Vulerability test system for SIP etwork elemets Filip Rezac, Miroslav Vozak, Karel omala, Jiri Vychodil, Ja Rozho Departmet of elecommuicatios, VSB echical Uiversity of Ostrava Ostrava, Czech Republic Email: filip.rezac@vsb.cz, miroslav.vozak@vsb.cz, karel.tomala@vsb.cz, jiri.vychodil@vsb.cz, ja.rozho@vsb.cz Abstrakt he SIP server, as well as other servers providig services i exposed etwork, ofte becomes the aim of attacks. he article describes a web-based system of vureability ad peetratio tests which was developed as a tool for testig whether the key compoet of the VoIP SIP ifrastructure is adequately safeguarded ad secured agaist the most widespread security threats. he tests represet a group at oce the most used ad effective attacks owadays, they eable to compose the aalysis of security risks ad to poit out the weakesses of the tested system. he paper also icludes the descriptio of applicatios ad algorithms that are used for the tests geeratig. he system is desiged as a modular web applicatio, which eables a access without depedacy o operatig system ad addig ext test modules. At the ed, the results achieved i practical testig are sumarized ad ext fuctios suitable for the future system extesio are proposed. 1 Itroductio Systems desiged to test ad moitor etworks or other compoets are quite wide-spread these days. Examples of the priciple oes are Nessus [1], Retia [2], Sort [3] ad other. he majority of these systems allows for testig the whole etwork ifrastructures ad protocols used for commuicatio betwee compoets. Noe of these solutios, however, eables a complex testig of VoIP ifrastructure ad SIP servers which are the key ad most vulerable compoet of the etwork. he system we developed, uder a workig title SP (SIP Peetratio estig), was desiged as a peetratio tests simulator for SIP servers. Based o the aalysis of itersectios, the perso who iitiated the testig ( the tester ) receives feedback i the form of test results, as well as recommedatios how to mitigate potetial security risks that were discovered. he advatage of this solutio is that the system simulates real attacks from the exteral etwork, i.e. the system does ot eed to be placed i the same etwork as the target compoet DU (Device uder est). his is frequetly oe of prerequisites to be able to use other testig tools. he SP system was desiged ad implemeted primarily to test SIP servers. he system itself was developed as a web applicatio accessible through a stadard web browser ad therefore idepedet o the operatio system s platform. As the solutio was developed as a part of the research itet of the CESNE associatio, this system will also be icorporated ito its etwork ad will be accessible after sigig i usig the SSO (Sigle Sig-O) service - Shibboleth [4]. his should also prevet the system beig used for other tha testig purposes. Oce siged i, the tester eters the required data ito a web form ad chooses tests to be ru. he output of the applicatio oce the tests have bee completed is a e-mail report to the tester. his report cotais the results of the tests; ad i case some peetratios were successful it also cotais recommedatios ad measures to mitigate such attacks i the future. Figure 1 illustrates the cocept of the SP system. he followig chapter describes idividual testig methods i detail, their implemetatio, algorithms used ad the impact o the target SIP server. 2 echology Used, Algorithms ad Performace Although the system is primarily desiged for peetratio tests o SIP servers, i reality it ca perform full-scale attacks o a particular compoet ad provide feedback o it to the tester. hus, it is ecessary to esure that the developed system caot be abused by a third party. he system was desiged as a LAMP (Liux, Apache, MySQL, PHP) server [8] ad its complete admiistratio icludig the istallatio is carried out via a web iterface. For reasos stated above, the system will be icorporated ito the CESNE s etwork ad will oly be accessible to authorised persos oce they pass through the autheticatio. Oce the tester fills i the IP adess or domai ame of the cetral SIP server ad the email adess to which the test results will be set to. Usig checkboxes, the tester may defie the rage of the modules offered for testig. Idividual modules are described below i detail. 2.1 Scaig ad Moitorig Module I order to be able to carry out a efficiet ad precise attack o a SIP server, the potetial attacker eeds to fid out the most iformatio about a particular compoet. his is why we first developed a Scaig ad Moitorig ( S&M ) module for the SP system, which is used to test the security of the cetral agaist attacks aimed at obtaiig iformatio by meas of commo ad available tools (Figure 2). hese tools iclude for istace Nmap [9] or ever more popular SIPvicious [10]. SP system also uses these testig tools. By meas of these tools, it is possible to obtai a list of listeig ports or a list of user accouts created o the cetral cocered from a usecured server. Where the server is ot secured sufficietly, they ca obtai eve the most importat, that is passwords to idividual accouts. If the tester ticks the 36
