Bypass of GARP Disablement
In new installations, Cisco Unified IP Phones by default have GARP Disabled in the IP Phone settings. What this means is that when you run UCSniff in MitM mode, you can only ARP Poison the traffic from the Network to the IP Phone - you can't successfully ARP Poison the traffic from the Phone to the network. This is a useful security feature to default casual attackers, but it most definitely is not fool proof. In fact we have written a feature called GARP Disablement Bypass, which helps defeat this protection control. This is an example of how you run the feature:
ucsniff -i eth0 --garpdb // //
Here is how we have observed that Cisco phones implement the security feature, and how our code can defeat this feature. Normally, you can ARP Poison a device via unicast ARP reply packets and they will update their ARP cache. This also works with Cisco Unified IP Phones with the security feature turned on. However, during an active call setup with SCCP signaling, when the phone learns it's remote RTP peer via the StartMediaTransmission Skinny message, it will send an ARP request for that remote RTP peer, assuming that the peer is in the same source VLAN as the phone. So even if we have already successfully ARP Poisoned the phone, when an active call starts, the IP Phone will update it's ARP cache during call setup. So in normal operation, that is why we can't ARP Poison the phones: because they will only ARP for their remote peer during call setup, and any previously spoofed entries are overwritten. But we can defeat this now, because we have automated a way to construct spoofed unicast ARP reply packets via MitM.
Winning the race condition: Since we are MitM for IP Phone traffic, we receive traffic from the network to the phone, including any traffic sent from the UCM to the IP Phone. What we do is intercept and analyze the StartMediaTransmission SCCP packet. This tells the phone the IP address and RTP port of the remote peer. Since we intercept this packet, we know the phone is about to ARP for this peer. We use information in this packet to construct a spoofed unicast ARP reply, and we start flooding the IP Phone. When the phone ARPs, we are already flooding it. When the valid IP Phone replies, we are still flooding. We keep flooding after the valid IP Phone. We win the race condition and successfully ARP Poison the phone during call setup. This method works for re-constructing bi-directional media when both phones are in the same VLAN. For calls that take place when an IP Phone is calling to/from a voice gateway in a remote VLAN, or any remote RTP peer for that matter, we can only re-construct uni-directional traffic from Network to IP phone - inbound RTP stream.
One of the problems with this new UCSniff feature is that it is ineffective against intercepting any Skinny messages from the phone to the network. This is because the IP Phone ARPs for its remote IP gateway when it boots up and registers for the first time, and any subsequent spoofed ARP packets are ineffective. So we really needed to find a way to change this feature. Read below, this is what we have done.
TFTP File Modification:
This attack was referred to previously as TFTP MitM Modification of IP Phone settings. The feature works to change IP Phones that have GARP Disabled to Enabled. This is the CLI recommended, example usage:
ucsniff -i eth0 --tftpm -T -D
You first need the IP address of a target phone and build the targets.txt entry. Let's say the IP address of the phone is 172.16.87.6, here is the entire example content of targets.txt:
172.16.87.6,1004,John,sccp
What this attack does is target the communication from the network to this phone's IP address of 172.16.87.6. UCSniff will block any KeepAliveAck messages forwarded from the network (UCM) to the IP phone. These messages are used as a protocol heartbeat mechanism to tell the phone that it is still connected or registered to the server. Since we block these packets suddenly, after a certain number of lost heartbeats, the phone believes it has lost connectivity to the server and attempts to re-register to the call server. In this process, it will attempt to download its SEP CNF XML configuration file, which includes the full configuration that the phone needs to parse. This file is used by the Administrator to configure the phone server-side, and the phone firmware parses the file to tell itself how it needs to be configured. UCSniff sets up a UDP stream dissector which intercepts and analyzes the return traffic, looking for signs that the server is sending this SEP CNF XML configuration file over TFTP to the IP Phone. UCSniff simply looks for the GARP Disabled configuration file in the TFTP UDP streamand sets it to Enabled. When the phone finishes parsing the configuration, it now re-registers and has GARP Enabled. The only way to restore this configuration setting back is to reboot the IP Phone.
This new feature can be powerful in waiting until employees go home for the evening and changing the configuration of their IP Phones, one-by-one, so that the attacker can do full eavesdropping. This research idea can be extended to change any IP Phone setting that is controlled via the SEP CNF XML file.
Remove Voice Interface:
To use UCSniff to remove a created virtual voice interface, run the following (assuming eth0.99 is the voice interface):
ucsniff -r eth0.99
