This attack against older telephone switches and trunks has been around
for decades. The signal is sent by the attacker to impersonate a supervisor
signal. This has the effect of rerouting or usurping command of the line and
call. While the US infrastructure proper may not contain widespread
vulnerabilities to this type of attack, many companies are connected
globally through call centers and business process outsourcing. These
international systems may be operated in countries which have not upgraded
telco infrastructure and so are vulnerable to Blue boxing.
Blue boxing is a result of failure on the part of the system to enforce
strong authentication for administrative functions. While the infrastructure
is different than standard current applications like web applications, there
are hisotrical lessons to be learned to upgrade the access control for
administrative functions.
Attack Prerequisites
System must use weak authentication mechanisms for administrative
functions.
Typical Likelihood of Exploit
Likelihood: Medium
Methods of Attack
Injection
Protocol Manipulation
Examples-Instances
Description
Attacker identifies a vulnerable CCITT-5 phone line, and sends a
combination tone to the switch in order to request administrative
access. Based on tone and timing parameters the request is verified for
access to the switch. Once the attacker has gained control of the switch
launching calls, routing calls, and a whole host of opportunities are
available.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
Given a vulnerable phone system, the attacker's technical vector
relies on attacks that are well documented in cracker 'zines and have
been around for decades.
Resources Required
CCITT-5 or other vulnerable lines, with the ability to send tones such as
combined 2,400 Hz and 2,600 Hz tones to the switch
Solutions and Mitigations
Implementation: Upgrade phone lines. Note this may be prohibitively
expensive
Use strong access control such as two factor access control for
adminsitrative access to the switch
Attack Motivation-Consequences
Scope
Technical Impact
Note
Availability
DoS: resource consumption
(other)
Confidentiality
Access_Control
Authorization
Gain privileges / assume
identity
Injection Vector
Payload delivered through standard communication protocols.
Description
