Cisco VoIP Hijacking Exploit Paper

Cisco VoIP Hijacking Exploit - Paper #01
[Written By: SmallDoink#0666]
[Written By: ScaredKYS]
-
Cisco's line of VoIP/IP Phones are vulnerable to hijacking. This form of hijacking I discovered only works on Cisco phones and some VoIP adapters.
Cisco's Vulnerable Devices:
8800 Series
7800 Series
6900 Series
3900 Series
--
Other Devices:
Ooma Tele Air
------
Explanation Of Vulnerability:
Cisco has a VoIP API it uses to log calls made from their IP phones. I discovered a way to grab the private key the server and the phone share and also grab the public key. By doing this I was able to access the Cisco API and see:
1.) Who they are calling
2.) How long they have been on calls
3.) Who they have called
I was also able to swap phone calls between multiple Cisco IP phones, meaning I could make each IP phone on the VLAN transfer calls to each other along the network.
---
[UPDATED PAPER]
Cisco's IP Phones use Cisco's Gateway and API to access and call other phones. By having access to the private key and public key I have the ability to change the JAL and DTAL features and use it for malicious purposes, hence the ability to transfer and merge calls. With access to the API I could view calls logs, etc. The API is hosted on *http://api.cisco.com/voice-api/* and to use the link to find calls. Use *http://api.cisco.com/voice-api/external-ip/callid* where external-ip is the phone's external IP and callid is the Call's ID. To access the API you must have an Ip range of either:
1.) Cisco's Private Network
2.) A Known Cisco Device
E.x.: 72.163.8.17 Cisco's Private Network
-
Cisco uses standard VoIP encryption along with packet hashing upon activation of their device.
Cisco has a key generation on their phones that allow access to the server, with internal access to the phone, you can intercept the key and use it to authenticate with the gateway. Once gateway access has been granted you are inside of the cisco voice network, but you are only given permissions to view your phones that are registered on your network.
-
Cisco's API automatically saves call logs, call information, call time, and call destination in their database which is a MySQL database. You can not inject any information into the database since it is filtered only a standard of syntax they have set.
---
Network Architecture For Calls:
Cisco Phone -> Router -> Internet -> Cisco Gateway -> Cisco API -> Cisco Gateway -> VoIP to Phone Regulator -> Phone Destination
-
Network Architecture For Database:
Spoofed IP -> Cisco Gateway -> Cisco API -> Cisco Database
					-        |      -
			Gateway is authed|API used to req
				with keys	 |	  Data

[Written By: SmallDoink#0666]
[Written By: ScaredKYS]
Cisco VoIP Hijacking Exploit - Paper #01