Archive notice: This article was originally published on October 19, 2007. Links and embedded videos are preserved as part of the historical record.
The security specialists at Secure Computing have come across proof-of-concept code with which the VoIP protocol SIP is exploited for the first time to smuggle malicious codes onto a computer. The demo attack is based on an XSS attack (cross-site scripting) via VoIP. Hackers can thus gain control of the target computer and run malware on the PC via the IP telephone connection. The vulnerability was discovered a few days ago by security engineer Radu State in the Linksys SPA-941 device.
State classifies the error as “very critical”, because a firewall could also be deactivated via an XSS attack. According to the expert, the problem lies in the small web servers of the VoIP software that are used to configure and manage the software. They would also be used to display missed calls. The user usually accesses these data via the network. In the cracked Linksys device, however, it is possible to perform an XSS injection because the “from” field of the SIP message is not properly filtered. Hacker tools can attack the system via a specially adapted SIP packet.
State also points out, however, that it is normally difficult to attack VoIP devices via SIP. This is because most products have a manufacturer-specific architecture as well as a special operating system. However, many also have integrated web servers, and these could be cracked with a buffer-overflow exploit. The security researcher has initially found the error only in the Linksys device, but believes that other products could also be affected by the problem.
Paul Henry, Vice President Technology Evangelism at Secure Computing, believes that the attack hits a sore point in current security software because most security products would not check this type of attack. A comprehensive solution would have to search for malicious scripts and malware in every protocol that is allowed to pass through the firewall. “Users now no longer open every e-mail attachment and are also cautious when they visit unknown websites. However, this new vulnerability in the VoIP SIP protocol shows us that we now live in the Web 2.0 world. Here much is far from as secure as we believe,” says Henry. “Everyone who uses a VoIP connection should therefore take additional security measures.”
