|
|
Popular broadband router open to VoIP hijacking
2008-01-22
The vulnerability allows an attacker to initiate VoIP calls on the user's machine. From the end user's perspective, it would appear that the victim is receiving the call from a falsified number that is specified by the attacker. Attackers on the other end could then coax account credentials or other sensitive information from the victim by impersonating a person from a bank, a stock brokerage or some other trusted organization where the call appears to be originating.
"We believe this is gonna be very hot in the VoIP fraud arena," Adrian Pastor, one of the hackers from GNUCitizen, wrote in an email.
BT's Home Hub is one of the UK's most popular home routers, so the report it is susceptible to call tampering is no trivial matter. What's more, the bug can be exploited even if the default password for BT Home Hub has been changed. All that's required for the attack to work is that a BT subscriber who uses VoIP be lured to a website that hosts some malicious code.
The vulnerability is related to a gaping backdoor Pastor and his colleague, Petko D. Petkov, found in October that left users wide open to eavesdropping, caller spoofing and other nasty attacks. A constellation of bugs in the router, which is made by Thomson/Alcatel, made it possible to bypass the device's password authentication system and gain complete administrative control. That in turn could have allowed attackers to steal a user's WPA key, listen in on VoIP calls, steal VoIP credentials or change DNS settings so users are silently redirected to fraudulent websites.
Rather than actually fix the bug that allowed attackers to by pass the router's authentication safeguards, BT simply disabled the Remote Assistance features that allow support professionals to gain administrative control over the device, according to Pastor and Petkov. The removal fixed the original vulnerability, but it did nothing to prevent VoIP hijacking, they say.
"Obviously BT wanted to downplay the whole topic and make it look like it's now safe and fixed," Pastor wrote to El Reg. "Because those 2 issues remain, now we have been able to come up with a new technique to steal VoIP calls."
A BT spokesman contacted outside of business hours in the UK said he was investigating the report, but had no immediate comment.
The VoIP hijacking is made possible by combining a cross-site request forgery bug - which allows the request to make a VoIP call to be forged - with an authentication bypass vulnerability, which allows the attack to skirt the router's password requirements.
Besides phishing attacks, VoIP hijacking could also force victims to call expensive phone numbers under the control of bad guys or open people up to a host of pranks.
The attack is possible on the BT Home Hub running firmware 6.2.6.B, and is likely on other versions. The GNUCitizen report is available here and proof-of-concept code is here. (Note to readers with sleeping housemates: This will cause vulnerable systems to launch a VoIP call.)
Of course, users should be careful not to visit suspicious sites, but given the current state of security, that's not always possible. Recent news reports are chock full of examples of responsible people being redirected to malicious destinations when browsing to trusted sites that have been infected with poisoned scripts and other parasites.
Until BT issues a patch, users can mitigate the risk by using the Firefox browser and the NoScript extension. ®
By Dan Goodin
|
|
|
|
VoIP Providers List Information |
|
|
|
If you have any constructive thoughts, creative ideas, or reasonable offers, please, contact us.
|
|
Send Email to Helen O'Neill if you have any questions either about this website, or about VoIP providers, or VoIP in general.
|
|
Send Email to our technical support if you have any technical queries.
|
About VoIP Providers List
VoIP Providers List services save time for companies searching both for information and interconnection partners, interested in voice minutes exchange, i.e. VoIP minutes termination and origination, as well as hardware and software trade. We provide information on interconnection services, VoIP hardware solutions and VoIP software , as well as overall situation in the VoIP industry.
VoIP Providers List is constantly moderated, and thus we can guarantee that any VoIP provider published in the web-based company catalogue has provided accurate details on its services and operations.
We are constantly working on improvement and development of our services. Your comments and proposals regarding the services are highly welcome. Please, do not hesitate to contact us providing with your ideas, opinion, and feed-back. We will be grateful for any information and useful links on Voice over IP, VoIP hardware, VoIP software, and VoIP Providers. |
|
|
|
|
VoIP Providers Statistics |
|
|
Providers in database: 3315
Users Online: 198
|
|
|
