How to Break Asterisk
August 15th, 2007 by Martyn DaviesJust to show that VoIP security is not all about SIP, researchers Himanshu Dwivedi and Zane Lackey from iSEC Partners have produced some interesting material on vulnerabilities in IAX, which they just presented at the recent Black Hat conference. IAX (pronounced eeks) as you may know, is a proprietary protocol often used to connect together Asterisk servers for the purposes of call routing. Implementors say that it is simpler than SIP, and also tunnels through firewalls better than SIP, thanks to a ‘VPN like’ approach that tunnels signalling and media together down the same pipe.
iSEC came up with a number of novel attacks including exploiting authentication problems with the use of MD5 hashes; man-in-the-middle and DoS. They have a very nice paper here that describes their attacks in detail, and they have also made available some code (in Python) that you can use for your own experimentation.
Not stopping at IAX, they also had a go at the granddaddy of VoIP protocols, H.323, and have published a couple of attack tools there too. It’s enough to keep you busy all Summer long.
August 15th, 2007 at 5:48 pm
[…] VoIPsa, an organization which I’ve previously accused of being more of a pretty face for VoIP equipment makers than a real agent of positive change, today called attention to a handful of security hacks targeted at Asterisk. Notice the apparent reluctance to say anything good about the IAX protocol, which is arguably Asterisk’s single-best feature. Anyway, check em out here. […]