Original Advisory: Wednesday, August 13, 2003

Severity: Medium - High

Description: An attacker using the VOIP (Voice Over IP) carrier Vonage,

has the ability to spoof the caller ID of a called party through the three-

way calling feature. This trick essentially acts similar to a POTS-based

diverter, as it allows the attacker to carry out illicit telephone

activities while hiding his or her phone number.

Version: This was tested using Cisco Systems' ATA 186 VOIP hardware on the

Vonage carrier.

Author: Nathan Wosnack

Vonage Background:

"Using an existing high-speed Internet connection, Vonage technology

enables anyone to make and receive phone calls - worldwide - with a touch-

tone telephone. Offering quality phone service bundled with enhanced IP

communications services, our interactive communications portal is a

gateway to advanced features only available through digital telephone

service. Utilizing our global network and advanced routing technologies,

Vonage offers an innovative, feature-rich and cost effective alternative

to traditional telephony services."

Description of the problem:

By using SIP-enabled voice over IP (VOIP) hardware such as the Cisco ATA

186 Analog Telephone Adaptor, it's possible to spoof the caller

identification that shows up on a call. The attacker only needs to call up

a regular phone line (POTS - plain old telephone service), place the

caller on hold, flash over to a dial tone using the threeway call feature,

and then call a second party for this to work. The caller ID information

that tends to show up is the first called party's telephone number with

either their name listed or "unknown name" showing on a conventional

caller-id enabled telephone. The opportunity for abuse is high and could

allow the determined attacker to social engineer your telephone, cable, or

utility company into modifying your services. Since many companies only

require the person's name, address, and caller id for account

authentication, this vulnerability helps the attacker. The other

opportunities this vulnerability gives the attacker is the ability to

spoof anyone's caller id information for phone hacking (often

called "phreaking"); such as breaking into voice mail accounts and PBX

exploitation for the purpose of proprietary information gathering and

telephone fraud.

Solutions to the problem:

This issue is something that Vonage will need to investigate on their end.

The proper routing of caller id information after a third-party call is

initiated is the problem, and needs to be resolved by the Vonage IT staff

figuring out why their VOIP switching equipment doesn't pass this data

properly. The Hypervivid Solutions staff has contacted Vonage directly

about this issue, so it can hopefully be resolved shortly.

For everyone else, your best defense is to be aware of who is calling you.

If you happen to receive a phone call from an unknown party who wants to

place you on hold, hang up immediately and then call them back.

If you hear a recording telling you the number is not in service, then

you've likely reached a Vonage gateway number, which mean you were likely

called by someone attempting to exploit this Vonage VOIP vulnerability.

Conclusion:

In the past year, Voice over IP telephony has seen many security issues.

The voip issues range from vendor implementations of the Session

Initiation Protocol (SIP), problems with remote-accessible code which can

be exploited to cause a denial of service, voip phones that are weak in

ways that facilitate man-in-the-middle attacks directed at intercepting

telephone traffic, and most recently 3-way caller ID spoofing on Vonage.

When the information security community works closely with vendors and

carriers, these problems can be resolved quickly and efficiently enough to

limit or even eliminate any abuse by phone phreaks and criminals.

Related Links:

http://www.hypervivid.com/ - Information, Telecom and Wireless Security

Consulting Firm.

Vendor Contact:

http://www.cisco.com/ - Cisco Systems, Inc. Manufacturer.

http://www.vonage.com/ - American Voip telecom carrier.

Have any questions or comments?

e-mail: advisories (at) hypervivid (dot) com [email concealed]

Copyright © 2003, Hypervivid Solutions Incorporated. All Rights Reserved.

[ reply ]