owning phone systems - thotcon · 2011. 6. 24. · why it (still) matters sunday, may 15, 2011....
TRANSCRIPT
![Page 1: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/1.jpg)
Owning Phone SystemsWhy it (still) matters
Sunday, May 15, 2011
![Page 2: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/2.jpg)
Josh “savant42” BrasharsAppSec Consulting
Sunday, May 15, 2011
![Page 3: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/3.jpg)
Obligatory “WTF are you?” slide
Pen Tester
Sometimes “telephone enthusiast”
Co-Founder of Mayhemic Labs
dc949
Sunday, May 15, 2011
![Page 4: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/4.jpg)
But before we begin...
Sunday, May 15, 2011
![Page 5: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/5.jpg)
My Wife = APT
Sunday, May 15, 2011
![Page 6: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/6.jpg)
My Wife = APTSeriously.
Sunday, May 15, 2011
![Page 7: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/7.jpg)
Some quick math (Frank^2 loves math)
Sunday, May 15, 2011
![Page 8: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/8.jpg)
let “d” = Defconlet “m” = Months
Sunday, May 15, 2011
![Page 9: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/9.jpg)
x = (d * 19) - (m * 9)
Sunday, May 15, 2011
![Page 10: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/10.jpg)
Sunday, May 15, 2011
![Page 11: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/11.jpg)
And then...
Sunday, May 15, 2011
![Page 12: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/12.jpg)
Sunday, May 15, 2011
![Page 13: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/13.jpg)
No Defcon.
Sunday, May 15, 2011
![Page 14: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/14.jpg)
Sunday, May 15, 2011
![Page 15: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/15.jpg)
Owning Phones
Sunday, May 15, 2011
![Page 16: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/16.jpg)
Why this talk?
Phones have been around a long time
Tech may change but basic premise is the same
Everywhere
Sunday, May 15, 2011
![Page 17: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/17.jpg)
Pen Testers
Always about the new hotness
Don’t care about the old and busted.
Sunday, May 15, 2011
![Page 18: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/18.jpg)
Sunday, May 15, 2011
![Page 19: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/19.jpg)
As a result...
Security stopped being important
PBXs became more complex, more obscure
Sunday, May 15, 2011
![Page 20: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/20.jpg)
“Nobody is attacking phones anymore”
Sunday, May 15, 2011
![Page 21: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/21.jpg)
“Phreaking is dead”
Sunday, May 15, 2011
![Page 22: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/22.jpg)
Any creature without a predator...
Sunday, May 15, 2011
![Page 23: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/23.jpg)
Remember when web “sites” became “applications?”
An orgy of shitty coding
“We’ll secure it later!”
(Or... never.)
Sunday, May 15, 2011
![Page 24: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/24.jpg)
Needlessly Complex
Sunday, May 15, 2011
![Page 25: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/25.jpg)
So now we have all these horny bunnies...
Sunday, May 15, 2011
![Page 26: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/26.jpg)
Hundreds of vendors
Acquisitions, Mergers, Leasing, Rebranding
Sunday, May 15, 2011
![Page 27: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/27.jpg)
In summary...
Telephones, one of the most important assets a business can posses, are more broken than they have ever been.
Sunday, May 15, 2011
![Page 28: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/28.jpg)
Without the phones, most businesses will
hurt.
Sunday, May 15, 2011
![Page 29: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/29.jpg)
Phones are “trusted”
Sunday, May 15, 2011
![Page 30: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/30.jpg)
Phones make money.
Sunday, May 15, 2011
![Page 31: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/31.jpg)
Money for Pen tests.
Sunday, May 15, 2011
![Page 32: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/32.jpg)
...and money to go to Thotcon.
Sunday, May 15, 2011
![Page 33: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/33.jpg)
In short, hack harder.
Sunday, May 15, 2011
![Page 34: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/34.jpg)
Pen Test Engagements
Did you make sure to ask? (scope)
How hard do you look at them?
How well do you know telephony?
Sunday, May 15, 2011
![Page 35: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/35.jpg)
The good news?
Sunday, May 15, 2011
![Page 36: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/36.jpg)
The good news?(for pen testers)
Sunday, May 15, 2011
![Page 37: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/37.jpg)
Easier than ever.
Sunday, May 15, 2011
![Page 38: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/38.jpg)
But first...
Sunday, May 15, 2011
![Page 39: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/39.jpg)
Old School
Sunday, May 15, 2011
![Page 40: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/40.jpg)
Sweet!
Scaling!
Redundant!
Secure!
