Podo Attack - Listening To Cisco IP Phone Calls

Transcription

1 Podo Attack - Listening To Cisco IP Phone Calls TABLE OF CONTENTS Introduction... 2 Overview - Cisco IP Phone Operation... 2 Demo The Scenario... 4 Demo Clone The Cisco IP Phone Configuration... 6 Demo Enable The Span to PC Port Cisco Phone Parameter... 9 Demo Capture And Play Voice Calls! Demo Cover Your Tracks! Conclusions... 17

2 Introduction Most of the Cisco IP phones on the market today provide a PC port. The idea is that a user device (i.e. a PC) can connect to the phone s PC port and the phone will bridge the traffic across its uplink to the switch thereby providing the PC with network connectivity. This is great because only a single switch port is required for the phone and the PC Screenshot 1 provides an overview of a Cisco IP phone and the available connections. Screenshot 1 Cisco IP phone connections The aim of this demo is to be able to capture voice traffic. Once this traffic is captured, it can be re-played at leisure, meaning that an attacker can listen to all voice calls that have been made on the compromised phone. Totally irrelevant trivia: I have named this the Podo Attack Podo is the nickname that I have given to my 5 year old boy Lewis. When he was about 3 years old he used to name everything and everyone Podo so I started to call him the same name, and it stuck... Overview - Cisco IP Phone Operation Before you can develop techniques to compromise something, my own philosophy is that it is better to understand how the hardware and/or software operates first. Only by gaining an understanding of how things work can you think of ways to compromise/exploit something and achieve whatever objective you set. In this tutorial, we target Cisco IP phones, so let s first provide a quick overview on the boot process. The following boot process is not intended to be exhaustive, but it does demonstrate the high level process undertaken (important content that is relevant to the demo is highlighted bold): 1. The Cisco IP Phone connects to an ethernet switchport (usually uses POE Power over Ethernet - to power the phone).

3 2. When the Cisco IP Phone powers on, the Cisco switch delivers voice VLAN information to the IP phone using CDP as a delivery mechanism. The Cisco IP Phone now knows what VLAN it should use for voice traffic. 3. The Cisco IP Phone sends a DHCP request asking for an IP address on its voice VLAN. 4. The DHCP server responds with an IP address offer. When the Cisco IP Phone accepts the offer, it receives all the DHCP options that go along with the DHCP request. DHCP options include items such as default gateway, DNS server information, domain name information, and so on. In the case of Cisco IP Phones, a unique DHCP option is included, known as Option 150. This option directs the IP phone to a TFTP server. Note: Other DHCP options can also be used to specify the TFTP server such as option 66. Option 66 only allows a single TFTP server to be specified whereas option 150 allows multiple TFTP servers to be specified which is better for redundancy. 5. After the Cisco IP Phone has the IP address of the TFTP server(s), it contacts the TFTP server and downloads its configuration file. The XML configuration file of a Cisco IP phone is SEPAAAABBBBCCCC.cnf.xml where AAAABBBBCCCC is the MAC address of the phone. Therefore, a Cisco IP phone with MAC address would send a TFTP get for filename SEP cnf.xml. 6. The Cisco IP Phone attempts to contact the first call processing server (the primary server) listed in its XML configuration file to register with. If this fails, the IP phone moves to the next server in the configuration file. Once the phone is registered with a call processing server, such as a CUCM (Cisco Unified Call Manager) server, it is able to send and receive voice calls. OK, we understand the boot process now, this will be useful later. The next concept to understand is the Span to PC Port feature. Screenshot 2 is the official description on Cisco s website: Screenshot 2 Span to PC Port explanation Source:

4 SPAN is traditionally a Cisco switch feature that stands for Switch Port Analyzer. In other switch vendors this is known as port-mirroring. In simple terms, it takes traffic that is sent/received on one interface and sends a copy of that traffic out of another interface. In a legitimate scenario, this could be useful when troubleshooting and you send the SPAN d traffic to an interface when you have a packet sniffer running so that you can analyse the traffic flows to and from a particular device. This feature is useful and dangerous in equal measures. If this feature is enabled, an attacker could capture a copy of all the voice traffic and then re-play the calls whenever they like... The Span to PC Port feature can be enabled for Cisco IP Phone Models: 7941, 7942, 7961, 7962, 7965, 7970, 7975, 99xx, 89xx, and 699xx. Interestingly, this feature is enabled and CANNOT BE DISABLED on the 7940 and 7960 phones as per Screenshot 3 Screenshot 3 Cisco 7940 and 7960 Span to PC Port setting Source: Demo The Scenario The demo will target a production Cisco 7941 phone as shown in Screenshot 4, with relatively default settings. For the purpose of the demo, you should assume that the Cisco 7941 phone is in a place that an attacker could physically access (in a meeting room that could be accessed for example). I will be using my own security drop box for this demonstration the OG150 ( In reality, you could use your own drop box or even a laptop. Using a drop box is more covert than a laptop, as you can see in Screenshot 5 the OG150 is neatly hidden at the rear of the phone. By using a small drop box and a portable power supply, a person in front of the phone has no idea that something is connected to the phone s PC port (Screenshot 4 is all the phone user sees).

