Who is Watching You? Video Conferencing Security

Transcription

1 Who is Watching You? Video Conferencing Security Navid Jam Member of Technical Staff March 1, 2007 SAND# C Computer and Network Security Security Systems and Technology Video Conference and Collaborative Technologies Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy s National Nuclear Security Administration under contract DE-AC04-94AL

2 Something to think about Communication Devices Let s Compare 2

3 Something to think about Communication Devices Vs. Polycom VSX

4 Something to think about Communication Devices Vs. Polycom VSX 8000 Linksys WVC200 Wireless PTZ Internet Camera with Audio 4

5 Something to think about Communication Devices Vs. Polycom VSX 8000 MSRP $12,999 Linksys WVC200 Wireless PTZ Internet Camera with Audio Difference of: MSRP $12,700 MSRP $299 5

6 Embedded Devices Specialized hardware and software TCP/IP That have embedded beneficial services like: FTP Telnet HTTP SNMP H.323 Etc. How secure are these devices? 6

7 Ocean s 11 Intelligence Gathering Hacking / Information Operations Using IT systems to aid physical attack 7

8 Agenda Introduction The Center for Cyber Defenders (CCD) Methodology Findings Best Practices Future Research Conclusion 8

9 Introduction Embedded IP devices Using video conferencing as case study Video Conferencing usage has increased Video Conferencing Technology (VCT) Vendors pushing new features IP VoIP Data collaboration Etc Little focus on security We have AES encryption, therefore we are secure Who is responsible for securing these devices? Networking Computer Security Video Conferencing What about patch management? 9

10 VCT Architecture 10

11 Basic Protocols H.320 ISDN H.323 Video over IP T.120 Collaborative data sharing HD Video, POTS, etc. 11

12 15-20 students a year Focus on information security Malicious Code Analysis Network Programming OS Analysis Vulnerability Assessments Forefront of IP Video Conferencing Security Highlighting the work done by students and other staff at SNL over the past 4 years Codec s (Polycom and Tandberg) Desktop Camera s Network Infrastructure (Polycom, Tandberg & Cisco) Stay tuned for future announcements 12

13 Methodology Knowing Your Adversary What is your threat? 13

14 Red Teaming - Methodology Six phases of research, planning, and attacking 14

15 Gain Administrative Access Attack Tree 15

16 Goals Attack with the following goals: Compromise the system any way possible Conduct an independent assessment of the vulnerabilities and risks of using Video Conferencing Technology Develop industry best practices Analyze the site implementation Develop tools to aid in vulnerability assessment of VCT devices 16

17 Overview of Findings Gaining Administrative Access Diagnostics Mode Packet Sniffing Web Vulnerabilities Surveillance Capturing and Viewing Traffic Auto Calling Encryption Audio and Video Streaming Making Surveillance Covert Transmitting Information to an Outside Source Hosting Files ISDN / IP Enabling and Concealing Services Other Attacks Will only vaguely describe some 17

18 Gaining Administrative Access Gaining Administrative Access Diagnostics Mode Packet Sniffing Web Vulnerabilities 18

19 Gain Administrative Access Diagnostics Mode BootUI mode Physical Access Hold power button for 10 seconds while booting up Remote Force BootUI mode with buffer overflow 2005, Software Version# 7.5.2d Attack BootUI Copy off the contents of flash to single file Run strings and grep on file Can t prevent physical attack Unable to log BootUI mode s occurrence 19

20 Gain Administrative Access Diagnostics Mode Analyzing a chip dump Also saves password history 20

21 Gain Administrative Access Packet Sniffing Telnet and FTP passwords are unencrypted which makes it easy to sniff the network and obtain them 21

22 Gain Administrative Access Web Vulnerabilities Unauthenticated CGI s Buffer Overflows Get requests Post requests 22

23 Gain Administrative Access Unauthenticated CGI s 2004, Software Version# Returns administrative password Returns a list of all addresses in the address book Returns a list of all video calls the device has participated 23

24 Exploiting a buffer overflow vulnerability Gain Administrative Access Buffer Overflows 2005, Software Version# 7.5.2d Upload a single file to the web server 24

25 Exploiting a buffer overflow vulnerability (contd.) Gain Administrative Access Buffer Overflows 2005, Software Version# 7.5.2d The system stops requiring authentication for Telnet and FTP connections (until next reboot) 25

26 Gain Administrative Access Get / Post Requests 2006, Software Version#8.5 Able to retrieve admin password unauthenticated Able to change admin password unauthenticated Some.file has this comment in code /*. We may want to look into making this more secure */ Number of web vulnerabilities New Security Mode features Encryption features, HTTPS, TelnetS, FTPS etc. Perform all attacks / steaming encrypted 26

27 Gain Administrative Access What does this mean? Having administrative rights gives a person complete control of the Polycom device, including: Placing script on device that will automatically dial a third device when called Configure the device to accept any call Smuggle file to an outside network using the Polycom device Change password, preventing legitimate users from using the device Forcing the device to use a gatekeeper which can falsify audio and video 27

28 Surveillance Surveillance Capturing and Viewing Traffic Auto Calling Encryption Video and Audio Streaming Covert Audio Streaming Making Surveillance Covert 28

