
The Method nameThe address which Alice is expecting to receive
responses. This parameter indicates the path the return message
needs to takeA display name and a SIP or SIPS URI towards which the
request was originally directedContains a globally unique
identifier for this callContains an integer (traditional sequence
number) and a method nameContains a SIP or SIPS URI that represents
a direct route to Alice
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationThe details of the session, type of media,
codec, sampling rate, etc. are not described using SIP. Rather, the
body of a SIP message contains a description of the session,
encoded in some other protocol format. One such format is the
Session Description Protocol (SDP) (RFC 2327). This SDP message
(not shown in the example) is carried by the SIP message in a way
that is analogous to a document attachment being carried by an
email message, or a web page being carried in an HTTP message
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationF1: Since the softphone does not know the
location of Bob or the SIP server in the biloxi.com domain, the
softphone sends the INVITE to the SIP server that serves Alices
domain,atlanta.comF3: the proxy server receives the INVITE request
and sends a 100 (Trying) response back to Alices softphone. The 100
(Trying) response indicates that the INVITE has been received and
that the proxy is working on her behalf to route the INVITE to the
destination. This response contains the same To, From, Call-ID,CSeq
and branch parameter in the Via as the INVITE, which allows Alices
softphone to correlate this response to the sent INVITE. F2: The
atlanta.com proxy server locates the proxy server at biloxi.com,
possibly by performing a particular type of DNS (Domain Name
Service) lookup to find the SIP server that serves the biloxi.com
domain. As a result, it obtains theIP address of the biloxi.com
proxy server and forwards, or proxies, the INVITE request there.
Before forwarding the request, the atlanta.com proxy server adds an
additional Via header field value that contains its own address
(the INVITE already contains Alices address in the first Via). F5:
The biloxi.com proxy serverreceives the INVITE and responds with a
100 (Trying) response back to the atlanta.com proxy server to
indicate that it has received the INVITE and is processing the
request.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationF4: The proxy server consults a
database,generically called a location service, that contains the
current IP address of Bob. The biloxi.com proxy server adds another
Via header field value with its own address to the INVITE and
proxies it to Bobs SIP phone.F6: Bobs SIP phone receives the INVITE
and alerts Bob ringing. Bobs SIP phone indicates this in a 180
(Ringing) response, which is routed back through the two proxies in
the reverse direction. Each proxy usesthe Via header field to
determine where to send the response and removes its own address
from the top.
As a result, although DNS and location service lookups were
required to route the initial INVITE, the 180 (Ringing) response
can be returned to the caller without lookups or without state
being maintained in the proxies.
This also has the desirable property that each proxy that sees
the INVITE will also see all responses to the INVITE.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationF9: Bob decides to answer the call. When he
picks up the handset, his SIP phone sends a200 (OK) response to
indicate that the call has been answered.
The 200 (OK) contains a message body with the SDP media
description of the type of session that Bob is willing to establish
with Alice.
As a result, there is a two-phase exchange of SDP messages:
Alice sent one to Bob, and Bob sent one back to Alice. This
two-phase exchange provides basic negotiation capabilities and is
based on a simple offer/answer model of SDP exchange. If Bob did
not wish to answer the call or was busy on another call, an error
response would have been sent instead of the 200 (OK), which would
have resulted in no media session being established.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationSIP/2.0 200 OK
Via: SIP/2.0/UDP server10.biloxi.com;branch=z9hG4bKnashds8
;received=192.0.2.3
Via: SIP/2.0/UDP
bigbox3.site3.atlanta.com;branch=z9hG4bK77ef4c2312983.1
;received=192.0.2.2
Via: SIP/2.0/UDP pc33.atlanta.com;branch=z9hG4bK776asdhds
;received=192.0.2.1 To: Bob ;tag=a6c85cf 465From: Alice
;tag=1928301774 466Call-ID: a84b4c76e66710 CSeq: 314159 INVITE
Contact: Content-Type: application/sdpContent-Length: 131 471(Bobs
SDP not shown) The first line of the response contains the response
code (200) and the reason phrase (OK)Added by Alices softphoneAdded
by atlanta.com SIP ProxyAdded by biloxy.com SIP ProxyContains a URI
at which Bob can be directly reached at his SIP phone. What method
this 200 OK is sent for?
