Attack Trends Editors: Elias Levy, [email protected] Iván Arce, [email protected] Voices, I Hear Voices No, I’m not interested in developing a powerful brain. All I’m after is just a mediocre brain, something like the President of the American Telephone and Telegraph Company. —Alan Turing Through pride we are ever deceiving ourselves. But deep down below the surface of the average conscience a still, small voice says to us, something is out of tune. —Carl G. Jung n 1876 Alexander Graham Bell received US patent valuable tool: a toy whistle included in Captain Crunch cereal boxes that number 174,465 for his “improvement in telegraphy,” produced the exact signal—an au- dible tone with a 2,600-Hz triggering a revolutionary change in human com- frequency—required to disrupt tele- phone signaling systems and take munications and the emergence of a new industry with control of the telephony trunk. Call- I ing a random phone number and technology at its very foundation. Today, more than 130 years blowing the whistle at any point dur- ing the call would grant trunk con- IVA´N ARCE after the telephone’s invention, we anecdotes, and facts that link known trol to the caller and open up the Core Security face the difficult task of reconciling personalities with security and pri- PSTN’s front gate. Technologies the prodigal children of the two vacy improvements and setbacks in The practice of exploring, ex- great men quoted above within the the telephony industry. perimenting, and exploiting PSTN confines of our computer networks. In 1971, for example, Steve Woz- and telephone equipment vulnera- The assignment is far from easy, niak (www.woz.org/letters/general/ bilities came to be called phreaking, considering that men from tele- 03.html) and Steve Jobs jerry-rigged and phreakers soon learned that phony and computing worlds have an ingenuous device called the “Blue messing around with a telephone substantially different philosophies, Box,” which gave its users control of company’s assets didn’t necessarily idiosyncrasies, technologies, busi- long-distance trunks on the public lead to success stories or happy end- ness models, entry barriers, and op- switched telephony network (PSTN) ings. Draper was arrested on charges erational characteristics. by manipulating the session teardown, of toll fraud in 1972 and sentenced to The clash between these two call routing, and session establishment five years’ probation; later, in 1977, worldviews in the realm of computer protocols (http://en.wikipedia.org/ he was arrested again and convicted networks already plagued with secu- wiki/Blue_box). The Blue Box of wire fraud. He made better use of rity and privacy concerns is a fertile proved to be a useful tool for explor- his idle time by writing EasyWriter, ground for both offensive and defen- ing a PSTN’s obscure and propri- one of the earliest word processor sive information security practition- etary corners and making prank calls programs for Apple and IBM PC ers. In this installment of Attack or engaging in phone fraud in the computers. In the years to come, Trends, I delve into the new security form of “free” long-distance calls. It many other phreakers and hackers and privacy challenges the ongoing also demonstrated the commercial would follow similar paths. widespread adoption of IP telephony viability of new types of electronic In the 1980s, the advent of PCs and voice over IP (VoIP) pose. consumer products: Wozniak and and the general availability of rela- Jobs went on to found Apple Com- tively low-cost modems popularized Phreaky styley puter in 1976. by bulletin board systems (BBS) Arguably, many of today’s informa- In his account of the Blue Box helped a new generation of com- tion technologies, defensive security story, Wozniak cites an inspiring and puter users explore the confines of mechanisms, and attack patterns supposedly fictional article featuring both their own computers and the came from organizations and indi- Joe Engressia and John Draper that vast technological world that lay at viduals with deep roots in the appeared in Esquire in 1971 (www. the end of the phone line. Telephony telecommunications world of the webcrunchers.com/crunch/esq- companies worldwide operated 1970s and ’80s. The information se- art.html). Draper was called “Cap- business-oriented data networks on curity folklore is filled with stories, tain Crunch” because of his most the physical circuits of their PSTNs 80 PUBLISHED BY THE IEEE COMPUTER SOCIETY ■ 1540-7993/06/$20.00 © 2006 IEEE ■ IEEE SECURITY & PRIVACY Attack Trends using the ITU-T X.25 protocol suite 1990s. As the process unfolds, it’s in- tion assumption and expose entire for wide area networks (WANs) over creasingly obvious that security and telephony networks to the whim of phone lines (http://en.wikipedia. privacy concerns, attackers, and at- technically savvy users. The Blue- org/wiki/X.25). Interconnectivity, tack patterns have carried over from Boxing phreaker exploited the fact open