Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci

•

0 likes•271 views

SIPVicious PRO is a new offensive security toolset for real-time communications (RTC) that aims to be the most powerful toolset. It covers SIP, RTP, STUN/TURN, and other protocols. The demo server provides a playground for testing SIPVicious PRO's attacks and is vulnerable to everything it can test. Future plans include expanding protocol coverage and potentially open sourcing the demo server.

Technology

TOOLS FOR OFFENSIVE
RTC SECURITY
Introducing SIPVicious PRO and the demo server
Sandro Gauci, 2021-04-30

WHO AM I?
Developed SIPVicious OSS
Leading Enable Security:
Offensive RTC security
Security research / penetration testing
Consultancy and training
We develop SIPVicious PRO

CONTRIBUTE TO OPEN SOURCE RTC
SECURITY?
Yes we do!
Security research and advisories
Open-source tools, especially SIPVicious OSS (being
updated)
Our blog - Communication Breakdown at
OpenSIPIt’01
https://rtcsec.com
https://opensipit.org/

PREVIOUSLY AT A DIFFERENT TAD SUMMIT
Why I think defensive security on its own is not
enough
The value of an offensive approach towards RTC
security
Why I think that RTC security lacks this approach:
lack of training opportunities
lack of robust testing tools

AGENDA: WHAT THIS ONE IS ABOUT
A brief look at the RTC offensive security landscape
SIPVicious OSS
SIPVicious PRO
The demo server as your playground
Demos and walk-throughs
Future plans

THE AWESOME RTC HACKING LIST
https://github.com/EnableSecurity/awesome-rtc-
hacking

A LITTLE ABOUT SIPVICIOUS OSS
open-source, published back in 2007
python-based
3 main tools:
svmap which is a scanner for SIP
svwar which enumerates extensions on SIP
devices
svcrack that tries to guess passwords for SIP
extensions

FAST FORWARD TO THE FUTURE (2021)
the future is here

SIPVICIOUS PRO: AN INTRODUCTION
shares the same name as SVOSS
complete new code
covers the entire RTC space not just SIP
aims to be the most powerful offensive RTC security
toolset

SIPVICIOUS PRO: FEATURE-SET
Various new attacks supported e.g.:
SIP ood
RTP ood
Digest leak
RTP Bleed
RTP inject
Fuzzing
Support for SIP over different transport protocols
TCP, UDP, TLS and WebSockets

SIPVICIOUS PRO: FEATURE-SET
Integration within QA , including
CI/CD pipelines
SIP messages may be easily modi ed using a exible
Support for RTP attacks
Insane speed, especially useful for ood attacks with
rate limiting capabilities
Compliance to RFCs
automation systems
templating system

TRAINING
OPPORTUNITIES WITH
THE DEMO SERVER

WHY?
needed a place to show SIPVicious PRO
reliable/deterministic response to attacks

VULNERABLE TO …
EVERYTHING THAT CAN BE TESTED WITH SIPVICIOUS PRO
(and more)
SIP Digest Leak
SIP extension enumeration
SIP password cracking
RTP Bleed
RTP Inject
RTP Flood
TURN proxy abuse

TALK TO ME ABOUT PROTOCOLS
SIP on TCP/TLS/UDP/WebSocket
RTP/SRTP SDES and DTLS
TURN server
WebRTC interface

DEMO SERVER .. DEMO TIME!
https://demo.sipvicious.pro/call/

FUTURE PLANS
SIPVicious PRO covering RTC in general, e.g. adding
coverage of:
XMPP
STUN/TURN
Custom signalling protocols
Keep supporting SIPVicious OSS
Demo server should be open-sourced (put some
pressure on us)

THANKS!
Alfred Farrugia for developing most of SIPVicious
PRO and the very cool web interface for calling over
WebRTC
Pinaki for helping keep SIPVicious OSS alive and
kicking
The TAD audience and Alan for inviting me to talk
about security stuff :)