test to be carried out, the Nmap applicatio is used first to establish ope ports. Give the time requiremets of the [s] test, the testig is Number of accouts E is derived from equatio (2) where E i is the umber of accouts that have bee reviewed by the system but ot defied o the SIP server. E = E + E ) E ( (2) i able 1: Udpflood est ime Duratio with Differet Badwidth ad Number of Geerated Packets by default restricted oly to several most frequetly used ports. Usig the web form, the tester ca set the rage of the tested ports. However the total time set for testig usig Nmap is 1800s (30 miutes). he list of available ports is subsequetly icluded i the asseset report together with recommedatios how to miimise such ports scaig. Aother test which the SP system ca carry out aims at establishig whether SIP server s security allows for obtaiig a list of user accouts. For this purpose, SIPvicious is used. By sedig out OPION ad ACK requests, the applicatio detects what accouts are defied o the SIP server. By default, the system tries the 100-999 rage of accouts. Agai, the tester may defie ow rage of tested umbers E or import a text file cotaiig strigs of alpha-umeric characters or words E. ime required to check ad create a list of e [s] accouts ca be expressed by equatio (1) where c = 0.02603 is a time costat obtaied by repetitive measuremets o a sample of 1000 potetial accouts o differet target SIP servers. e Figure 1: SIP Peetratio ests System Scheme = E + E ) c ( (1) Figure 2: SP System S&M Module Oce the system has tested security of the SIP server agaist detectig accouts, possibility to detect passwords for idividual accouts is tested. Agai, this testig is carried out by SIPvicious. Usig a pre-defied rage of possible umeric passwords P or a imported text file with alpha-umeric characters or words P, it obtais a list of passwords for idividual accouts. ime requiremets o this test are expressed by the followig equatio (3). Number of Badwidth [Mbps] ad the Attack ime udp [s] Packets P 10 25 50 100 100 000 113,12 45,25 22,63 11,31 200 000 226,24 90,50 45,26 22,62 300 000 339,36 135,75 67,89 33,93 400 000 452,48 181 90,52 45,24 500 000 565,60 226,25 113,15 56,55 600 000 678,72 271,5 135,78 67,86 700 000 791,84 316,75 158,41 79,17 800 000 904,96 362 181,04 90,48 900 000 1018,08 407,25 203,67 101,79 1 000 000 1131,20 452,5 226,3 113,1 p [ E P + P ] c = ) e p ( (3) + + = (4) Now we ca determie the estimated time required to carry out the complete S&M test (4). Usig the module, we ca verify whether the target SIP server is sufficietly secured agaist such scaig ad moitorig attacks. 2.2 Deial of Service Module Oe of the most frequetly occurrig attacks is DoS (Deial of Service). I reality, it cosists of several attacks with the same characteristic feature to lock up or restrict the availability of the attacked service so that it does ot fuctio properly. Several types of DoSs [11] ca be used to achieve this; our system tests the SIP server usig the most frequetly used oe, Flood DoS. he priciple of the attack is to sed a large volume of adjusted or otherwise deformed packets to the target compoet so that it is uable to provide its core services. As a result of the attack, CPU load icreases ad most of the available badwidth is cosumed, resultig i the SIP server beig uable to service regular calls, or oly a miimum amout of them. 37
