Cisco Security Response: Cisco Unified IP Phone Remote Eavesdropping

Document ID: 100252

http://www.cisco.com/warp/public/707/cisco-sr-20071128-phone.shtml

Revision 1.1

Last Updated 2007 November 30 1600 UTC (GMT)

For Public Release 2007 November 28 1600 UTC (GMT)

Please provide your feedback on this document.

Contents

Cisco Response
Additional Information
Revision History
Cisco Security Procedures

Cisco Response

This is the Cisco PSIRT response to a presentation given at the Hack.Lu 2007 security conference by Joffrey Czarny of Telindus regarding a technique to remotely eavesdrop using Cisco Unified IP Phones.

The original report is available at the following link:

http://www.hack.lu/archive/2007/hacklu07_Remote_wiretapping.pdf

We greatly appreciate the opportunity to work with researchers on security vulnerabilities and welcome the opportunity to review and assist in product reports.

This Cisco Security Response is posted at the following link:

http://www.cisco.com/warp/public/707/cisco-sr-20071128-phone.shtml

Additional Information

Cisco confirms that an attacker with valid Extension Mobility authentication credentials could cause a Cisco Unified IP Phone configured to use the Extension Mobility feature to transmit or receive a Real-Time Transport Protocol (RTP) audio stream. This ability can be exploited to perform a remote eavesdropping attack. All Cisco IP Phones that support the Extension Mobility feature are vulnerable.

For this attack to be possible, several conditions need to be satisfied:

• The internal web server of the IP phone must be enabled. The web server is enabled by default.
  
• The IP phone must be configured to use the Extension Mobility feature, which is not enabled by default.
  
• The attacker must possess or obtain valid Extension Mobility authentication credentials.
  

Extension Mobility authentication credentials are not tied to individual IP phones. Any Extension Mobility account configured on an IP phone's Cisco Unified Communications Manager/CallManager (CUCM) server can be used to perform an eavesdropping attack.

To obtain Extension Mobility authentication credentials, an attacker needs physical access to the network to sniff credentials. This can be accomplished by inserting a sniffing device between an IP phone and switch port.

Before eavesdropping can occur, the user who is logged into the IP phone via Extension Mobility must first be logged off of the IP phone. This can be accomplished by sending an Extension Mobility logout message to the IP phone's Cisco Unified Communications Manager/CallManager (CUCM) server.

If exploitation is successful, any IP phone that is undergoing an eavesdropping attack will have its speaker phone status light enabled, and the phone will display an off-hook icon that indicates an active call is in progress. Internal testing by Cisco also revealed that the described attack produced static noise on the IP phone while it was under attack.

Workarounds

There are workarounds to combat this attack:

• Disable the internal web server on IP phones.
  
• Disable the Extension Mobility feature on IP phones.
  
• Disable the speaker phone / headset functionality on IP phones.
  

This attack can also be mitigated by restricting access to the internal web server of IP phones (TCP port 80) using an transit access control list (tACL). For more information on transit access control lists, reference this link:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml

For more information about Cisco-recommended best practices for securely deploying Cisco Unified IP Phones, reference this link:

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/6x/security.html#wp1045452

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Revision History

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.