Sunday, May 15, 2011
![Page 41: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/41.jpg)
...uh, how to do routing?
Sunday, May 15, 2011
![Page 42: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/42.jpg)
Let’s use sound!In-Band Signaling
Sunday, May 15, 2011
![Page 43: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/43.jpg)
In-Band Signaling
Secret tones within the existing channel
Security Through Obscurity
What could go wrong?!
Sunday, May 15, 2011
![Page 44: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/44.jpg)
Sunday, May 15, 2011
![Page 45: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/45.jpg)
Blind telephone enthusiasts figured it out
Could drop call by whistling
Bell technical journal published frequencies
Phone phreaking is born.
Sunday, May 15, 2011
![Page 46: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/46.jpg)
Making it Happin’
Sunday, May 15, 2011
![Page 47: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/47.jpg)
Blind phreaks used cassettes and pianos to create Multi-Frequency (MF) tones
Met John “Capt. Crunch” Draper
Discovered Cap’n Crunch Bosun Whistle could create 2600 hz tone, seize trunk
Crunch created electronic device to phreak
Sunday, May 15, 2011
![Page 48: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/48.jpg)
Sunday, May 15, 2011
![Page 49: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/49.jpg)
Toll fraud is huge
Production of “Blue Boxes” ignites, Metasploit for phones
Even Woz and Jobs get in on it.
Sunday, May 15, 2011
![Page 50: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/50.jpg)
Genie is out of the bottle
Kids are controlling the phone network
Mafia and Political Dissidents get in on it
“Hacker” culture is in full swing
Sunday, May 15, 2011
![Page 51: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/51.jpg)
Phones are Owned.
Sunday, May 15, 2011
![Page 52: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/52.jpg)
And then...
Sunday, May 15, 2011
![Page 53: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/53.jpg)
The King is Dead(ish)
Party continued full swing until switches went digital
Control channels are (mostly) no longer in-band
Sunday, May 15, 2011
![Page 54: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/54.jpg)
We’re cool now, right?
Sunday, May 15, 2011
![Page 55: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/55.jpg)
Wrong.
Sunday, May 15, 2011
![Page 56: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/56.jpg)
Digital Era
Phone switches are basically giant computers.
Computers with modems.
Sunday, May 15, 2011
![Page 57: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/57.jpg)
Sunday, May 15, 2011
![Page 58: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/58.jpg)
Damn kids.
As technology improves, so do attackers
Skill requirement goes up, somewhat
Mafia and Activists are less involved, but hacking remains rampant
Sunday, May 15, 2011
![Page 59: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/59.jpg)
Damn kids.
Personal computers boom, BBSes are born
“K-Rad boards” lead to more fraud
Long Distance is $$$++
Victimless crime?
Sunday, May 15, 2011
![Page 60: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/60.jpg)
Highly Skilled AttackersToll fraud leads the way to owning digital switches
LOD, Masters of Deception (MoD), etc...
Pranking!
Why does my house phone ask me for coins?!?
Eavesdropping
Sunday, May 15, 2011
![Page 61: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/61.jpg)
Highly Skilled Attackers
Calls are maliciously re-routed
Denial of Service
Dogs and cats, living together.
Continued
Sunday, May 15, 2011
![Page 62: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/62.jpg)
Mass Hysteria.
Sunday, May 15, 2011
![Page 63: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/63.jpg)
Sunday, May 15, 2011
![Page 64: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/64.jpg)
NO CARRIER
Sunday, May 15, 2011
![Page 65: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/65.jpg)
Sunday, May 15, 2011
![Page 66: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/66.jpg)
R.I.P.
Increased interest in hacking computers
Phone phreaking dies down
Long distance calls become reasonable
IP is the new hotness
BBSes are mostly gone
Sunday, May 15, 2011
![Page 67: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/67.jpg)
We’re cool NOW, right?
Sunday, May 15, 2011
![Page 68: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/68.jpg)
...
Sunday, May 15, 2011
![Page 69: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/69.jpg)
Sunday, May 15, 2011
![Page 70: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/70.jpg)
The Honeymoon
Phone calls are now dirt cheap.
As little as .02 CENTS per minute.
Business is STOKED.
Who really cares about toll fraud?
Sunday, May 15, 2011
![Page 71: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/71.jpg)
Sunday, May 15, 2011
![Page 72: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/72.jpg)
Old becomes new.
Sunday, May 15, 2011
![Page 73: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/73.jpg)
Retro is in.
Old attacks, new techniques
Interception is now trivial.