o geerate Flood DoS, the SP system uses two applicatios: udpflood [12] ad iviteflood [12]. Whe usig udpflood, the system geerates UDP packets of 1400 bytes which are directed at SIP default port 5060 of the target SIP server. he tester defies the umber of geerated packets ad the system tests whether the packets arrived at the SIP server ad whether they cause some restrictio of the service availability, see Figure 3. Sice we kow the packet s size ad therefore also the size of the Etheret framework Fs udp, we ca, based o the umber of geerated packets P ad the badwidth provided the test (5). B, determie time w udp [s] required to carry out viteflood, is used for testig, the system geerates INVIE requests at the SIP server which are directed at a existig accout. his method is very successful as most of today s SIP servers require a autheticatio for INVIE requests. able 2 provides a overview of time-cosumig usig iviteflood test ad time-cosumig compariso of these two applicatios o differet umber of geerated packets at a badwidth of 100Mbps is the show o Figure 4. As the INVIE requests geerated by our system do ot cotai ay autheticatio strig, the SIP server returs SIP aswer 407 Proxy Autheticatio Required. With the large volume of icomig requests, the load of SIP server s CPU icreases. he tester ca set the value of a accout i the system maually, or it ca be radomly selected from the previously obtaied list of accouts E. As i the previous case, we ca, based o the umber of geerated packets P ad the badwidth provided B, determie time [s] required to carry out the test (6). w ivite Figure 3: SP System DoS Module = ( Fs P ) / B (5) udp udp w able 2: Iviteflood est ime Duratio with Differet Badwidth ad Number of Geerated Packets Number of Badwidth [Mbps] ad the Attack ime udp [s] Packets P 10 25 50 100 100 000 91,2 36,48 18,24 9,12 200 000 182,4 72,96 36,48 18,24 300 000 273,6 109,44 54,72 27,36 400 000 364,8 145,92 72,96 36,48 500 000 456 182,4 91,2 45,6 600 000 547,2 218,88 109,44 54,72 700 000 638,4 255,36 127,68 63,84 800 000 729,6 291,84 145,92 72,96 900 000 820,8 328,32 164,16 82,08 1 000 000 912 364,8 182,4 91,2 able 1 provides a overview of time required usig udpflood test for differet umbers of geerated packets P ad w differet badwidth B.Whe the other applicatio, i- Figure 4: Udpflood ad Iviteflood Applicatios imecosumig Compariso with Differet Numbers of Geerated Packets ad 100 Mbps Badwidth = ( Fs P ) / B (6) ivite ivite w Figure 5: Impact of chage i badwidth o CPU load i case of udpflood attack Figure 5 illustrates the impact of the chage i badwidth o CPU load whe simulatig a udpflood attack. he chart also clearly shows resistace of the two popular ope-source SIP servers, Asterisk PBX [5] ad OpeSIPS [6, 7], to UDP Flood DoS attacks. Both cetrals have bee istalled o the same HW of Dell PowerEdge R510 server to elimiate ay 38
potetial differece i computatioal performace. o chage badwidths, we used HW emulator of the Simea etworks. CPU load o idividual cetrals was measured by meas of dstat [13]. he chart shows that OpeSIPS is may times more resistat to UDP DoS attacks tha Asterisk. otal time required to carry out DoS tests is determied as follows (7). + dos udp ivite dos = (7) oday, oe of the most popular attacks o the Iteret is spam. It is estimated that spams accout for 80-90% of total attacks o the Iteret. Security experts predict that Spam over Iteret elephoy (SPI) will be a major threat i the future. he level of aoyace is eve greater tha with classical spam. Out team i CESNE had developed SPIFILE [14] which served as a testig tool while developig security agaist such type of attacks. he SP system uses the core of this applicatio, together with Sipp [15], to simulate a SPI attack o the target SIP server (Figure 7). I the form, the tester defies the value of a SIP accout the called party to which the SPI call will be directed ad the the value ad password to a SIP accout the caller through which the call will be iitiated. Where the tester fails to defie these values, the system automatically assigs a accout ad a appropriate password from the list created while scaig ad moitorig the cetral. Results ad success rate of DoS tests carried out are icluded i the report for the tester. 2.3 Registratio Maipulatio Module Oce the potetial perpetrator obtais iformatio about existig accouts, he ca maipulate these accouts quite easily. he SP system we developed ca also test SIP servers security, i.e. measures agaist maipulatig the registratio, see Figure 6. Figure 6: SP System RM Module o carry out this test, the system uses reghijacker [12] which substitutes the legitimate accout registratio with a fake, o-existig oe. his type of attack ca easily be expaded to a so called MIM, Ma-i-the-Middle [11]. I this attack, a o-existet user is substituted by a SIP registratio ad all icomig sigallig ad media to the legitimate registratio will be re-directed to the ewly created registratio. I this case, the tester eeds to defie the value of the SIP accout which is to be stole i the system ad where autheticatio of REGISER request is allowed, also a password to this accout. Where the tester fails to defie these values, the system automatically assigs a accout ad its password from the list created while scaig ad moitorig the cetral. ime required to carry out the test is isigificat compared to operatioal times of other modules. 