Date 10/04/2012 TB Number TB VoIP Security Threat Reminder

Transcription

1 VOIP SECURITY THREAT REMINDER Bulletin Authorisation Detail Author Andrew Kenyon Authorisation Wilf Wood Date 10/04/2012 TB Number TB Description VoIP Security Threat Reminder Summary Please use this bulletin as a reminder on best practices to secure your OfficeServ 7000 system from VoIP security threats. Avoiding misuse and fraud via your telephone system is a matter that should be planned and controlled during the pre-installation period by customer and dealer, constant monitoring of the system is also advised to detect any misuse subsequent to installation. We are still seeing and hearing of reports where systems and network access equipment such as routers and firewalls are being left in an almost default state, with little consideration for security or where ports are being forwarded without proper consideration of the consequences. System hackers and fraudsters never sleep be aware and stay secure

2 THERE ARE SEVERAL COMMON ATTACK METHODS 1 - THE CONNECTION METHOD FOR H323/SIP TRUNKS CAN BE WITHOUT ANY AUTHENTICATION. This means that if you have a SIP Trunk or H323 Trunk server or rogue device, an illegal attempt to connect to the OS7000 could be made by discovering its IP address. The system can be accessed: 1: From the Local Network 2: The system is directly connected to the Internet 3: If the system is behind a Firewall and the relevant Port forwarding has been programmed. If the system has been compromised, there is now a trunk connection to the system. If a connection is established an inbound call could then be made to the system. This call would then follow the DDI table routing. What does this mean? As the system is being sent multiple SIP/H323 calls these calls are busying out your SIP/H323 trunks, effectively a Denial of Service attack resulting in potential loss of business. Furthermore, if connected they can then dial any digits matched in the DDI table and reach that destination. 2 SIP EXTENSIONS Hackers can send multiple usernames and passwords in an attempt to register a sip device to the system. What does this mean? As the fraudsters are sending multiple username and passwords your system has to process all these messages, again effectively a Denial of Service attack. If they manage to hit a valid username and password they then have an extension registered to the system and can then make calls. 3 ISP ACCOUNT DETAILS SIP ISP account details are encrypted using an industry standard protocol by the OfficeServ If a customer s ISP account details have been fraudulently obtained, the user s details can be used illegally without restriction.

3 What does this mean? The hacker now has your username and password. They can now register your account from wherever they want and make calls. PREVENTION Firewall If you are not using SIP and/or H323 do not forward the relevant ports. To confirm the port forwarding for H323 and SIP is as follows: H , 1720 Used for setting and maintaining the connection SIP 5060 For connection setup THE OTHER PORTS REQUIRED FOR IP CONNECTIVITY ARE AS FOLLOWS: General: to 30xxx UDP to the MGI/OAS card for Voice. Even port : Odd Port RTP (Real Time Transport Protocol) for each MGI Channel : RTCP (Real Time Transport Control Protocol) for each MGI Channel to 40xxx UDP to the MGI/OAS card for Voice when using MPS. Even port : RTP (Real Time Transport Protocol) for each MGI Channel Odd Port : RTCP (Real Time Transport Control Protocol) for each MGI Channel to 45xxx UDP to the MGI/OAS for RTG SPNET 6100 Used for setting and maintaining the connection Remote ITP 6000 UDP Signalling to system processor 9000, 9001 RTP, RTCP Voice data for MGI or ITP If you are using SIP/H323 trunks the providers are usually from a dedicated public IP address. The firewall therefore is configured to only accept traffic on these ports from the IP Address of your service provider.

4 OfficeServ SIP Trunks Comm Exclusive MMC837/DM You can set the OfficeServ to only accept SIP trunk traffic from specific IP addresses: There are three settings: None Allow SIP trunk traffic from any IP address Response Only allow SIP Trunk traffic from registered IP addresses but respond to the request with the SIP message 403 rejecting the call No Response 7400 only Only allow SIP Trunk traffic from registered IP addresses, do not send a response and block traffic from the originating IP address To register IP address the OfficeServ will allow traffic from IP addresses in: nregistered sip station ip address (DM 6.2.3) MMC842 nvoip peering ip addresses (DM ) MMC833 ncarriers ip addresses (DM ) MMC837 Remote access via IT Tool/Device Manager If you forward port 5090 for remote access to the OfficeServ then again the whole world can try and connect the programming tool to your system.

5 What does this mean? If you have left the login in default settings anybody with IT Tool or Device manager has access to all the programming and then your SIP accounts. If the remote programming software has been amended by a potential hacker a brute force attack with multiple usernames and passwords could be attempted. If they can connect then all your SIP accounts details can copied then be registered anywhere and used to make calls. Your system could be completely reprogrammed or defaulted, passwords changed so that you no longer have access to the system. Remote Access Port 5090 should be firewalled to only allow traffic from specific IP addresses. Only addresses that you will be connecting from to remote programme, for example your office. If you remote in from random IP address then a VPN connection should be configured