Caller ID Spoofing
Voice Mail Attacks
Swatting
Paris Hilton
Sunday, May 15, 2011
![Page 74: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/74.jpg)
Fast forward to...
Sunday, May 15, 2011
![Page 75: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/75.jpg)
Sunday, May 15, 2011
![Page 76: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/76.jpg)
Today.
The honeymoon is over.
VoIP is everywhere
VoIP has been talked about to death
Everyone uses VoIP.
Sunday, May 15, 2011
![Page 77: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/77.jpg)
Let’s get down to it.
Sunday, May 15, 2011
![Page 78: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/78.jpg)
Threat Modeling
Sunday, May 15, 2011
![Page 79: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/79.jpg)
Attack Vectors
Trust and Social Engineering Attacks
Information Disclosure
Interception
OS Attacks
Toll Fraud
Denial of Service
Sunday, May 15, 2011
![Page 80: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/80.jpg)
Trust
Caller ID Spoofing
This is Jim From IT Services, I hear your computer is running slowly?
This is CEO Jim, gimme your passwords!
Sunday, May 15, 2011
![Page 81: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/81.jpg)
Trust
Sunday, May 15, 2011
![Page 82: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/82.jpg)
Sunday, May 15, 2011
![Page 83: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/83.jpg)
VoIP Hopper
http://voiphopper.sourceforge.net/
Hop...er... VoIP.
Sunday, May 15, 2011
![Page 84: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/84.jpg)
Information Disclosure
Convergence is here to stay.
“WebEx” style conferencing
Proprietary data uploaded as slide decks
“Confidential”, “Partner Only”
Saved to the file system
Sunday, May 15, 2011
![Page 85: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/85.jpg)
Information Disclosure
Call Logs tell you who calls who
The CEO sure does call his secretary a lot.
Like, a LOT, a lot.
Dude, I think the CEO is @#%ing the secretary.
BLACKMAIL!
Sunday, May 15, 2011
![Page 86: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/86.jpg)
Interception
Sunday, May 15, 2011
![Page 87: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/87.jpg)
The old way
Sunday, May 15, 2011
![Page 88: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/88.jpg)
The New Way.
Sunday, May 15, 2011
![Page 89: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/89.jpg)
Interception
Protocol attacks to eavesdrop on calls
SIP credentials are trivial to steal and re-use.
MITM
• PBX -> Attacker PBX -> Tubes
• Trivial to record, deny, etc.
Sunday, May 15, 2011
![Page 90: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/90.jpg)
Wireless.
Sunday, May 15, 2011
![Page 91: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/91.jpg)
OS Attacks
Who patches the phone system? Sys admins? The telephony guys?
Not *MY* Problem, right?
Sunday, May 15, 2011
![Page 92: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/92.jpg)
Sunday, May 15, 2011
![Page 93: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/93.jpg)
Default passwords.
Sunday, May 15, 2011
![Page 94: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/94.jpg)
“changeme”
Sunday, May 15, 2011
![Page 95: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/95.jpg)
Toll Fraud
Easier than ever before
Like Perl, there’s more than one way to do it wrong.
Dial Plan Logic Errors = Outbound trunks
Default Telnet or VxWorks credentials
Sunday, May 15, 2011
![Page 96: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/96.jpg)
Toll Fraud
Voicemail Collect Charges Attack
Stealing Credentials
Google for sip.conf & iax.conf
Sunday, May 15, 2011
![Page 97: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/97.jpg)
Denial of Service
Childs play.
Sunday, May 15, 2011
![Page 98: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/98.jpg)
Sunday, May 15, 2011
![Page 99: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/99.jpg)
Web Interfaces(Hi Raf!)
Sunday, May 15, 2011
![Page 100: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/100.jpg)
A whole new way to fail.
Sunday, May 15, 2011
![Page 101: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/101.jpg)
Web Interfaces
Ease of Use = Ease of Compromise
Inherit the OWASP Top 10+++
Sunday, May 15, 2011
![Page 102: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/102.jpg)
Just one example.
Sunday, May 15, 2011
![Page 103: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/103.jpg)
intitle:”index.of” (sip.conf | iax.conf) “last.modified”
Sunday, May 15, 2011
![Page 104: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/104.jpg)
Sunday, May 15, 2011
![Page 105: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/105.jpg)
Remember when we had to scan for codes?
Sunday, May 15, 2011
![Page 106: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/106.jpg)
Sunday, May 15, 2011
![Page 107: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/107.jpg)
TFTP?!?
