VoIP Wars: Attack of the Cisco Phones

on YouTube ↗01h 02m

" summary

Hosted Cisco VoIP deployments are vulnerable to practical attacks demonstrated with the Viproy (VRO) toolkit (a dozen modules) and a custom MITM proxy: DHCP/TFTP spoofing lets an attacker serve fake phone configs, Remote‑Party‑ID injection enables caller‑ID spoofing and billing bypass, and hardcoded SSH keys in domain manager allow server access; binary Skinny protocol fuzzing registers/clones phones to disconnect or impersonate lines, modify call‑forward/speed‑dials, and crash soft clients. Live demos and proof‑of‑concept tools work against unpatched versions.

AI-written summary · about

" chapters (13)

1. 0:00Introduction and agenda
2. 3:41Hosted VoIP infrastructure
3. 6:26Network and physical access
4. 10:31Hardware tampering
5. 12:46Network service attacks
6. 14:33Collaboration suite threats
7. 17:44Web application vulnerabilities
8. 21:35XML service exploitation
9. 29:55SIP protocol attacks
10. 36:12Caller ID and identity spoofing
11. 39:02Client-side and fuzzing
12. 47:34Skinny protocol exploitation
13. 57:31Remediation and conclusion

" related talks

• 53mVoIP Wars: the Phreakers AwakenFatih Ozavci · Black Hat USA 2016
• 21mHanging on the Telephone: Hacking VoIPSarah Young · BSidesSF 2020
• 01h 05mVOIP Wars: Destroying Jar Jar LyncFatih Ozavci · Black Hat Europe 2015
• 37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-DaysBen Seri, Barak Hadad · Black Hat Asia 2020
• 30mAttacking Encrypted VOIP ProtocolsIvica Stipovic · HITBSecConf 2019 Amsterdam
• 48mMobile Network Hacking, IP EditionSina Yazdanmehr, Karsten Nohl, Luca Melette · Black Hat Europe 2019
• 31mZero-Touch-Pwn: Abusing Zoom's Zero Touch Provisioning for Remote Attacks on Desk PhonesMoritz Abrell · Black Hat USA 2023
• 26mBack to the Future. Cross-Protocol Attacks in the Era of 5GSergei Puzankov · Black Hat Asia 2020