SOME WAYS TO GET IN TOUCH
Subscribe to our blog at
Enable Security:
https://www.rtcsec.com
sandro@enablesecurity.com
https://enablesecurity.com/#contact-us

A presentation describing two different approaches that we took when making use of fuzzing to discover vulnerabilities in VoIP or Real-time communications software and libraries. We describe our failures and also our successful findings when using AFL and also our custom fuzzer, gasoline against Asterisk, Kamailio, PJSIP, RTP proxy and other solutions. Presentation can be found at https://www.youtube.com/watch?v=CuxKD5zljVI

The OpenSIPS security audit - OpenSIPS Summit - Sandro Gauci

Sandro Gauci

IRJET- A Defense System Against Application Layer Ddos Attacks with Data Secu...

IRJET Journal

IRJET- Sky Shield: A Sketch-Based Defense System against Application Laye...

IRJET Journal

Zaccone Carmelo - IPv6 and security from a user’s point of view

IPv6 Conference

Future Internet Week - IPv6 the way forward: IPv6 and security from a user’s ...

ir. Carmelo Zaccone

This workshop will start with a presentation of results of a study that was conducted for the European Commission on IPv6 and security. This will be followed by presentations from a technology provider who will focus on the security issues related to IPv6. The last presentation will be done by an organisation that has implemented IPv6 and it will share its experiences with the focus on security. At the end of the session, there is a Q&A. http://ipv6-ghent.fi-week.eu/ipv6-security/

Pxosys Webinar Amplify your Security

🏆Ruben Cocheno💭

Cisco and Pxosys teamed up for this Webinar, we will walk you through the Threat Landscape and recent DNS Ransomware cases, and explain why DNS Security is important in your Security Stack within your Organization. We are going to look on a Cisco Umbrella Live Demo and see the potential of the platform from the easy deployment, reporting, and blocking & mitigate Threats from day Zero. A Q&A is going to end the event to clarify any questions that arise during the demo event. Attendees will receive a Cisco Umbrella Free Trial (30 days) at the end of the event. Visit www.pxosys.com to know more about us.

Introduction To NIDS

Michael Boman

In this hands-on workshop you will attack a vulnerable web application while defending your own web service behind a Fastly WAF. Attendees will depart understanding how common web application attacks can be exploited as well defended against. They will experience WAF logging and analytics via sumologic to detect attacks realtime. For mitigation you will use a preview version of our newly built WAF rule management UI. We will close off the workshop by deep diving on how our security team analyzed and mitigated some of this summer major vulnerabilities.

SoHo Honeypot (LUGS)

Michael Boman

Cisco umbrella youtube

Dhruv Sharma

Asterisk WebRTC frontier: make client SIP Phone with sipML5 and Janus Gateway

Alessandro Polidori

AWS live hack: Docker + Snyk Container on AWS

Eric Smalling

ROP ‘n’ ROLL, a peak into modern exploits

Alexandre Moneger

Cisco CSIRT Case Study: Forensic Investigations with NetFlow

Lancope, Inc.

Cisco CSIRT uses NetFlow to collect 16 billion flows from Cisco’s 175TB of traffic observed daily. The data is used to monitor, investigate, and contain incidents using 3 key playbook “plays” each day. Two leaders from Cisco's Computer Security Incident Response Team (CSIRT) will review a real cyber incident and the resulting investigation leveraging NetFlow collected via the StealthWatch System. Participants will learn how to use NetFlow and the StealthWatch System to: Investigate top use cases: C&C discovery, data loss and DOS attacks Gain contextual awareness of network activity Accelerate incident response Minimize costly outages and downtime from threats Protect the evolving network infrastructure Provide forensic evidence to prosecute adversaries

Lancope and-cisco-asa-for-advanced-security

Lancope, Inc.