2.4 SPI Module rm Figure 7: SP System SPI Module If the attack was successful, a SIP call is iitiated from the caller s accout, ad the ed device with the registered accout of the called party starts rigig. Oce the call is aswered, a pre-recorded message is played ad the call termiated. ime required to carry out the test is determied by the legth of the pre-recorded message. he fial report o peetratio tests which the tester receives via e-mail, will, besides iformatio o all previous tests, also cotai a aalysis ad success rate of the SPI module s test. Figure 8: Divisio of the SP system ito idividual modules Figure 8 illustrates the divisio of the SP system ito idividual modules ad shows time itervals ecessary to carry out idividual tests i respective modules. ime requiremets of the whole SP system ca be expressed by equatio (8). Its value depeds o may factors ad ca radically chage i accordace with the type of tests requested by the tester. Its value is for referece oly. + + + spt = (8) dos rm spit spit 39
3 estig ad Coutermeasures Although the SP system is still i the phase of itesive testig ad developmet, basic operatioal tests of all available modules were carried out. Each test is accompaied by a short descriptio of coutermeasure s priciples ad methods [12] which should limit or completely mitigate potetial security gaps that were revealed durig SIP server s testig. from a attack. I this case, there is recommeded to divide the ifrastructure ito idividual VLANs so that the detectio for itruder was as difficult as possible. 3.2 Deial of Service Module estig ad Coutermeasures Usig udpflood, the tester set 500000 UDP packets directly to port 5060. Badwidth was set to 100Mbit/s, Asterisk processed 90% calls. Oce the test was completed, Asterisk recovered to a full operatio mode. o be able to compare, we substituted Asterisk by OpeSIPS i this test. Call processig uder the same attack was etirely error-free. Whe testig usig iviteflood o the accout 7001, we foud out that this attack is much more destructive i terms of computatioal power. As early as at 100000 INVIE request whe ivite 9s, CPU load for both Asterisk ad OpeSIPS reached 100% ad failed to process a sigle icomig or outgoig call. Oce the test was completed, both cetrals recovered to a full operatio mode (Figure 10b). Figure 9: SIP Peetratio ests System estbed Figure 9 describes the basic testig topology. he system rus at IP adess 195.113.113.137, IP adess of Asterisk (VoIP PBX) is 158.196.81.205. Asterisk was istalled at Dell PowerEdge R510 server. 3.1 Scaig ad Moitorig Module estig ad Coutermeasures he first step was to record SIP server s IP adess ad the e- mail adess to sed the fial report to. Next, the S&M module ad subsequetly Nmap ad SIPvicious applicatios were lauched. Values for Nmap were set by default, value of E for SIPvicious was set to rage betwee 1000-9999. he device foud all three registered accouts E 7001-7003 ad listed ope CP ad UDP ports at Asterisk. Oce P was set to 7001-7003 ad a text file P cotaiig test ad 7003ab strig, the test to obtai passwords to idividual accouts was also successful (Figure 10a). otal time icurred o testig module 235s. If we had to protect ad prevet SIP server from scaig ad moitorig, the a implemetatio of firewall is the effective solutio or a itrusio detectio system that is able to distiguish scaig ad moitorig. he ext effective solutio is to divide the etwork logical ifrastructure ito VLANs ad decompose the provided services ito more physical servers (FP, HP servers). he prevetio of accouts ad passwords detectio is difficult, moreover, the tools for detectio apply the stadard SIP methods ad is ot trivial to distiguish legitimate behaviour Figure 10: SIP Peetratio ests System estbed. a) Scaig ad Moitorig ests, b) DoS ests, c) Registratio Maipulatio ests, d) SPI ests he possibilities, how to protect from Flood DoS attacks, are the followig: to divide the etowork ifrastructure ito separate VLANs, to have i use solely LS, to implemet L2 etwork elemets with DoS detectio or to apply SIP firewall that ca detect DoS attacks ad miimalize their impact. 3.3 Registratio Maipulatio Module estig ad Coutermeasures Whe testig possibility for registratio maipulatio, we etered values of accout 7003 ad its password 7003ab maually ito the system. Oce the test was completed, we established whether the attack was successful. he aim of the attack was to de-register accout 7003 ad to direct all icomig calls to a fake accout which does ot exist. hus, calls were 40