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationIn addition to DNS and location service
lookups shown in this example, proxy servers can make
flexiblerouting decisions to decide where to send a request. For
example, if Bobs SIP phone returned a 486 (Busy Here) response, the
biloxi.com proxy server could proxy the INVITE to Bobs voicemail
server. A proxy server can also send an INVITE to a number of
locations at the same time. This type of parallel search is known
as forking. Finally, Alices softphone sends an acknowledgement
message, ACK to Bobs SIP phone to confirm the reception of the
final response (200 (OK)). In this example, the ACK is sent
directly from Alices softphone to Bobs SIP phone, bypassing the two
proxies. This occurs because the endpoints have learned each others
address from the Contact header fields through the INVITE/200 (OK)
exchange, which was not known when the initial INVITE was sent. The
lookups performed by the two proxies are no longer needed, so the
proxies drop out of the call flow. This completes the
INVITE/200/ACK three-way handshake used to establish SIP
sessions.In this case, the 200 (OK) is routed back through the two
proxies and is received by Alices softphone, which then stops the
ringback tone and indicates that the call has been answered.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationAlice and Bobs media session has now begun,
and they send media packets using the format to which they agreed
in the exchange of SDP. In general, the end-to-end media packets
take a different path from the SIP signaling messagesDuring the
session, either Alice or Bob may decide to change the
characteristics of the media session. This is accomplished by
sending a re-INVITE containing a new media description. A re-INVITE
references the existing dialog so that the other party knows that
it is to modify an existing session instead of establishing a new
session. The other party sends a 200 (OK) to accept the change. The
requestor responds to the 200 (OK) with an ACK. If the other party
does not accept the change, he sends an error response such as 406
(Not Acceptable), which also receives an ACK. However, the failure
of the re-INVITE does not cause the existing call to fail the
session continues using the previously negotiated
characteristics
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of OperationF13/F14: At the end of the call, Bob
disconnects (hangs up) first and generates a BYE message. This BYE
is routed directly to Alices softphone, again bypassing the
proxies. Alice confirms receipt of the BYE with a 200 (OK)
response, which terminates the session and the BYE transaction. No
ACK is sent an ACK is only sent in response to a response to an
INVITE request.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F13
200 OK F14
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation Forced Routing In some cases, it may be
useful for proxies in the SIP signaling path to see all the
messaging between the endpoints for the duration of the session.
For example, if the biloxi.com proxy server wished to remain in the
SIP messaging path beyond the initial INVITE, it would add to the
INVITE a required routing header field known as Record-Route that
contained a URI resolving to the hostname or IP address of the
proxy. This information would be received by both Bobs SIP phone
and (due to the Record-Route header field being passed back in the
200 (OK)) Alices softphone and stored for the duration of the
dialog. The biloxi.com proxy server would then receive and proxy
the ACK, BYE, and 200 (OK) to the BYE. Each proxy can independently
decide to receive subsequent messaging, and that messaging will go
through all proxies that elect to receive it. This capability is
frequently used for proxies that are providing mid-call
features.
INVITE F1
INVITE F2
INVITE F4
100 Trying F3
100 Trying F5
180 Ringing F6
180 Ringing F7
180 Ringing F8
200 OK F9
200 OK F10
200 OK F11
ACK F12
RTP Media Stream
BYE F14
200 OK F16
Alices PC
Bobs SIP Phone
atlanta.com Proxy Server
biloxy.com Proxy Server
ACK F13
BYE F15
200 OK F17
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation Registration Registration is one way that
the biloxi.com server can learn the current location of Bob. Upon
initialization, and at periodic intervals, Bobs SIP phone sends
REGISTER messages to a server in the biloxi.com domain known as a
SIP Registrar. The REGISTER messages associate Bobs SIP or SIPS URI
(sip:[email protected]) with the machine into which he is currently
logged (IP). The registrar writes this association, also called a
binding, to a database, called the location service, where it can
be used by the proxy in the biloxi.com domain. Bob is not limited
to registering from a single device. For example, both his SIP
phone at home and the one in the office could send registrations.