By collecting and analyzing data from Cisco ASA with Lancope’s StealthWatch System, organizations can: • Increase visibility and security context at the network edge • Consume and stitch together NAT data to more accurately pinpoint the source of issues such as MPAA/RIAA copyright infringements • Audit firewall rules through flow analysis • Achieve better performance and scalability for network and security monitoring • Save vast amounts of time and money spent correlating data points from various sources • More confidently demonstrate compliance with regulations such as PCI

Checkpoint Firewall for Dummies

sushmil123

Vision one-customer

Marie-Agnès PONS

What's New in StealthWatch v6.5

Lancope, Inc.

Lancope’s latest release includes an intuitive Web interface and sophisticated alarming capabilities for enhanced usability, security analytics and early threat detection. The new version further improves incident response and network forensics for fending off today’s advanced attacks. Specific new features include: • The Operational Network & Security Intelligence (ONSI) dashboard, which keeps track of the attacker’s “kill chain,” providing administrators with awareness of how far attacks are progressing within their networks. • New “data hoarding” alarms that detect attackers who are moving stolen data around within internal networks or preparing it for exfiltration. • StealthWatch Labs Security Updates that provide constantly updated, automated security capabilities in the StealthWatch System to detect the latest threats. • User-defined Threat Criteria, which enable administrators to monitor their networks for targeted attack activity based on specific threat intelligence.

Hillstone-Corporate-Overview-EN-V3.0Shamal Abeyrathne

Preparing for the Imminent Terabit DDoS Attack

Imperva

With the rapid growth of volumetric DDoS threats, even the largest networks, equipped with carrier grade hardware and with huge amounts of bandwidth at their disposal, are at risk of being taken down by a large DDoS attack. Volumetric DDoS threats are leading many financial institutions, service providers, and other large organizations on a search for solutions that can scale DDoS protection beyond their existing network capabilities, and into the Terabit level. Learn: - Expected trends in the evolving DDoS landscape over the next 12-36 months - Important considerations when selecting your DDoS protection technology - How to prepare your organization to detect and respond to a DDoS attack

SSL Pinning and Bypasses: Android and iOS

Anant Shrivastava

AWS Cloud Security From the Point of View of the Compliance

Yury Chemerkin

Clouds are finding increased use in core enterprise systems, which mean auditing is the cornerstone expectation. Cloud vendors announce new cloud services, offer new security solutions and refer to the global security standards among of them the requirements look like quite similar. This is series of articles about AWS Cloud Security from the point of view of the compliance to highlight technical requirements of the top Worldwide and Russian security standards for key AWS services, describe how technically prepare to audit and configure AWS services. http://pentestmag.com/pentest-webapp-1212/

CommCon 2023 - WebRTC & Video Delivery application security - what could poss...

Sandro Gauci

WebRTC is often considered to be secure by default - with most security concerns being around IP address leakage which is more of a privacy issue than anything. Well, I have news for you - the applications and infrastructure that handles WebRTC can be attacked. It may indeed have various types of security vulnerabilities which are often overlooked. This presentation is based on experiences gained through security testing of WebRTC applications with anecdotal stories to illustrate the dangers. We will also take a peek at Video Delivery mechanisms such as RIST and SRT and discuss what could possibly go wrong there too!

SIP Beyond Telecom

RADVISION Ltd.

The Session Initiation Protocol (SIP) was originally defined as a protocol for creating and managing sessions. Its main use is for telecommunication applications but given its extensibility and flexibility features it may be used for other implementations as well. Many segments are looking today for their next generation communication and control solutions these include applications such as transportation control, public transportation monitoring, elderly and healthcare applications and home automation. Traditionally most of these segments have been using proprietary implementations but lately we see a growing trend for implementing standard based solutions. RADVISION has gained experience in such solutions. This webinar is delivered by our leading technology and architecture people, people who have taken a significant role in shaping many of the VoIP standards to date. Please join us to gain from their experience and insights.

What's hot

SIP & TLS - Security in a peer to peer world

Olle E Johansson

Sguil

Michael Boman

Cisco, Sourcefire and Lancope - Better Together

Lancope, Inc.

