full-disclosure - ASN.1 telephony critical infrastructure warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040218044148.GA22862@mikompaq.ipsystems.com.au>
From: michael at miknet.net (Michael Samuel)
Subject: ASN.1 telephony critical infrastructure warning - VOIP

Hi,

I work for a VoIP provider, and I thought I'd clear up a few points:

If desktop PCs have access to the PSTN via VoIP, it's entirely
possible for a worm (or intruder) to use the PSTN as that VoIP user.
(That could be used for a telemarketing worm or a DDoS on somebody's
phone pool, I guess)  This is regardless of which vulnerability the worm
uses.

This is made worse because some VoIP software (well, at-least one SIP
based VoIP package) disables authentication by default when adding a
user, and makes you jump through hoops to enable it.

Yet this is mostly mitigated because almost all VoIP infrastructure is
on a separate network (generally controlled by vlans and some sort of
VPN technology), which can't be accessed by desktop PCs. I beleive this
is pretty-much standard with Cisco equipment.  So, assuming the router
and switching hardware is secure and properly configured, an Internet
worm can't get to your VoIP network (or even DoS it).

That's not much comfort for those accessing a Internet->PSTN VoIP
provider (rather than just an IP Centrix or IP PBX VoIP network), but
the risk there is no greater than online shopping/banking. (Assuming
you're using a secured VoIP protocol - and you're probably NOT)