5 Screenshot 4 Cisco 7941 phone (front) Screenshot 5 Cisco 7941 phone with OG150 connected (rear) The OG150 has an b/g/n wireless interface. The attacker in this scenario has connected the OG150 (via ethernet cable) to the phones PC port and left the premises. He/she is outside the building and has associated to a wireless SSID hosted by the OG150 and has successfully SSH d to the OG150 command line, as shown in Screenshot 6. The attacker now has access to a device (the OG150) that is directly connected to the Cisco IP phone. Let the fun commence...

6 Screenshot 6 OG150 login banner Demo Clone The Cisco IP Phone Configuration The next thing we want to do is find out a little about the Cisco IP phone. In fact, it would be useful to actually take a copy of the phones configuration file! We know that Cisco devices use a protocol called CDP (Cisco Discovery Protocol) to advertise capabilities and general information about the device. Let us see if the Cisco IP phone is sending CDP messages out of the PC port where the OG150 is connected. I use tcpdump for this, which is a packet capture tool supported by the OG150 and most Linux based devices. In Screenshot 7 I apply a filter to display only CDP traffic this is shown within the red rectangle. As you can see in Screenshot 7, the OG150 has successfully snooped a CDP message sent by the phone relevant CDP details are shown in the green rectangles. Screenshot 7 CDP snooping with tcpdump

7 The most useful information here is the device ID and the IP address of the phone. Recall in section Overview - Cisco IP Phone Operation that a Cisco IP phone configuration file is named SEPAAAABBBBCCCC.cnf.xml where AAAABBBBCCCC is the MAC address of the phone. Now that we know the phones device ID (gleaned via the CDP snoop), we can ascertain that the phones configuration file is: SEP001BD40C0C7A.cnf.xml If we knew the TFTP server IP address that the phone uses, we could try and download the phones configuration file via a TFTP get. However, we don t know the TFTP server IP address... at least we don t know it yet Cisco IP phones support a minimal web-based management interface, which means you can web-browse to the phone as long as you know its IP address. This is useful for troubleshooting and viewing configuration data. Did I just say configuration data!? Yes, that is helpful! The OG150 and most other Linux based devices support a tool called wget. wget is a network utility that can be used to retrieve files from the web using http. I will use wget to download a page from the Cisco IP phone where I know that the TFTP server IP address is listed! We already know the IP address of the phone via the CDP snooping process shown in Screenshot 7. I will execute the wget command to the Cisco IP phone IP address with the URL /CGI/Java/Serviceability?adapter=device.statistics.configuration appended as shown in Screenshot 8 (see red rectangle for wget command). As highlighted using the colour green, we have got the TFTP servers IP address Please note: Sensitive information has been blocked out using the colour grey. Screenshot 8 Find TFTP server IP address using wget

8 This is progress, we now know the Cisco IP phones configuration filename and the TFTP server IP address where it is hosted. Let s go and get a copy! The OG150 and most other Linux based devices support a tool called atftp which is a TFTP client utility. We can use this tool to tell the OG150 to download the phones configuration file from the TFTP server and save it to memory. As you can see in Screenshot 9, we download the configuration file ( atftp command shown in the red rectangle). To confirm the file was downloaded successfully, the ls (list directory) command was executed and the configuration file is displayed (shown in the blue rectangles). Screenshot 9 Download Cisco IP phone configuration file using atftp You can view this configuration file using the cat command on the OG150, as shown in Screenshot 10. Note: Only part of the configuration is displayed for illustration purposes. Screenshot 10 View Cisco IP phone configuration file using cat