This information is stored together in the location service and
allows a proxy to perform various types of searches to locate Bob.
Similarly, more than one user can be registered on a single device
at the same time. The location service is just an abstract concept.
It generally contains information that allows a proxy to input a
URI and receive a set of zero or more URIs that tell the proxy
where to send the request.
SIP Location Server
1. REGISTER
SIP Registration Server
Bobs SIP Phone
2. Write in DB
biloxy.com Proxy Server
3. Query for Bobs Location
4. Zero (0) or more URIs
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation RegistrationF1 REGISTER Bob ->
Registrar
REGISTER sip:registrar.biloxi.com SIP/2.0 Via: SIP/2.0/UDP
bobspc.biloxi.com:5060;branch=z9hG4bKnashds7 Max-Forwards: 70 To:
Bob From: Bob ;tag=456248 Call-ID: 843817637684230@998sdasdh09
CSeq: 1826 REGISTER Contact: Expires: 7200 Content-Length: 0
Associating Bobs URI with the machine he is currently logged (the
Contact information) The information expires after 2 hours
Bobs SIP Phone
SIP Registration Server
REGISTER F1
200 OK F2
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation RegistrationF2 200 OK Registrar ->
Bob
SIP/2.0 200 OK Via: SIP/2.0/UDP
bobspc.biloxi.com:5060;branch=z9hG4bKnashds7 ;received=192.0.2.4
To: Bob From: Bob ;tag=456248 Call-ID: 843817637684230@998sdasdh09
CSeq: 1826 REGISTER Contact: Expires: 7200 Content-Length: 0 All
Current Binding of
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation CANCELThe CANCEL request, as the name
implies, is used to cancel a previous request sent by a client
(only INVITEs). Specifically, it asks the UAS to cease processing
the request and to generate an error response to that request.
CANCEL has no effect on a request to which a UAS has already
given a final response (200 OK).
A UAS that receives a CANCEL request for an INVITE, but has not
yet sent a final response, would stop ringing, and then respond to
the INVITE with a specific error response (a 487).
CANCEL F4
INVITE F1
100 Trying F2
180 Ringing F3
487 (Request Terminated) F5
Alices PC
Bobs SIP Phone
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation CANCELIf the UAS has already sent a final
response for the original request, the CANCEL request has no effect
on the processing of the original request, no effect on any session
state, and no effect on the responses generated for the original
request.
If the UAS did not find a matching transaction for the CANCEL
according to the procedure above, it SHOULD respond to the CANCEL
with a 481 (Call Leg/Transaction Does Not Exist).
INVITE F1
100 Trying F2
180 Ringing F3
Alices PC
Bobs SIP Phone
CANCEL F4'
200 OK F4
BYE F6
200 OK F7
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation OPTIONSThe SIP method OPTIONS allows a UA
to query another UA or a proxy server as to its capabilities. This
allows a client to discover information about the supported
methods, content types, extensions, codecs, etc. without ringing
the other party.
