Phree as in Phone Call The other end of the line

Transcription

1 Phree as in Phone Call The other end of the line Presented By:

2 FILE_ID.DIZ Advantages of phreaking with VoIP Modern dialing setup Modern wardialing and scanning techniques Identifying and classifying devices Hacking dial-in lines System types and login attacks IVR and voic systems PIN brute-forcing PaBX s Exploiting features Eavesdropping and data-mining

3 International destinations much more accessible VoIP is cheap Can scam free VoIP Don t need to scan from home anymore Less knocks at the door Parallelization Can run savage burns Easier to perform certain attacks CallerID spoofing Automates hand scanning Callus free! Advantages of phreaking with VoIP

4 Modems and VoIP Most people think it can t be done Complex codecs cause havoc to connections Modems can t connect Connections drop It can be done! What you need How to tweak it

5 What you need Modems

6 What you need Analog telephony adaptors (ATA)

7 What you need VoIP account Lots of cheap providers voipjet.com voipbuster.com Trial accounts Free calls Asterisk server Routing Call recording CallerID spoofing

8 Device configuration tricks ATA Compression disabled (G.711 ulaw!) No echo cancellation (*99 on PAP2) Modem Disable local flow control Error-correction Disable data-compression Limit the data rate to 1200 bps for scans

9 Modem connection using VoIP

10 What can you connect to? Modems all over the world Control systems SCADA systems Alarm systems International x.25 networks India, Africa, Russia, China Banking Other interesting stuff Obscure devices and networks Bulletin boards (yep!) Who knows? The PSTN is global!

11 What can you connect to? SCADA system example

12 Wardialing Automatically dialing numbers to find modems Risks Target identification Inventory building Time of day Randomize numbers! Modern Wardialing Use VoIP, UNIX and Asterisk The Intelligent Wardialer (iwar)

13 Wardialing iwar Multiple modems are no problems! Serial to usb adapters Scaleable banks of modems with limitless potentional Remote system identification (126 banners) MySQL support CNAM lookup feature Blacklist support

14 Wardialing iwar in serial mode

15 Wardialing What will we find? Routers Remote access servers PPP dialins PC Anywhere PaBX management systems IVR systems Network backdoors Outdials Diverters (dialtones) Unknown and forgotten devices

16 Wardialing Reducing time with blacklists Internal / employee directories DDI s and other numbers harvested from websites Business directories Websites CDROMs Fax directories Do-not-call lists Special ranges Telco test equipment

17 Wardialing Published research Peter Shipley dialed 5.7M numbers over three years 50,000 carriers found Found unauthenticated access to Fire Department's dispatch system Control system for high-voltage power transmission line Internal networks of financial organizations A leased line control system Credit card number databases Medical billing records.

18 Wardialing THC-Scan: Next Generation Distributed wardialer! Large modem pools Large scan ranges - (09) 3XXXXXX Global scanning efforts Log sharing and karma systems

19 Wardialing Callus-free handscanning iwar with IAX2 connection Wifi at café, etc Headphones Time and patience Upsides Safe and anonymous Mostly automated Handsfree!

20 Hacking dial-in lines Figuring out what you re dealing with System types and banners Identifying different type login prompts and methods Building username and password lists Google for defaults Login Brute-forcing Tools Homebrew scripting

21 Hacking dial-in lines System types and banners

22 Hacking dial-in lines System types and banners

23 Hacking dial-in lines Different login prompts and methods Single auth Dual auth Limited or unlimited attempts? Username, password or both?

24 Login brute forcing Tools Commercial war dialers (lame) Modem login hacker for Linux X.25 NUI/NUA scanners Homebrew Minicom runscript Python serial library Procomm plus aspect script

25 Login brute forcing Modem Login Hacker Works against any Username: or Login: variations Unix, Cisco, PaBXs Customizable for different login formats Includes PPP brute-forcing tool!

26 IVRs and voic Fingerprinting voic systems Default prompts Default mailbox numbers and PINs Admin mailbox Nudges (*8, *81, *, #, 0) Can you find the admin console? CallerID spoofing attacks ANI or CID authentication is very bad! Call forwarding and out-dials Free calls

27 IVRs and voic Launching a PIN brute force attack Things to figure out Dial-in numbers and PIN length Numbering format for mailboxes Method of getting to the PIN prompt

28 PIN brute forcing Metalstorms mighty Hai2IVR SIP-client for brute forcing DTMF prompts Can record calls and scan in parallel GUI for sorting and listening to the results Doubles as PaBX extension war dialer

29 PIN brute forcing Components Hai2IVR GTK interface Handles the parallelization GUI for reviewing results metlodtmfzor Makes the calls and sends the DTMF Command line scriptable Hai2IVR setup Route through Asterisk Authenticated SIP CID spoofing

30 Predictable PINs Keypad patterns Making shapes L, X, O Repeating numbers 2244, 9988 Patterns Other lists Birth dates Pop culture references 1984, 1337 (WiteRabits PIN) Word numbers Hell, love, krad, sexy

31 Predictable PINs

32 Predictable PINs PINPop.com Research project into predictable PINs PIN database analysis Goals Secure PIN selection patches to Asterisk Whitepaper on PIN selection psychology

33 PaBX hacking Attack categories Theft of service Routing manipulation Traffic analysis (stealing CDR s) Social engineering Eavesdropping

34 PaBX hacking The Holy Grail Access to the maintenance console Dial-in lines, extensions, computers Feature exploits Conferencing Three-way calling Call forwarding Direct Inwards System Access (DISA) Test features that remotely activate mics Theft of CDR s Industrial espionage Advanced auditing Free Space Invaders: reverse engineering

35 PaBX hacking Maintenance console banners

36 PaBX hacking A hacked Meridian management console can: Setup trunks to allow outgoing calls Manipulate trunks Re-route incoming / outgoing calls Eavesdrop extensions Set a Meridian Mail box to auto logon temporarily Shut down the PaBX Make phones ring infinitely Trace calls through CDR records Steal CDRs

37 PaBX hacking Lockdown methods Restricted out dialing Forwarding features disabled Enforced minimum PIN size Unused boxes deactivated Lockout counters with manual reset Timeouts on setup of new mailboxes Challenge response systems US Government classified VMSs need SecureID s Logging

38 PaBX hacking CDR s and datamining Sensitive information can be gleaned from call records Who called who and when Current and potential clients, contractors Recent company activities AMDOCS Example Handles billing for most American telcos FBI and NSA investigation into sending CDRs offshore Possibility of Israeli's spying on American's through CDRs

39 The infinite power of Asterisk Custom setups Testing environment for tools Anonymous voic servers Encrypted voice Private networks like DetoVoIP and Telephreak Rogue PaBX s for evesdropping Custom features ProjectMF: A trip down phone-phreak memory lane Asterisk patches to support MF in-band signaling Lets you bluebox telephone calls Simulation of old (but not dead?) networks

40 The infinite power of Asterisk Blueboxing through a ProjectMF test server

41 The infinite power of Asterisk Call the ProjectMF server Get dropped to a C5 trunk Hold the phone up to the speakers Seize the trunk with a 1 second burst of 2600Hz Send KP ST in multi-frequency tones (MF) Call connects Re-seize, repeat

42 Thanks Thanks & greats to: SA.com SLi Andrew Horton Metlstorm Detonate Kiwicon crew Beave Jfalcon M4phr1k

43 NO CARRIER