[ISN] Hacking the lobby telephone

[InfoSec News <alerts@xxxxxxxxxxxxxxx>]

http://www.news.com/8301-10789_3-9873864-57.html

By Robert Vamosi
Defense in Depth
February 17, 2008

WASHINGTON -- Two security researchers at ShmooCon demonstrated on 
Saturday how a laptop connected to a VoIP telephone could, in some 
cases, expose a business' internal network to outsiders.

John Kindervag, senior security architect for Vigilar, said that public 
waiting areas in hospitals, conference rooms, and hotel rooms are 
particularly vulnerable to this attack since often there is no IT staff 
around. Appearing on stage at the East Coast computer hacker conference 
with Kindervag was Jason Ostrom, manager of Vigilar's Vulnerability 
Assessment and Compliance Practice team, who used the ShmooCon 
conference to show off his latest version of VoIP Hopper, a tool he uses 
for penetration testing of companies that are running voice over IP 
phone systems.

Kindervag said that VoIP was gaining acceptance with large companies and 
organizations for many reasons: there are no toll calls over the 
Internet; there's less cabling involved; employees can move offices 
without having to rewire or change switching operations for their 
phones; and finally, voice mail notices can appear in one's Outlook 
inbox. "This is very popular among CIOs," Kindervag said.

But Ostrom's tool allows one to hook up a laptop computer to a public 
VoIP phone and connect to the company's or organization's internal 
network with full administrator access. VoIP Hopper can be used to 
intercept Cisco Discovery Protocol (CDP), which announces the device 
type and the SNMP agent address of neighboring devices, and 
automatically create a new ethernet device. This could allow someone to 
map or otherwise do damage to a company's network from a public waiting 
area. The tool also allows one to physically remove the phone and have a 
laptop spoof the phone's MAC address, so the network is unaware that a 
laptop has replaced the expected phone.

To prevent such attacks, the researchers recommend turning off CDP. They 
also recommend disabling port 2 on any public VoIP phone, and include 
the public phone within a firewall.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn