This document discusses VoIP security and contains the following: 1. It introduces VoIP components and protocols like SIP, H.323, and RTP. 2. It describes recent VoIP attacks like phone scams and using default credentials. 3. It outlines security tools and techniques for analyzing VoIP vulnerabilities and demonstrates attacks.

1. “Seguridad” VoIP Giovanni Cruz Forero @fixxx3r

2. ThinkEvil

3. Agenda Intro Protocolos Ataques Recientes Herramientas Demo # 1 Demo # 2 Demo # 3

4. Intro

5. VoIP

6. Componentes Endpoints (Softphones, Hardphones) IP PBX Base de Datos Servidores Web Sistemas Operativos H.323 Gatekeeper SBC PSTN B2BUA UAS UAC SIP Proxy SIP Registrar Softswitch Media Gateways Location Server Directorio

7. Protocolos

8. H.323

9. SCCP

10. XMPP / Jingle

11. IAX

12. SIP PETICIONES INVITE ACK BYE CANCEL REGISTER OPTIONS RESPUESTAS 1XX – Provisionales 2XX – Exitosa 3XX – Redirección 4XX – Error de cliente 5XX – Fallas del Servidor 6XX – Fallas Globales

13. Registro Bob SIP Server | | | REGISTER F1 | |------------------------------>| | 401 Unauthorized F2 | |<------------------------------| | REGISTER F3 | |------------------------------>| | 200 OK F4 | |<------------------------------|

14. F1 REGISTER Bob -> SIP Server REGISTER sips:ss2.biloxi.example.com SIP/2.0 Via: SIP/2.0/TLS client.biloxi.example.com:5061;branch=z9hG4bKnashds7 Max-Forwards: 70 From: Bob <sips:bob@biloxi.example.com>;tag=a73kszlfl To: Bob <sips:bob@biloxi.example.com> Call-ID: 1j9FpLxk3uxtm8tn@biloxi.example.com CSeq: 1 REGISTER Contact: <sips:bob@client.biloxi.example.com> Content-Length: 0

15. F2 401 Unauthorized SIP Server -> Bob SIP/2.0 401 Unauthorized Via: SIP/2.0/TLS client.biloxi.example.com:5061;branch=z9hG4bKnashds7 ;received=192.0.2.201 From: Bob <sips:bob@biloxi.example.com>;tag=a73kszlfl To: Bob <sips:bob@biloxi.example.com>;tag=1410948204 Call-ID: 1j9FpLxk3uxtm8tn@biloxi.example.com CSeq: 1 REGISTER WWW-Authenticate: Digestrealm="atlanta.example.com", qop="auth", nonce="ea9c8e88df84f1cec4341ae6cbe5a359", opaque="", stale=FALSE, algorithm=MD5 Content-Length: 0

16. F3 REGISTER Bob -> SIP Server REGISTER sips:ss2.biloxi.example.com SIP/2.0 Via: SIP/2.0/TLS client.biloxi.example.com:5061;branch=z9hG4bKnashd92 Max-Forwards: 70 From: Bob <sips:bob@biloxi.example.com>;tag=ja743ks76zlflH To: Bob <sips:bob@biloxi.example.com> Call-ID: 1j9FpLxk3uxtm8tn@biloxi.example.com CSeq: 2 REGISTER Contact: <sips:bob@client.biloxi.example.com> Authorization: Digestusername="bob", realm="atlanta.example.com" nonce="ea9c8e88df84f1cec4341ae6cbe5a359", opaque="", uri="sips:ss2.biloxi.example.com", response="dfe56131d1958046689d83306477ecc" Content-Length: 0

17. F4 200 OK SIP Server -> Bob SIP/2.0 200 OK Via: SIP/2.0/TLS client.biloxi.example.com:5061;branch=z9hG4bKnashd92 ;received=192.0.2.201 From: Bob <sips:bob@biloxi.example.com>;tag=ja743ks76zlflH To: Bob <sips:bob@biloxi.example.com>;tag=37GkEhwl6 Call-ID: 1j9FpLxk3uxtm8tn@biloxi.example.com CSeq: 2 REGISTER Contact: <sips:bob@client.biloxi.example.com>;expires=3600 Content-Length: 0

18. SDP

19. RTP

21. Ataques

24. PhoneScam

26. Amazon EC2

27. Contraseñas por defecto….

29. Fácil…. Fuente: http://amitay.us/blog/files/most_common_iphone_passcodes.php

30. Fraude Teléfonico

31. + Fraude

32. Herramientas

35. DEMO # 1

36. DEMO # 2

37. DEMO # 3