OPTIONS F1
200 OK F2
Alices PC
Carols SIP Phone
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation OPTIONSOPTIONS sip:[email protected]
SIP/2.0Via: SIP/2.0/UDP pc33.atlanta.com;branch=z9hG4bKhjhs8ass877
Max-Forwards: 70 To: From: Alice ;tag=1928301774 Call-ID:
a84b4c76e66710 CSeq: 63104 OPTIONS Contact: Accept: application/sdp
Content-Length: 0
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Overview of Operation OPTIONSSIP/2.0 200 OKVia: SIP/2.0/UDP
pc33.atlanta.com;branch=z9hG4bKhjhs8ass877 ;received=192.0.2.4 To:
;tag=93810874 From: Alice ;tag=1928301774 Call-ID: a84b4c76e66710
CSeq: 63104 OPTIONS Contact: Contact: Allow: INVITE, ACK, CANCEL,
OPTIONS, BYE Accept: application/sdp Accept-Encoding: gzip
Accept-Language: en Supported: foo Content-Type: application/sdp
Content-Length: 274
(SDP not shown)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Protocol ComponentsUser Agent Client (UAC)End SystemsSend SIP
RequestsUser Agent Server (UAS)Listening for Incoming
RequestsExecute an internal logic/program to determine the
appropriate responseUser AgentUAC + UAS
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Protocol ComponentsRedirect ServerRedirect callers (requests) to
another ServerProxy ServerRelay Call Signaling (Proxy requests to
another server)Can fork requests to multiple targetsAble to
maintain basic Call-State (or not)RegistrarReceives registrations
requests regarding current user locationsStores the information at
a Location Server
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Methods (Core Methods)INVITEInitiate SessionsChange a
Session state via re-INVITEsACKConfirms Session
EstablishmentBYETerminates SessionsCANCELCancels an INVITE request
sent by a client not already sent a final response forOPTIONSQuery
another UA or a proxy server as to its capabilitiesREGISTERBinds
permanent address to the current location
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes1xy Information or Provisional - Request in
progress but not yet completed100 Trying180 Ringing181 Call is
Being Forwarded182 Queued183 Session Progress2xy Success - the
request has completed successfully200 OK
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes3xy Redirection - another location should be
tried for the request 300 Multiple Options 301 Moved Permanently
302 Moved Temporarily 305 Use Proxy 380 Alternative Service
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes4xy Client Error due to an error in the
request, the request was not completed . The client SHOULD NOT
retry the same request without modification (for example, adding
appropriate authorization). However, the same request to a
different server might be successful. 400 Bad Request 401
Unauthorized 402 Payment Required 403 Forbidden 404 Not Found 405
Method Not Allowed 406 Not Acceptable 407 Proxy Authentication
Required 408 Request Timeout
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes 410 Gone 413 Request Entity Too Large 414
Request URI Too Long 415 Unsupported Media Type 416 Unsupported
Media Scheme 420 Bad Extension 421 Extension Required 423 Interval
Too Brief 480 Temporarily Unavailable 481 Call/Transaction Does Not
Exist482 Loop Detected 483 Too Many Hops 484 Address Incomplete 485
Ambiguous 486 Busy Here 487 Request Terminated 488 Not Acceptable
Here 491 Request Pending 493 Undecipherable
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes5xy Server Failure the request was not
completed due to error in recipient. Can be retried at another
location 500 Server Internal Error 501 Not Implemented 502 Bad
Gateway 503 Service Unavailable 504 Server Time-Out 505 Version Not
Supported 513 Message Too Large
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Response Codes6xy Global Failure request was failed and
should not be retried again 600 Busy Everywhere 603 Decline 604
Does Not Exist Anywhere 606 Not Acceptable
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Architecture (I Proxy) SIP UA [A]SIP ProxyDNS ServerSIP UA
[B]Location ServiceSIP ProxySIP Registrar1. Register2.
Storesip:[email protected]:[email protected].
INVITE5+6. DNS Query7. FW: INVITE9+10. Query & Respond11. FW:
INVITE4. 100 Trying8. 100 Trying12. 180 Ringing13. 180 Ringing14.
180 Ringing15. 200 OK16. 200 OK17. 200 OK18. ACK19. Media Transport
is opened20. BYE21. 200 OK
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Architecture (II Proxy & Redirect) SIP UA [A]SIP
ProxyDNS ServerSIP UA [B]Location ServiceSIP ProxySIP Registrar1.
Register2.
Storesip:[email protected]:[email protected].
INVITE5+6. DNS Query9. FW: INVITE11+12. Query & Respond13. FW:
INVITE4. 100 Trying10. 100 Trying14. 180 Ringing15. 180 Ringing16.
180 Ringing17. 200 OK18. 200 OK19. 200 OK20. ACK21. Media Transport
is opened22. BYE23. 200 OKSIP Redirect Serversip.new-york.com7. FW:
INVITE8. Redirect: sip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Architecture (III The Principle of Mobility) SIP UA [A]SIP
ProxyDNS ServerSIP UA [B]Location ServiceSIP ProxySIP Registrar1.
Register2.
Storesip:[email protected]:[email protected].