9 Let s re-cap; at this point all we have is the phones configuration. Although we cannot capture phone calls thus far, the work we have done is critical in order for the compromise to be successful. Demo Enable The Span to PC Port Cisco Phone Parameter The next step in this compromise is to enable the Span to PC Port setting on the Cisco phone. As discussed earlier, if this option is enabled the Cisco phone will send a copy of voice traffic to the device connected to the PC port in this case the OG150. We can check if this feature is enabled by reviewing the phone configuration that was previously downloaded in section Demo Clone The Cisco IP Phone Configuration. You need to find the spantopcport setting in the phones configuration file, it will be set to either a 1 or 0 as follows: If this setting is set to 1 then the Span to PC port feature is disabled (voice traffic IS NOT copied to the PC port) If this setting is set to 0 then Span to PC port feature is enabled (voice traffic IS copied to the PC port) In Screenshot 11 we open the phones configuration file using the cat command but filter the output using grep. As you can see, the spantopcport setting is set to 1 (inside the green rectangle). This means that voice traffic IS NOT currently copied to the PC port. Hmmmmm, let s change that! Screenshot 11 View spantopcport setting using cat Just for sanity, you can check this yourself on the phone as follows: Settings > Device Configuration > Ethernet Configuration > Span to PC Port The setting will be either Yes (enabled) or No (disabled) as you can see in Screenshot 12 this is set to No which confirms Span to PC Port is disabled.

10 Screenshot 12 View spantopcport setting using Cisco IP phone To get around this, we will edit the phone s configuration file that we previously downloaded to the OG150. We will enable the Span to PC Port setting and then demonstrate how to upload this configuration to the phone. First of all, edit the phones configuration on the OG150 so that the spantopcport setting is set to 0 (which means it is enabled). To do this we use the vi tool which is a text editor as shown in Screenshot 13. Screenshot 13 Edit the Cisco IP phones configuration using the vi tool Once the spantopcport setting is set to 0, use the same cat command used in Screenshot 11 to confirm that it is set properly. As you can see in Screenshot 14 the setting has been set properly. Screenshot 14 View spantopcport setting using cat OK, how do we get the edited configuration file (saved to memory on the OG150) onto the Cisco IP phone? In simple terms, we are going to tell the Cisco IP phone to download its configuration from the OG150 (instead of CUCM), where the edited configuration file is located Once it does this, the Span to PC Port setting will be enabled!

11 The OG150, like most Linux based devices, support a tool called atftpd which is a TFTP server utility. We will turn the OG150 into a TFTP server so that the phone can download its configuration from it. To do this, start the atftpd daemon with the default directory set to where the phone configuration file is saved. This process is shown in Screenshot 15. Screenshot 15 Enable TFTP server on OG150 Next, you have to physically touch the phone. Note: I am currently researching ways that avoids having to physically touch the phone for this step. On the phone, navigate to: Settings > Network Configuration > IPv4 Configuration > Alternate TFTP As you can see in Screenshot 16, Alternate TFTP is set to No and the TFTP Server 1 setting is set to (review Screenshot 8 for more information). Notice that this setting is Locked as per the padlock (highlighted by the red arrow). Screenshot 16 Phone settings Locked In order to change this setting, we need to Unlock it. Press the following key combination: **# Once this is done, the settings will become Unlocked as per the open padlock shown in Screenshot 17 (highlighted by the red arrow).

12 Screenshot 17 Phone settings Unlocked Highlight the Alternate TFTP setting and press the Yes softkey and then Save. Next, go to TFTP Server 1 and select Edit. Enter the IP address of the OG150, then press Validate and Save this process is shown in Screenshot 18. Note: The first octet of the IP address is blurred for security reasons. Screenshot 18 Reconfigure TFTP server IP address The phone will then reset and download its configuration from the OG150 (where the edited configuration file is stored). If you check the phone, it will now display the Span to PC Port setting is Yes which means it is enabled Confirmation of this is shown in Screenshot 19.

13 Screenshot 19 Span to PC Port is set to yes (enabled) Excellent, the phone is now sending a copy of all voice traffic to the PC port where the OG150 is located! Demo Capture And Play Voice Calls! We now want to capture all the voice traffic that is being copied to the PC port. To do this, I will use tcpdump and save any packets received on the OG150 ethernet interface (eth0) to directory /mnt/usb/ with filename phonecall.pcap. This is shown in Screenshot 20. Note: I chose to save the capture file to the 4GB USB memory that is connected to the OG150 because the onboard memory on the OG150 is fairly limited. In addition I am capturing ALL packets, feel free to use filters which capture only traffic you are interested in. Screenshot 20 Capture phone traffic using tcpdump At this point, I made a phone call from the Cisco IP phone to my mobile phone and talked to myself. This is not the first time I have done this, but it s a medical condition :-/ On a serious note, the important thing here is that a phone call was made and a conversation took place. I then stopped the tcpdump capture using CTRL+C.

