| Attack Pattern ID | Pattern Abstraction: Detailed 5 |
| Typical Severity | Very High |
| Description | Summary
This attack against older telephone switches and trunks has been around for decades. The signal is sent by the attacker to impersonate a supervisor signal. This has the effect of rerouting or usurping command of the line and call. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded telco infrastructure and so are vulnerable to Blue boxing.
Blue boxing is a result of failure on the part of the system to enforce strong authentication for administrative functions. While the infrastructure is different than standard current applications like web applications, there are hisotrical lessons to be learned to upgrade the access control for administrative functions.
|
| Attack Prerequisites |
System must use weak authentication mechanisms for administrative functions.
|
| Typical Likelihood of Exploit |
Medium
|
| Methods of Attack | - Injection
- Protocol Manipulation
|
| Examples-Instances | Description
Attacker identifies a vulnerable CCITT-5 phone line, and sends a combination tone to the switch in order to request administrative access. Based on tone and timing parameters the request is verified for access to the switch. Once the attacker has gained control of the switch launching calls, routing calls, and a whole host of opportunities are available.
|
| Attacker Skill or Knowledge Required |
Low: Given a vulnerable phone system, the attacker's technical vector relies on attacks that are well documented in cracker 'zines and have been around for decades.
|
| Resources Required |
CCITT-5 or other vulnerable lines, with the ability to send tones such as combined 2,400 Hz and 2,600 Hz tones to the switch
|
| Solutions and Mitigations |
Implementation: Upgrade phone lines. Note this may be prohibitively expensive
Use strong access control such as two factor access control for adminsitrative access to the switch
|
| Attack Motivation-Consequences | - Denial of Service
- Privilege Escalation
|
| Context Description |
“Attack Pattern: Analog In-band Switching Signals (aka "Blue Boxing")
Many people have heard of 2600, the frequency used in the United States to control telephone switches during the 1960s and 1970s. (Come to think of it, probably more people have heard of the hacker 'zine 2600 and its associated club than have heard of the reason for the name of the club,) Most systems are no longer vulnerable to ancient phreaking attacks. However older systems are still found internationally. Overseas trunk lines that use trans-Atlantic cabling are prone to the in-band signal problem, and they are too expensive a resource to abandon. Thus, many overseas (home-country direct) 800/888 numbers are known to have in-band signal problems even today.
Consider the CCITT-5(C5) signaling system that is used internationally. This system does not use the commonly known 2,600 Hz, but instead uses 2,400Hz as a control signal. If you have ever heard the "pleeps" and chirps on the Pink Floyd album "The Wall," then you have heard C5 signals. There are millions of phone lines still in operation today that are routed through switches with in-band signaling.
This attack pattern involves playing specific control commands across a normal voice link, thus seizing control of the line, rerouting calls, and so on."
[Hoglund and McGraw 04]
|
| Injection Vector |
Payload delivered through standard communication protocols.
|
| Payload |
Command(s) executed directly on host
|
| Activation Zone |
Client machine and client network
|
| Payload Activation Impact |
Enables calls to be rerouted.
|
| Related Weaknesses | | CWE-ID | Weakness Name | Weakness Relationship Type |
|---|
| 264 | Permissions, Privileges, and Access Controls | Targeted |
|
| Purpose | Penetration |
| CIA Impact | | Confidentiality Impact | Integrity Impact | Availability Impact |
|---|
| Low | Medium | Medium |
|
| Technical Context | | Architectural Paradigm | Framework | Platform | Language |
|---|
| Other | Other | Other | All |
|
| References |
G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.
|
| Source | | Submission(s) |
|---|
| Submitter | Organization | Date | Comment |
|---|
| G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004. | Cigital, Inc | 2007-01-01 | |
| Modification(s) |
|---|
| Modifier | Organization | Date | Comment |
|---|
| Gunnar Peterson | Cigital, Inc | 2007-02-28 | Fleshed out content to CAPEC schema from the original descriptions in "Exploiting Software" | | Sean Barnum | Cigital, Inc | 2007-03-09 | Review and revise |
|