protocols, and free access to both the telephony and computer that telephony trunks were operated data networks belonged to “toy net- network worlds. via in-band signaling, a system in works” such as the Internet, not the which network command and con- serious business-oriented infrastruc- Like Ma Bell, I’ve got trol and user data is sent over the same tures of X.25 networks. the ill communications medium. Abuse of in-band signaling In this context, several publica- A cursory review of the foundations prompted the move to out-of-band tions, such as Phrack (www.phrack. of PSTNs and IP-based networks signaling systems such as the Com- org) and 2600 The Hacker Quarterly reveals two opposing views on how mon Channel Interoffice Signaling (www.2600.org), and organizations to use technology for voice and data (CCIS, or Signaling System 7 as it such as the German Chaos Com- communications. The telephony came to be known internationally puter Club (www.ccc.de) and the networks were built on the assump- [http://en.wikipedia.org/wiki/ Dutch Hack-Tic Group (www. tion of complete ownership of al- Signalling_System_7]), which is an hacktic.nl), emerged as the telltale most all communications. A handful effective countermeasure for separat- signs of a subculture linked together of providers deployed and ran com- ing signaling and voice circuits. via a string of BBSs, informal techni- munications over physical links and Nonetheless, Micah Sheer, Eric cal publications, prototypical chat tightly controlled international stan- Cronin, Sandy Clark, and Matt Blaze systems, and social gatherings. The dards and proprietary protocols. showed—more than a decade later— line separating harmless and legiti- Most important, these providers that in-band signaling vulnerabilities mate activity from harmful and illegal maintained closed networks whose remain a valid security and privacy deeds rapidly blurred and soon con- operational characteristics couldn’t concern today.1 fronted the apparent lack of legal, reg- be tampered with because users The use of computers and termi- ulatory, and technical preparedness to were physically isolated from the sys- nals to manage and operate tele- address security and privacy con- tems that controlled them. phony equipment and networks cerns. Science-fiction author Bruce The Blue Box story is a particular weakened another major premise— Sterling’s novel epitomizes the daz- example of how the discovery and that PSTNs were closed networks. zled and confused times of this new exploitation of design weaknesses in This proved to be invalid when the subculture and its clash with law and signaling systems invalidate the isola- equipment became remotely accessi- order (“The Hacker Crackdown: Law and Disorder in the Electronic Frontier” is available online at http:// gopher.well.sf.ca.us:70/0/Publi cations/authors/Sterling/hc). Meanwhile, the Internet and IP protocol suite marched on to become the de facto standard for interconnect- ing research and academic organiza- tions, building local area networks (LANs), and reaching out to the users who would transform it into a global nerve system for business and leisure. With it came a new crop of security and privacy problems: Web site de- facements, data privacy breaches, dis- tributed denial-of-service attacks, proliferation of computer worms and other malware, and spam. The convergence of voice and data communications over IP-based networks is developing steadily de- spite the iterative cycle of praise and dismissal that has raged since the mid www.computer.org/security/ ■ IEEE SECURITY & PRIVACY 81 Attack Trends ble via modems attached to regular, almost total disregard for security and work (www.ee.oulu.fi/research/ous although unlisted, phone lines. The an explicitly stated spirit of openness pg/protos/testing/c07/sip/). A year practice of systematically calling a set to foster interoperation among co- later, in April 2004, the UK Na- of phone numbers in search of an operative parties, which elicits a con- tional Infrastructure Security Coor- auto-answering modem attached to stantly changing threat model due to dination Centre (NISCC) worked a computer system became a popular the rapid development and adoption jointly with OUSPG to uncover hobby for home computer users. of new protocols, technologies, and multiple vulnerabilities in imple- War Games, a popular 1983 film, ex- applications. On the other hand, the mentations of the H.323 protocol posed this hacker “folklore” and in- technological foundations of tradi- suite that affect various vendors troduced the term war dialing (www. tional telephony networks indicate a (www.cert.org/advisories/CA- imdb.com/title/tt0086567). The conscious attempt to maintain con- 2004-01.html). The Secure RTP process was later automated with the trol of all the variables in an almost specification of March 2004 (www. development of ad hoc programs unchanged and unchangeable threat ietf.org/rfc/rfc3711.txt) seeks to ad- such as ToneLoc (www.textfiles.