RE: [Full-Disclosure] ASN.1 telephony critical infrastructure warning - VOIP
I would like to answer you all together, as I was the one who started this
thread,
ASN1 is a simple data encapsulation, the problem occurs when the
decapsulation procedure fails because of any reason.
in the case at hand, the data slips into the code segment.
My intention was not a worm that spreads by ASN1 but one that locates VoIP
based communication and attacks it !
you can do a lot by inserting code into these devices that are software
driven !
Here is a simple description of the h323 protocol, BASED ON ASN1, feel free
to access any one of these items and use the exploit :-)
End-Point:
q931 - port 1720 - initial hand shake
h225 - port 1720 - media capabilities negotiations for h245
h235 - port 1720 - negotiate security
h245 - dynamic port - negotiate media real-time protocol, and
data channel
h45x - Waiting call, pressed keys (to save line bandwidth),
etc.
. RTP - (Real Time Protocol) dynamic ports UDP/TCP- transfer
media codecs
(video and audio), T38 (fax), T120 (data)
T120 - Send files, share documents, etc. - implemented in
netmeeting
GateKeeper:
H324 - Authenticate user for call
* Long time didn't touch the VoIP so forgive me if I had a mistake somewhere
in the Hxxx.
Companies today have introduced the VoIP into their systems to save
telephony resources, calls between offices and to manage&control their
equipment (Telephony Service Providers)
a worm can nest until it will find a VoIP infrastructure and attack, if it
is "smart" it will take access of the infrastructure !
There is usualy a DIRECT CONNECTION between the internet --> LAN --> VoIP
equipment !
In my humble opinion, we're not going to see an outbreak but some surgical
attacks.
I must underline that I don't know if all use the same parser, BUT, let me
refer you to Berkley's SNMP protocol precedent that was copied and pasted
everywhere with the exploit inside ...
Sincerely,
Zak Dechovich,
Managing Director
SecureOL Ltd.
Mobile: +972 (53) 828 656
Office: +972 (2) 675 1291
Fax: +972 (2) 675 1195
-----Original Message-----
From: Michal Zalewski [mailto:lcamtuf@xxxxxxxxxxx]
Sent: Tuesday, February 17, 2004 6:23 PM
To: Gadi Evron
Cc: bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxx; Zak
Dechovich
Subject: Re: [Full-Disclosure] ASN.1 telephony critical infrastructure
warning - VOIP
On Tue, 17 Feb 2004, Gadi Evron wrote:
> ASN is what VOIP is based on, and thus the critical infrastructure for
> telephony which is based on VOIP.
>
> This may be a false alarm, but you know how worms find their way into
> every network, private or public. It could (maybe) potentially bring the
> system down.
Balooney. ASN.1 is not a network service, is a notation standard used in,
among other things, some network protocols. A worm that targets one of the
protocols, if is going to show up at all - some disagree with your
assessment the vulnerability is "very easy to exploit", so perhaps it
would be good to substantiate your claim - would not magically start
attacking a wholly different protocol, where ASN.1 is used in a different
way, just like this.
Such a worm would have to target VoIP specifically to attack it
successfully (and this is unlikely, as this is not a vector commonly open
on desktop systems), for starters. Even then, a relatively small
percentage of all VoIP applications, particularly the mission-critical
ones, are running off of Windows, I suppose. The world is not going to end
tomorrow.
That is no say there is no risk; quite the opposite. An aggressive worm
may quite efficiently bring down large parts of critical infrastructure by
simply overloading systems and networks. But then, it would be no
different from Nachi and whatnot, and there's nothing about ASN.1 to it.
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-02-17 17:17 --
http://lcamtuf.coredump.cx/photo/current/