Acid

Michael Boman

SIP & TLS - a very brief overview for the POSH BOF at IETF 87

Olle E Johansson

Altitude San Francisco 2018: WAF Workshop

Fastly

SoHo Honeypot (LUGS)

Michael Boman

Cisco umbrella youtube

Dhruv Sharma

Asterisk WebRTC frontier: make client SIP Phone with sipML5 and Janus Gateway

Alessandro Polidori

AWS live hack: Docker + Snyk Container on AWS

Eric Smalling

ROP ‘n’ ROLL, a peak into modern exploits

Alexandre Moneger

Cisco CSIRT Case Study: Forensic Investigations with NetFlow

Lancope, Inc.

Lancope and-cisco-asa-for-advanced-security

Lancope, Inc.

Checkpoint Firewall for Dummies

sushmil123

Vision one-customer

Marie-Agnès PONS

What's New in StealthWatch v6.5

Lancope, Inc.

Hillstone-Corporate-Overview-EN-V3.0Shamal Abeyrathne

Preparing for the Imminent Terabit DDoS Attack

Imperva

SSL Pinning and Bypasses: Android and iOS

Anant Shrivastava

AWS Cloud Security From the Point of View of the Compliance

Yury Chemerkin

What's hot (20)

SIP & TLS - Security in a peer to peer world

Sguil

Cisco, Sourcefire and Lancope - Better Together

Acid

SIP & TLS - a very brief overview for the POSH BOF at IETF 87

Altitude San Francisco 2018: WAF Workshop

SoHo Honeypot (LUGS)

Cisco umbrella youtube

Asterisk WebRTC frontier: make client SIP Phone with sipML5 and Janus Gateway

AWS live hack: Docker + Snyk Container on AWS

ROP ‘n’ ROLL, a peak into modern exploits

Cisco CSIRT Case Study: Forensic Investigations with NetFlow

Lancope and-cisco-asa-for-advanced-security

Checkpoint Firewall for Dummies

Vision one-customer

What's New in StealthWatch v6.5

Hillstone-Corporate-Overview-EN-V3.0

Preparing for the Imminent Terabit DDoS Attack

SSL Pinning and Bypasses: Android and iOS

AWS Cloud Security From the Point of View of the Compliance

Similar to Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci

CommCon 2023 - WebRTC & Video Delivery application security - what could poss...

Sandro Gauci

SIP Beyond Telecom

RADVISION Ltd.

ABN AMRO DevSecOps Journey

Derek E. Weeks

The various ways your RTC may be crushed

Sandro Gauci

A presentation about Denial of Service on Real-time Communications systems. This presentation covers the following: The presentation, in parts: - DoS on Signalling, including SIP Flood, TCP and TLS Flooding, TLS certificate flooding and a WebRTC proprietary signalling protocol attacked via malformed message - DoS on the Media, including RTP Bleed and Invalid DTLS certificate - DoS on RTC monitoring tools including DoS on Recording systems, on PCAP monitoring and Flooding the firewall - DoS on callbacks including random input and Slowloris attack - DoS on security protection including IP spoofing to block trusted peers and flooding the intrusion prevention system - Tips on evasion of security protection, on rate limiting, distributing attacks and slowing down attacks - Discussion on solutions and mitigation, on rate limiting again, increasing resources, and various other techniques If you'd rather watch this presentation: https://www.youtube.com/playlist?list=PLfoovPTqAipVGa__xPSatN9qKC22nTKl7

INTERFACE by apidays 2023 - The Swiss Cheese Model of Layered API Security, L...

apidays

INTERFACE by apidays 2023 APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization June 28 & 29, 2023 The Swiss Cheese Model of Layered API Security Leon Andrews, Principal, APIs and Product Engineering at Terem ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

WebRTC Videobroadcasting

Ravi Kuril

str-w04_next-wave-of-security-operationalizationpeter lam

The worst of enemies – let’s talk about DDoS and RTC, Sandro Gauci

Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci

Similar to Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci (20)

More from Alan Quayle

More from Alan Quayle (20)

Recently uploaded

Recently uploaded (20)

Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server. Sandro Gauci