Home > CAPEC List > CAPEC-5: Blue Boxing (Version 2.10)  

CAPEC-5: Blue Boxing

 
Blue Boxing
Definition in a New Window Definition in a New Window
Attack Pattern ID: 5
Abstraction: Detailed
Status: Draft
Completeness: Complete
Presentation Filter:
+ Summary

This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.

+ Attack Prerequisites
  • System must use weak authentication mechanisms for administrative functions.

+ Typical Severity

Very High

+ Typical Likelihood of Exploit

Likelihood: Medium

+ Methods of Attack
  • Injection
  • Protocol Manipulation
+ Examples-Instances

Description

An adversary identifies a vulnerable CCITT-5 phone line, and sends a combination tone to the switch in order to request administrative access. Based on tone and timing parameters the request is verified for access to the switch. Once the adversary has gained control of the switch launching calls, routing calls, and a whole host of opportunities are available.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

Given a vulnerable phone system, the attackers' technical vector relies on attacks that are well documented in cracker 'zines and have been around for decades.

+ Resources Required

CCITT-5 or other vulnerable lines, with the ability to send tones such as combined 2,400 Hz and 2,600 Hz tones to the switch

+ Solutions and Mitigations

Implementation: Upgrade phone lines. Note this may be prohibitively expensive

Use strong access control such as two factor access control for administrative access to the switch

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Availability
DoS: resource consumption (other)
Denial of Service
Confidentiality
Access_Control
Authorization
Gain privileges / assume identity
+ Injection Vector

Payload delivered through standard communication protocols.

+ Payload

Command(s) executed directly on host

+ Activation Zone

Client machine and client network

+ Payload Activation Impact

Enables calls to be rerouted.

+ Purposes
  • Penetration
+ CIA Impact
Confidentiality Impact: LowIntegrity Impact: MediumAvailability Impact: Medium
+ Technical Context
Architectural Paradigms
Other
Frameworks
Other
Platforms
Other
Languages
All
+ References
[R.5.1] [REF-2] G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. February 2004.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
More information is available — Please select a different filter.
Page Last Updated or Reviewed: May 01, 2017