INVITE5+6. DNS Query7. FW: INVITE9+10. Query & Respond11. FW:
INVITE4. 100 Trying8. 100 Trying12. 3xx Redirect13. FW: RedirectSIP
UA [B][email protected]. FW: INVITE15. 180 Ringing16. 180
Ringing17. 200 OK18. 200 OK19. ACK20. Media Transport is Open21.
Bye22. 200 OK
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Message Structure
Some Other Time
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The Change of TidesWith RFC 2543 UDP was used as the underlying
transport protocol for SIPThe IETF demanded that with the new
version of SIP, Security will be an integral part of the
protocolSince UDP is hard to secure (IPSec only) the authors of the
new version of the protocol turned to TCP. Up until that point they
argued that UDP is a better solution for transport of SIP signaling
(no retransmissions, and other)So Dorothy had to buckle up because
Kansas gone bye bye
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
The SIP Threat Module
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
SIP Threat Module
Assumption:An Attacker Is On the Wire[This list is only a
partial list]
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
ThreatsDenial-of-ServiceCANCELBYEUsing response codesICMP Error
Messages for UDP datagramsCall HijackingThrough the
RegistrarThrough the usage of 3xy response code messagesMid-Session
tricks
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
ThreatsMan in the Middle (MITM) AttacksThrough the usage of 301
& 302 Response codesThrough the usage of 305 (Use Proxy)
response codeNo intelligence/control of the Media stream during a
sessionCovert ChannelsUnknown Header fieldsEnumeratingOPTIONSCall
Leg does not existsMax - Forwards
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
ThreatsWiretappingWhos in my path?SIP Proxies are allowed to
send messages through a set of additional proxiesCall
TrackingClients are Malicious
Design IssuesPredictable Values
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service CANCEL SIP UA [A]SIP ProxyDNS ServerSIP UA
[B]Location ServiceSIP ProxySIP Registrar1. Register2.
StoreSIP:[email protected]:[email protected].
INVITE5+6. DNS Query7. FW: INVITE9+10. Query & Respond11. FW:
INVITE4. 100 Trying8. 100 Trying12. 180 Ringing13. 180 RingingSIP
UA [C]SIP:[email protected]. CANCEL14. 180 RingingThe CANCEL needs
to hit Bobs SIP Phone before it sends the 200 OK. This is a
Denial-of-Service on Bob
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service CANCEL SIP UA [A]SIP ProxyDNS ServerSIP UA
[B]Location ServiceSIP ProxySIP Registrar1. Register2.
StoreSIP:[email protected]:[email protected].
INVITE5+6. DNS Query7. FW: INVITE9+10. Query & Respond11. FW:
INVITE4. 100 Trying8. 100 Trying12. 180 Ringing13. 180 RingingSIP
UA [C]SIP:[email protected]. CANCEL14. 180 RingingThe CANCEL needs
to hit Bobs SIP Phone before it sends the 200 OK. This is a
Denial-of-Service on Alice. Whenever Alice sends an INVITE, carol
will CANCEL it.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service BYE Location ServiceSIP RegistrarSIP UA [B]SIP
UA [C]SIP Proxy SIP UA [A]SIP Proxy1. Register2.
StoreSIP:[email protected]:[email protected]:[email protected]
soon as the 200OK will be sent from Bobs SIP Phone to Alices SIP
Phone, Carol will send a BYE request to either Bob or Alice or
both3. INVITE4. 100 Trying5. FW: INVITE6. 100 Trying8. Reply9. FW:
INVITE7. Query10. 100 Trying11. FW: 100 Trying12. FW: 100 Trying13.
200 OK14. FW: 200 OK16. BYE15. FW: 200
OKsip.atlanta.comsip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service BYE (to Alice)Location ServiceSIP RegistrarSIP
UA [B]SIP UA [C]SIP Proxy SIP UA [A]SIP
ProxySIP:[email protected]:[email protected]:[email protected]
200OK is sent to acknowledge the BYE request16. BYE17. FW: BYE18.
