-- Best Regards, Lance James Secure Science Corporation www.securescience.com
Secure Science Corporation Advisory TSA-052 http://www.securescience.net e-response@xxxxxxxxxxxxxxxxx 877-570-0455 --------------------------------------------------------- Callwave.com customer service automated termination service is vulnerable to caller-ID authentication spoofing, enabling arbitrary termination of customer accounts. --------------------------------------------------------------------- Vulnerability Classification: Authentication bypass, Denial of Service, Misplaced trust. Discovery Date: October 25, 2004 Vendor Contacted: October 25, 2004 Advisory publication date: November 3rd, 2004 Vendor Description: ------------------- CallWave's easy-to-install software helps consumers and businesses get more out of their wireless phone, home phone, and Internet-connected PC by 'bridging' calls between these devices. Millions of households and small businesses have installed CallWave to get important calls instantly no matter where they are, receive faxes on their PC, and even screen out unwanted calls all without purchasing or installing additional hardware. Abstract: --------- Callwave.com grant implicit trust to service subscribers Caller-ID input for customers to terminate their accounts via the automated termination service 800 number. Caller-ID spoofing allows forgery of a calling number to the target number. When spoofing a subscriber number while calling the automated 800 service, the target depends solely on the CID for authentication and grants termination of the customer account associated with the specific number spoofed. Description: ------------ During recent explorations with telephone bridging software, we signed up for the callwave service temporarily. The process to cancel the service when requested directed us to call an automated 800 service from your subscription number. Forging the caller-id and calling the 800 service number enabled the termination request to be successful. It is untested whether CID/CPN spoofing impacts other features of callwave at this time. Tested Vendors: --------------- Callwave.com Vendor and Patch Information: ----------------------------- Secure Science Corporation has made attempts to contact the vendor with no response. Solution: --------- Add 2-factor authentication (passcode requirement) by default and cease implicit trust of Caller-ID information. Alternatively use ANI with 8xx numbers. Credits: -------- Secure Science Corporation: Lance James Disclaimer: ----------- Secure Science Corporation is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Secure Science Corporation products.
Attachment:
signature.asc
Description: OpenPGP digital signature