14 A quick check of the destination directory ( /mnt/usb/ ) shows that the phonecall.pcap file was created with a filesize of we got something! This is shown in Screenshot 21. Screenshot 21 Verify packet capture file was created Next, we need to transfer this capture file to my laptop and play back the phone call. Recall that my laptop is connected wirelessly to the OG150, therefore I will use WinSCP to transfer the file to my laptop (you can use whatever tools you like to transfer the file). Open WinSCP on your laptop and login as shown in Screenshot 22. Screenshot 22 WinSCP login page Using WinSCP, browse to the folder on the OG150 where the phonecall.pcap file was saved in this demo I saved it to directory /mnt/usb/. Next, drag the phonecall.pcap file to a folder on your PC, make sure this file is copied as a Binary file as shown in Screenshot 23. Screenshot 23 Copy capture file to laptop

15 There are a few tools available that can replay voice calls using a packet capture file as input. I will use Wireshark for this purpose which is freeware. Screenshot 24 shows the version of Wireshark that I am using for this demo. Screenshot 24 Wireshark version Next, in Wireshark open the phonecall.pcap file that you previously copied to your laptop. To eliminate some of the background noise (irrelevant protocol traffic), add the filter skinny or rtp as shown by the red arrow in Screenshot 25. This will show only Skinny and RTP protocol traffic. Skinny is the short name for Skinny Call Control Protocol SCCP and is used for call control between a Cisco IP phone and a CUCM (Cisco Unified Call Manager). In this example, Skinny was used to create a call between the Cisco IP phone and my mobile phone. RTP (Real-time Transport Protocol) is used to transport the bearer traffic (the actual real-time audio stream). Screenshot 25 Open packet capture with the filter skinny or RTP Let s re-play the voice conversation! In the Wireshark menu, go to Telephony > VoIP Calls as shown in Screenshot 26.

16 Screenshot 26 View voice calls A screen similar to the one shown in Screenshot 27 will open. If there is no content displayed, then you didn t capture any voice calls. Click on Select All and then click on Player. Screenshot 27 Select voice calls to play A new window called RTP Player will open as shown in Screenshot 28. Click on Decode. Screenshot 28 Select voice calls to play A new screen will open as shown Screenshot 29. You can listen to either one-way traffic (one person talking only) or two-way traffic (both people talking). In my example, I want to hear the entire conversation (two-way traffic) therefore tick both boxes as indicated by the red arrows in Screenshot 29 and click on Play. You will now here the full conversation being replayed to you MISSION ACCOMPLISHED!

17 Screenshot 29 Play the voice calls Demo Cover Your Tracks! Once the attack is complete, the attacker would remove the OG150. It is also likely that the attacker would cover his/her tracks by changing the TFTP server back to the original IP address and setting the Alternate TFTP setting back to No on the phone (the phone would reset and the Span to PC Port setting would be disabled again). The installation is back to normal, however the attacker has potentially hours of your phone calls that they could listen to whenever they liked... Conclusions This attack may seem a little long-winded but it is pretty easy to execute. Phone calls are understandably considered to be private in nature, therefore this is a highly intrusive attack. I have drawn the following conclusions: Cisco goes to great lengths to provide a plethora of security features that prevent this type of attack. A classic feature blocks the user from being able to access or change the phone settings. If this feature was enabled in this demo, I would not be able to change the TFTP server IP address setting to that of the OG150. I believe Cisco should enable more security features as standard. The Span to PC Port setting is DISABLED by default, this is a good thing. I personally believe that user access to network settings should be BLOCKED by default too. Like most things in IT, ease of use is often preferred over security. I see no reason why a Cisco phone should be able to download its configuration via the PC port. This is asking for trouble in my opinion. In the real world you would never have a CUCM hanging off of a phones PC port that holds all the phone

18 configuration files...therefore it should not be allowed to download phone configurations via the PC port. I am very surprised that the Cisco 7940 and 7960 phones have the Span to PC Port feature enabled and it CANNOT be disabled. This is bad and the only real alternative is to replace these phones. As always, if you have any comments or questions feel free to me at: og150mark1@gmail.com