29 Surveillance Capturing and Viewing Traffic Capture with Ethereal Decode and view with Observer 29

30 Surveillance Capturing and Viewing Traffic 30

31 Surveillance Auto Calling Use scripts to initiate calls to third party Livermore Albuquerque Attacker 31

32 Surveillance Auto Calling Use scripts to initiate calls to third party Albuquerque Viewstation in Albuquerque has a previously loaded script 32

33 Surveillance Auto Calling Use scripts to initiate calls to third party Livermore Albuquerque Livermore calls Albuquerque 33

34 Surveillance Auto Calling Use scripts to initiate calls to third party Livermore Albuquerque Attacker Viewstation in Albuquerque runs the script which calls Attacker s Viewstation 34

35 Surveillance Encryption Video & Audio Streaming 2006, Software Version# 8.5 Making changes through encrypted channels Streaming Audio and Video Making audio streaming covert 35

36 Surveillance What does this mean? Any conference that uses VCT devices on an unencrypted network can be recorded and replayed by anyone connected to that network Any conference that uses Polycom VCT devices can be eavesdropped on using auto dialing with ISDN and IP 36

37 Transmitting Information to an Outside Source Hosting Files Upload files unauthenticated files to the Polycom web server Upload files to the Polycom with FTP and an administrative password. Maximum file size that can be uploaded: Viewstation VS Software Release MB Viewstation FX Software Release 5.1 FX 3MB VS 4000 Software Release FX 3MB VSX 8000 Software Release 8.5 3MB 37

38 Transmitting Information to an Outside Source Hosting Files 2005, Software Version# 7.5.2d Telnet to the web services (port 80) and use the PUT command Initial attempts caused the device to crash erratically 38

39 Transmitting Information to an Outside Source IP / ISDN System files can be accessed and modified. Fooling OS to think files are system files by giving them the same names ISDN line can be used to transfer data outside 2006, Software Version# 8.5 IP traffic can be encrypted as well Enabling and concealing services 39

40 Transmitting Information to an Outside Source What does this mean? Information can be passed to an outside source using the Polycom VCT devices, such as: Sensitive information a user intentionally added to system files Configuration files Call logs Administrator password 40

41 Other Attacks Deny Service Inject / Falsify Video Using: Gatekeepers Gateways Use VCT devices a launching point for other attacks Compromised Host Java / Java Script Programs Port Scanners Vulnerability Scanners Enterprise Management 41

42 What About Tandberg? 2004, Software Version# Classic Model E2.1 and E4.0 Not Perfect... all pages on the Tandberg device could be requested if the leading / is left off the get request sent to the HTTP server get Request Rejected 42

43 Tandberg Continued get Request Accepted without Authentication 43

44 Tandberg Continued Administrator Password Set using get and plugin_set 44

45 What About Tandberg Some problems in 2004 Auto Dialing Uploading / Transmitting files (9 megabytes) Surveillance Better vendor support wrt security More stable IP stack Targeted attacks ongoing 45

46 Best Practices for VCT Devices Device Physically secure the devices Update firmware Disable all unneeded and rarely used protocols (i.e. FTP, Telnet, SNMP, and HTTP*) Disable auto answer for incoming calls Develop a strong administrator password and change it periodically Restart the devices on a weekly basis Take a snapshot (MD5, SHA[n]) of all of the system files and periodically verify that they have not been modified (or just reinstall the OS periodically) 46

47 Best Practices for VCT Devices Network Use Access Control Lists (ACL's) and/or routers to help secure the network on which the devices operate Any computer (IP) allowed past the ACL needs to be well guarded as to make sure surveillance software is not installed that could allow that computer to sniff the traffic and send it offsite Use VLAN's Encryption should be used on the network across all WAN links as well as internally for important calls Ensure the router/switch/firewall is kept up to date 47

48 Best Practices for VCT Devices Management Server Keep the server up to date with security patches Limit access to the server via strict ACL's Encrypt traffic between the management clients and devices 48

49 Best Practices for VCT Devices Policy Shut off the devices when they are not in use Develop and enforce a strong password policy Develop policies that forbid circumventing network security to sniff/monitor traffic Develop working relationship and information sharing with vendor based on Service Level Agreements Conduct routine security audits of devices Conduct periodic reviews/scans to audit ACL's and ensure they are working 49

50 Sandia Security Switch (S3) Patent Pending TSCM approved 62 50

51 Open PCS Architecture for Interoperable Design (OPSAID) Designed for add-on security for embedded devices SCADA Video Conferencing Legacy systems Etc. Provides for: Secure management / configuration Logging and monitoring capabilities Firewalls IDS Encryption 51

52 Further Areas for Research Impact of connecting with other vulnerable Codec s Inserting malicious code into video stream ISDN Gatekeepers, Gateway s and Bridges as another means of attack T.120 security issues Room Controllers Systematic approach to security Codec Network Conference Room / Desktop 52

53 Conclusion Many benefits to video conferencing Polycom devices continue to be insecure Polycom is making a number of security improvements, however, more of a bandage than a comprehensive security overhaul Tandberg has better vendor support wrt security Technical and policy based recommendations to help mitigate some of the current threat Multilayered approach to security ACL's VLAN's Encryption User training 53

54 Navid Jam Questions / Comments 54

55 Environment 55

56 Gather Information About Devices Google White papers Documentation Nessus Other vulnerability scanners Spiders Social engineering etc 56

57 S3 Block Diagram 57