Sunday, May 15, 2011
![Page 108: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/108.jpg)
Sunday, May 15, 2011
![Page 109: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/109.jpg)
Sunday, May 15, 2011
![Page 110: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/110.jpg)
Remember when we had to wardial for this?
Sunday, May 15, 2011
![Page 111: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/111.jpg)
Derail: War Dialing
iWAR by da Beave
WarVOX by HDM
ToneLoc (yes, people still use it)
Sunday, May 15, 2011
![Page 112: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/112.jpg)
Slow or ExpensiveYou pick.
Sunday, May 15, 2011
![Page 113: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/113.jpg)
Pro Tip:
• CNAM lookups!
• Backspoof
• HTTP API
Sunday, May 15, 2011
![Page 114: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/114.jpg)
Sunday, May 15, 2011
![Page 115: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/115.jpg)
Google for Asterisk + “CallerID” or “Asterisk CNAM”
$0.002 a query
(roughly one share of LGTT)
Sunday, May 15, 2011
![Page 116: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/116.jpg)
Oh, right...
Where was I?
Sunday, May 15, 2011
![Page 117: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/117.jpg)
Case Study:Owning the whole network via the phone
Sunday, May 15, 2011
![Page 118: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/118.jpg)
(not talking about SE here)
Sunday, May 15, 2011
![Page 119: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/119.jpg)
Sunday, May 15, 2011
![Page 120: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/120.jpg)
ShoreTel Conference
• “Convergence” - IM, Conference, WebEx
• Super secret software (Linux, shhh!)
• No root for you!
Sunday, May 15, 2011
![Page 121: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/121.jpg)
Sunday, May 15, 2011
![Page 122: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/122.jpg)
admin / changeme
Sunday, May 15, 2011
![Page 123: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/123.jpg)
Sunday, May 15, 2011
![Page 124: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/124.jpg)
Sunday, May 15, 2011
![Page 125: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/125.jpg)
Sunday, May 15, 2011
![Page 126: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/126.jpg)
Sunday, May 15, 2011
![Page 127: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/127.jpg)
via Burp Suite
Sunday, May 15, 2011
![Page 128: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/128.jpg)
syscmds.cgi
Sunday, May 15, 2011
![Page 129: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/129.jpg)
Oops.
Sunday, May 15, 2011
![Page 130: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/130.jpg)
%26 is != “|”This is why phone people shouldn’t write webapps.
Sunday, May 15, 2011
![Page 131: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/131.jpg)
Sunday, May 15, 2011
![Page 132: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/132.jpg)
Savant, who cares? ‘nobody’ is a nobody.
Sunday, May 15, 2011
![Page 133: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/133.jpg)
Sunday, May 15, 2011
![Page 134: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/134.jpg)
Sunday, May 15, 2011
![Page 135: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/135.jpg)
Nightly automated backups.
Sunday, May 15, 2011
![Page 136: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/136.jpg)
...and it is run by root.
Sunday, May 15, 2011
![Page 137: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/137.jpg)
Sunday, May 15, 2011
![Page 138: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/138.jpg)
Sunday, May 15, 2011
![Page 139: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/139.jpg)
Sunday, May 15, 2011
![Page 140: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/140.jpg)
Sunday, May 15, 2011
![Page 141: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/141.jpg)
Sunday, May 15, 2011
![Page 142: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/142.jpg)
john
Sunday, May 15, 2011
![Page 143: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/143.jpg)
“Ok, so that’s one box, impress me.”
Sunday, May 15, 2011
![Page 144: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/144.jpg)
Remember this? Yeah, that’s active directory enabled.
Sunday, May 15, 2011
![Page 145: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/145.jpg)
Simple to patch.
• Tweak login page to capture credentials to file.
• Same host, no problems with SSL cert
• Schedule a conference with CEO, IT, Ops.
Sunday, May 15, 2011
![Page 146: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/146.jpg)
I accidentally the whole org chart.
Sunday, May 15, 2011
![Page 147: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/147.jpg)
MSF Module(s)
• ShoreTel Brute by Keith Leigh
• http://code.google.com/p/shoretel-brute/
• MSF Root payload module coming soon.
Sunday, May 15, 2011
![Page 148: Owning Phone Systems - THOTCON · 2011. 6. 24. · Why it (still) matters Sunday, May 15, 2011. Josh “savant42” Brashars AppSec Consulting ... “WebEx” style conferencing](https://reader034.vdocuments.mx/reader034/viewer/2022051901/5ff071dc8e4e64397332668f/html5/thumbnails/148.jpg)
Questions?@savant42 on the twitters
Sunday, May 15, 2011