FW: BYE19. 200 OK20. FW: 200 OK21. FW: 200 OK200 OK received (The
transaction is non-existent on Alices SIP Phone ONLY)22. Any SIP
MessageThe session does not exist on the SIP Proxy anymore, but it
will pass the message23. FW: Any SIP Message24. FW: Any SIP
Message25. 481 Call/Transaction Does Not Exist26. 481
Call/Transaction Does Not Exist27. 481 Call/Transaction Does Not
ExistWe got a mismatchsip.atlanta.comsip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service BYE (to Bob)Location ServiceSIP RegistrarSIP
UA [B]SIP UA [C]SIP Proxy SIP UA [A]SIP
ProxySIP:[email protected]:[email protected]:[email protected].
200 OK18. FW: 200 OK16. BYE19. FW: 200 OKThe session does not exist
any more on Bobs SIP Phonesip.atlanta.comsip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service BYE (to Both)Location ServiceSIP RegistrarSIP
UA [B]SIP UA [C]SIP Proxy SIP UA [A]SIP
ProxySIP:[email protected]:[email protected]:[email protected].
BYE (B->A)17. 200 OKWhen a fake BYE will be sent to one of the
participants in a dialog, that participant will generate a 200 OK
reply. To avoid detection the BYE will be sent simultaneously to
both participants, and the 200 OK responses, although generated for
a different message will not be suspected (Sequence of both BYE
will be the same) 18. FW: 200 OK17. 200 OK16. BYE (A->B)The
malicious party will send the BYE request not through the SIP
Proxies but direct to the dialog participants. This to avoid cases
in which a stateful proxy might take action for the BYE SIP
request.19. FW: 200 OK18. FW: 200 OK19. FW: 200
OKsip.atlanta.comsip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Denial of Service Using Response Codes A malicious party can use
several response codes in order to introduce a denial of service
condition4xx responses are definite failure responses from a
particular server. The client SHOULD NOT retry the same request
without modification (for example, adding appropriate
authorization). However, the same request to a different server
might be successful.5xx responses are failure responses given when
a server itself has erred.6xx responses indicate that a server has
definitive information about a particular user, not just the
particular instance indicated in the Request-URI.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call HijackUsing Manipulation of the Registration
RecordsLocation ServiceSIP RegistrarSIP UA [B]SIP UA [C]SIP Proxy
SIP UA [A]SIP Proxy1. Register2. Store3.
RegisterSIP:[email protected]:[email protected]:[email protected].
StoreAssociating Bobs URI with the machine he is currently logged
(the Contact information) Associating Bobs URI with the attackers
machine 4. INVITE5. 100 Trying6. FW: INVITE7. 100 Trying8. Query9.
Reply10. FW: INVITEsip.atlanta.comsip.biloxy.com
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call Hijack Using Manipulation of the Registration Records You
can query the SIP Registrar for the list of addresses of a
particular SIP URI You will be given the list of addresses
associated with your SIP URI with each successful registrationBut
does your UA will show it up? Probably not (we tried this NO!)You
can give your registration higher priority than the other record
(not deleting other records)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call Hijack Using Manipulation of the Registration RecordsOr,
you can register with a lower priority and perform a denial of
service on the higher priority entry, so the SIP Proxy will not be
able to deliver-to-it and will turn to the next entry with the
RegistrarThe Registrar can require the registering party (which can
be a 3rd party as well) to authentication before receiving the
registration information. But, since the characteristics of the
registration with SIP requires registration each hour for the same
SIP URI, by default, it is unlikely that a SIP phone user will
authenticate to the Registrar each hourInstead, what most of the
SIP-based phones does is store the username and password
information with the phone (other attack venues) and perform
autentication automatically for the user when required (not always
works smoothly)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call Hijack Using 301 Moved Permanently Response Code SIP UA
[A]SIP ProxySIP:[email protected]. INVITE2. 100
Tryingsip.atlanta.comSIP Proxysip.biloxy.comSIP UA
[B]SIP:[email protected] UA [C]SIP:carol@IP_ADDRESS3. FW: INVITE4.
301 Moved PermanentlyThe user can no longer be found at the address
in the Request-URI, and the requesting client SHOULD retry at the
new address given by the Contact header field. The requestor SHOULD
update any local directories, address books, and user location
caches with this new value and redirect future requests to the
address(es) listed. 5. INVITEThe INVITE that was originally sent to
[email protected], is now being sent to the address given with the 301
spoofed response code, bob@foobar_IP (carols SIP Phone). Therefore
the query goes to Carols SIP phone rather than to Bobs6. FW:
INVITE
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call Hijack Using 30x MessagesThe location of the malicious
entity can be anywhere (Alices network, Bobs network, in-between
networks)One can also use the 302 Moved Temporarily Response
Code:The requesting client SHOULD retry the request at the new
address(es) given by the Contact header field. The Request-URI of
the new request uses the value of the Contact header field in the
response. The duration of the validity of the Contact URI can be
indicated through an Expires header field or an expires parameter
in the Contact header field. Both proxies and UAs MAY cache this
URI for the duration of the expiration time. If there is no
explicit expiration time, the address is only valid once for
recursing, and MUST NOT be cached for future transactions. If the
URI cached from the Contact header field fails, the Request-URI
from the redirected request MAY be tried again a single time.
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call Hijack Mid Session Tricks / Re-INVITE me baby one more
time!this modification can involve changing addresses or ports,
adding a media stream, deleting media stream, and so on, this is
accomplished by sending a new INVITE request within the same dialog
that established the sessionalso known as Re-INVITEHijack the
signaling path you are able to introduce new routing into the
signaling path of a current sessionDeny signaling from any side to
your benefitCan evolve to introducing other participants to the
sessionEavesdropping made easy
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
MITM Attacks301 and 302 Response codes can be spoofed as
responses coming from any SIP element:SIP RegistrarSIP Proxy Server
SIP Redirect ServerSIP UAMore creativity 305 Use Proxy Response
Code
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
MITM Attacks 302 Moved Temporarily SIP UA [A]SIP
ProxySIP:[email protected]. INVITE2. 302 Moved
Temporarilysip.atlanta.comSIP Proxysip.biloxy.comSIP UA
[B]SIP:[email protected] Proxy302 Moved Temporarily - The
requesting client SHOULD retry the request at the new address(es)
given by the Contact header field. The Request-URI of the new
request uses the value of the Contact header field in the
response.3. INVITE4. FW: INVITE5. 100 Trying6. FW: INVITECarol is
now acting as a SIP Proxy
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
MITM Attacks vs. RegistrarLocation ServiceSIP RegistrarSIP UA
[B]SIP UA [C]1. RegisterSIP:[email protected]:[email protected]
SIP Phone performs a registration requestCarol is spoofing a 301
Moved Permanently response message allegedly coming from the
REGISTRAR2. 301 Moved Permanently3. Register4. 401 Unauthorized5.
Register request with appropriate credentials6. Confirm
Registration7. Register request for bobs credentials8. StoreCarol
has bobs credentials Game Over
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
MITM Attacks 305 Use Proxy, orThe Whos your Daddy? Attack SIP UA
[A]SIP ProxySIP:[email protected]. INVITE2. 305 Use
Proxysip.atlanta.comSIP Proxysip.biloxy.comSIP UA
[B]SIP:[email protected] ProxyThe requested resource MUST be
accessed through the proxy given by the Contact field. The Contact
field gives the URI of the proxy. The recipient is expected to
repeat this single request via the proxy. 305 (Use Proxy) responses
MUST only be generated by UASs. 3. INVITE4. FW: INVITE5. 100
Trying6. FW: INVITECarol is now acting as a SIP Proxy
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
No intelligence/control of the Media stream during a
sessionSignaling goes one way, Media goes another waySome device
needs to control the creation of Media streams no media stream
without the appropriate signaling (who came first the chicken or
the egg problem)If there is a modification to the Media stream
along the call (through the usage of RTP or RTCP, for example) the
SIP signaling protocol will not be aware of itIf the codec used
will be changed using the media transport protocol SIP is simply
blind. In the case the media stream will be cut the SIP elements
participating in the session (especially the SIP UAs) will not get
indication that the media is cut They will have to understand that
the conversation was cut
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
No intelligence/control of the Media stream during a
sessionThere is no control of the pipeline for the Media stream.
