A Vonage VOIP 3-way call CID Spoofing Vulnerability

From: Nathan Wosnack (nathan_at_hypervivid.com)
Date: 08/14/03

  • Next message: Darren Reed: "Re: Buffer overflow prevention" 
    Date: 14 Aug 2003 00:02:21 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Original Advisory: Wednesday, August 13, 2003

    Severity: Medium - High

    Description: An attacker using the VOIP (Voice Over IP) carrier Vonage,
    has the ability to spoof the caller ID of a called party through the three-
    way calling feature. This trick essentially acts similar to a POTS-based
    diverter, as it allows the attacker to carry out illicit telephone
    activities while hiding his or her phone number.

    Version: This was tested using Cisco Systems' ATA 186 VOIP hardware on the
    Vonage carrier.

    Author: Nathan Wosnack

    Vonage Background:

    "Using an existing high-speed Internet connection, Vonage technology
    enables anyone to make and receive phone calls - worldwide - with a touch-
    tone telephone. Offering quality phone service bundled with enhanced IP
    communications services, our interactive communications portal is a
    gateway to advanced features only available through digital telephone
    service. Utilizing our global network and advanced routing technologies,
    Vonage offers an innovative, feature-rich and cost effective alternative
    to traditional telephony services."

    Description of the problem:

    By using SIP-enabled voice over IP (VOIP) hardware such as the Cisco ATA
    186 Analog Telephone Adaptor, it's possible to spoof the caller
    identification that shows up on a call. The attacker only needs to call up
    a regular phone line (POTS - plain old telephone service), place the
    caller on hold, flash over to a dial tone using the threeway call feature,
    and then call a second party for this to work. The caller ID information
    that tends to show up is the first called party's telephone number with
    either their name listed or "unknown name" showing on a conventional
    caller-id enabled telephone. The opportunity for abuse is high and could
    allow the determined attacker to social engineer your telephone, cable, or
    utility company into modifying your services. Since many companies only
    require the person's name, address, and caller id for account
    authentication, this vulnerability helps the attacker. The other
    opportunities this vulnerability gives the attacker is the ability to
    spoof anyone's caller id information for phone hacking (often
    called "phreaking"); such as breaking into voice mail accounts and PBX
    exploitation for the purpose of proprietary information gathering and
    telephone fraud.

    Solutions to the problem:

    This issue is something that Vonage will need to investigate on their end.
    The proper routing of caller id information after a third-party call is
    initiated is the problem, and needs to be resolved by the Vonage IT staff
    figuring out why their VOIP switching equipment doesn't pass this data
    properly. The Hypervivid Solutions staff has contacted Vonage directly
    about this issue, so it can hopefully be resolved shortly.

    For everyone else, your best defense is to be aware of who is calling you.
    If you happen to receive a phone call from an unknown party who wants to
    place you on hold, hang up immediately and then call them back.
    If you hear a recording telling you the number is not in service, then
    you've likely reached a Vonage gateway number, which mean you were likely
    called by someone attempting to exploit this Vonage VOIP vulnerability.

    Conclusion:

    In the past year, Voice over IP telephony has seen many security issues.
    The voip issues range from vendor implementations of the Session
    Initiation Protocol (SIP), problems with remote-accessible code which can
    be exploited to cause a denial of service, voip phones that are weak in
    ways that facilitate man-in-the-middle attacks directed at intercepting
    telephone traffic, and most recently 3-way caller ID spoofing on Vonage.

    When the information security community works closely with vendors and
    carriers, these problems can be resolved quickly and efficiently enough to
    limit or even eliminate any abuse by phone phreaks and criminals.

    Related Links:

    http://www.hypervivid.com/ - Information, Telecom and Wireless Security
    Consulting Firm.

    Vendor Contact:

    http://www.cisco.com/ - Cisco Systems, Inc. Manufacturer.
    http://www.vonage.com/ - American Voip telecom carrier.

    Have any questions or comments?
    e-mail: advisories@hypervivid.com

    Copyright © 2003, Hypervivid Solutions Incorporated. All Rights Reserved.

  • Next message: Darren Reed: "Re: Buffer overflow prevention"

    Relevant Pages

    • Re: A Vonage VOIP 3-way call CID Spoofing Vulnerability
      ... Sorry but simply calling a phone number and then 3-waying another number ... caller ID to the person you transfered them to, ... vonage is they only send your vonage number as caller ID and flex ANI, ... An attacker using the VOIP carrier Vonage, ...
      (Bugtraq)
    • Time to Ditch Your Landline Phone for VOIP?
      ... Voice-over-Internet-Protocol, or VoIP, phone systems. ... fire sprinkler engineering technician in O'Fallon, Mo., and a Vonage ... Internet calling services are designed to replace both your ... traditional land line and your long-distance provider. ...
      (comp.dcom.telecom)
    • Moving to VOIP But Keeping Same Phone Number
      ... other telecom regulations should apply to VoIP. ... world of Internet phone service are discovering that even when no one ... frustrated that it took more than four months for Vonage to transfer ... number-transfer agreement with Time Warner. ...
      (comp.dcom.telecom)
    • Re: AT&T to discontinue CallVantage voip service [Telecom]
      ... the voip service from Primus Telecommunications, ... That being said, the economics of most VOIP companies are very, ... It's pretty important to have a router ... I wonder if Vonage is using a new "single port" router because of QOS ...
      (comp.dcom.telecom)
    • TelecomDirect News Daily Update - September 06, 2006
      ... Vonage Hits 2 million Subscribers ... Canada Examines Looser Incumbent VoIP Rules ... Cisco Systems Inc. and friends have scored one of the biggest ... Sony Are Only Two Survivors in Handheld Game Market ...
      (comp.dcom.telecom)