termiated as ucoected. he call to 7003 was ot put through, see Figure 10c. he CP protocol is recommeded at trasport level to prevet a registratio hijackig because the maipulatio with CP requires higher complexity. Next optio, how to miimalize this threat, is to use REGISER message autheticatio. We could decrease the registratio iterval, as well, it is quite simple but effective. 3.4 SPI Module estig ad Coutermeasures As stated above, we used SPIFILE applicatio, developed by this paper s authors, to test the cetral s vulerability to SPI attacks. he tester etered maually ito the system the value of a accout 7002 o which a SPI attack was to be iitiated, as well as the value of a accout 7003 ad password to it (7003ab) which was supposed to iitiate the SPI call. Oce the test was lauched, SPIFILE registered o the participat 7003 ad the started to geerate a call to accout 7002. he ed device registered o 7002 bega rigig, ad oce the call was aswered, a recordig with a advertisemet was played (Figure 10d). A few methods exist how to restrict the SPI propagatio, which are more or less efficiet, but their combiatio brig quit strog protectio agaist the type of attack. Amog these methods the utilizatio of the various automatically or maually editable lists belog, o their base the call is permitted or prohibited, evetually a iteractio with voice meu ca be the effective protectio agaist call bots. Authors developed ow solutio ANISPI [14] that exploits the specific huma behaviour ad automatically modifies the Blacklist table without participatio of called party, the approach is based o the statistical Blacklist. Refereces [1] R. Rogers, Nessus Network Auditig. Sygress, 2d editio, 2008. [2] R. Chocheliski ad I. Baroak, "Private elecommuicatio Network Based o NGN", I 32d Iteratioal Coferece o elecommuicatios ad Sigal Processig, 2009, Duakiliti, HUNGARY, pp. 162-167. [3] J. Bates, C. Gallo, M. Bocci, S. Walker ad. aylor, "Coverged Multimedia Networks", Wiley, 364 p., 2006. [4] M. Vozak, Voice over IP. VSB-echical Uiversity of Ostrava: College extbook, 1st. ed., Ostrava, 2008. [5] S. Witermezer ad S. Bosch, Practical Asterisk 1.4 ad 1.6: From Begier to Expert. Addiso-Wesley Professioal; 1 editio, 2009. [6] F. Gocalves, "Buildig elephoy Systems with OpeSIPS 1.6", Packt Publishig, 274p., 2010. [7] D. Sisalem, J. Floroiu, J. Kutha, U. Abed ad H. Schulzrie, SIP Security, Wiley, 350p., 2009. [8] J. Lee ad B. Ware, Ope Source Developmet with LAMP: Usig Liux, Apache, MySQL, Perl, ad PHP, Addiso-Wesley Professioal, 2002. [9] G.F. Lyo, Nmap Network Scaig: he Official Nmap Project Guide to Network Discovery ad Security Scaig. Nmap Project, 2009. [10] M. Vozak ad J. Rozho, SIP Ifrastructure Performace estig, I 9th Iteratioal Coferece o elecommuicatios a Iformatics, Cataia, Italy, 2010, pp. 153-158. [11] F. Rezac, M. Vozak ad J. Ruzicka, "Security Risks i IP elephoy", I CESNE Coferece 2008, 2008, Prague, pp. 31-38. [12] D. Edler ad M. Collier, Hackig Exposed VoIP: VoIP Security Secrets ad Solutios. McGraw-Hill Compaies, 2007. [13] I. Pravda ad J. Voazka, Voice quality plaig for NGN icludig mobile etworks, 12th Iteratioal Coferece o Persoal Wireless Commuicatios (PWC 2007), 2007, Prague. [14] M. Vozak ad F. Rezac, he implemetatio of SPAM over Iteret telephoy ad defece agaist this attack, preseted at SP 2009: 32d Iteratioal Coferece o elecommuicatios ad Sigal Processig, Duakiliti, HUNGARY, Aug 26-27, 2009, pp. 200-203. 4 Coclusio ad Future Work he aim of the authors was to develop a tool to carry out peetratio tests o SIP servers. he system that was desiged ad implemeted cosists of several modules that are able to geerate selected types of attacks which the authors deem most popular. he system the aalyses to what extet is the target compoet secured, afts assesets cotaiig tests results ad proposes factual recommedatios to esure security agaist the threat cocered. he asseset report is set as a text documet to a e-mail. he system is curretly uder itesive testig. It is plaed that i the future, it will be exteded to iclude other testig modules ad fuctios such as for istace testig of the whole VoIP ifrastructure ad heavy testig of idividual compoets. Ackowledgmet his project has bee supported by a research itet Optical Network of Natioal Research ad Its New Applicatios (MŠM 6383917201). he report icludes the result achieved by authors i a research activity Multimedia traissios ad collaborative eviromet, http://www.ces.et/project/15. 41