Therefore a malicious party can change the codec used through the
Media protocol used, and use a codec which demands more bandwidth
(and therefore its usage will raise the packet loss and we will
have a lower quality, or even a poor quality of speech)No
Provisioning what so ever on the Media stream
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
EnumerationIf the UAS did not find a matching transaction for
the CANCEL according to the procedure it SHOULD respond to the
CANCEL with a 481 (Call Leg/Transaction Does Not Exist). OPTIONS
methodThe Max-Forwards header value represents the maximum number
of SIP devices this request can route through. The default value is
70 (a nice rounded number)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Covert ChannelsIf you will introduce a fake SIP header field
with a SIP message it will be allowed across all components of a
SIP based solutionFuture header support It Just Rock!
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call TrackingDefined as: Logging of the source and destination
of all numbers being calledCapturing DTMFs along with other
signaling traffic will give an attacker the opportunity to capture
voice mail passwords (rings a bell?), calling card information,
credit card information, or any other data entered using DTMFWith
SIP all we need is to track INVITE messages If the BYE is also
recorded the duration of the call can also be tracked, and other
bits of information
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Call TrackingINVITE sip:[email protected] SIP/2.0Via: SIP/2.0/UDP
pc33.atlanta.com;branch=z9hG4bK776asdhds Max-Forwards: 70 To: Bob
From: Alice ;tag=1928301774 Call-ID:
[email protected] CSeq: 314159 INVITEContact:
Content-Type: application/sdp Content-Length: 142
(Alices SDP not shown)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Clients are MaliciousSIPs threat module according to the SIP WG
does not include malicious clientsIf I am using a malicious client
(my stack instead of the manufactures stack or a modified one) and
I am the called party, I can, for example, strip any Record-Route
headers and not bother with those. As a direct response to this,
not my client, and most importantly the caller will send signals
beyond the three-way SIP handshake through any SIP Proxy as we like
The official SIP threat module does not take into consideration
that when two friends use the network they will be able to unveil
the routing path with nearly no hassle (see example at the next
slide)There is also a lot more to this one
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Clients are MaliciousLocation ServiceSIP RegistrarSIP UA [B]SIP
Proxy SIP UA [A]SIP ProxySIP:[email protected]:[email protected]
conspirator will have all the route taken (at least the entities
that needs to be passed through) in the VIA
headerssip.atlanta.comsip.biloxy.comEncryptedSIP
Proxysip.somewhere.comEncryptedMight be EncryptedMight be
Encrypted
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
More IssuesPredicted ValuesFirewalls & NATBypassing the SIP
Proxy = Bypassing Billing (where is my CDR syndrome) No Control on
Media streams = Bypassing Billing using tunneling with the Media
streams protocolsFraud if you are only looking at CDRs produces
Well, you are a complete idxxx Most important is to look at the
network traffic
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Security Mechanisms with the SIP Protocol
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Security Mechanisms with the SIP ProtocolTLS supportTLS is only
good for TCPThis means that if you wish to use UDP for the
transport of your SIP messages you will not have security (accept
for body encryption)It is only RECOMMENDED that a UA will be able
to initiate a TLS based connectionDigital Certificated Usage and
the missing piece it is only for the SIP Servers to use digital
certificates. Clients are not required to have oneWithout
certificates at the client side we just have at the end of the
process an encrypted communication channel between two parties
without authenticating their identity12 messages to establish a
session, which according to the RFC needs to be kept alive all the
time
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Security Mechanisms with the SIP ProtocolS/MIME for message
bodies (key distribution)Digest Authentication With encryption
firewalls will be useless when they have the ability to really
understand the protocol (remember Max-Forwards for example?)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Multimedia Communication (RTP & RTCP)
2 0 0 1 - 2 0 0 2 O F I R A R K I N & @ S T A K E , I N C
.*
Multimedia Communication (RTP & RTCP)The main concern is the
ability to control any part of a media stream by manipulating the
appropriate valuesThis is done by manipulating the Sequence and
Timestamp field values to higher values than they are currently.
The affect is that media streams coming from the user we are
attacking will not be accepted at the destinations end because they
will be discarded as old
More? Some other time
