SpringerBriefs in Electrical and Computer Engineering For further volumes: http://www.springer.com/series/10059 Iosif I. Androulidakis PBX Security and Forensics A Practical Approach Iosif I. Androulidakis Fokaias 8 15669 Papagou Greece ISSN 2191-8112 ISSN 2191-8120 (electronic) ISBN 978-1-4614-1655-5 ISBN 978-1-4614-1656-2 (eBook) DOI 10.1007/978-1-4614-1656-2 Springer New York Heidelberg Dordrecht London Library of Congress Control Number: 2012941227 © The Author 2013 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location, in its current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Printed on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com) To my parents Preface Apart from the public telephone network we all know, there is a parallel private network, consisting of private branch exchanges (PBXs). These are privately owned telephone exchanges that serve the communication needs of a private or public entity making connections among internal telephones and linking them to other users in the public telephone network. Modern societies rely on telecommunication infrastructure more than ever. PBXs serve Hospitals, Ministries, Police, Army, Banks, Public bodies/authorities, Compa- nies, Industries, and so on. This leads to the assumption that most—if not all—of the nations’ vital infrastructures rely on PBXs as well. As such, it is not an exaggeration to state that PBXs are part of a nation’s critical infrastructure. The purpose of this book, therefore, is to raise user awareness in regard to security and privacy threats present in PBXs, helping both users and administrators safeguard their systems. It is focused on practical issues and easy-to-follow examples, skipping theoreti- cal analysis of algorithms and standards. The book is more geared towards the tele- phony as a service and the devices themselves and not the underlying networks, so most of the contents are applicable to PSTN and VoIP alike. The contents are bal- anced, including both technical and nontechnical chapters. Amateur as well as experienced administrators will bene fi t from the overview of threats and the valu- able practical advice. They will also get to know various issues affecting the secu- rity of their PBX while they will also learn the fraudsters’ modus operandi. More advanced administrators will appreciate the technical discussions and will possibly try experimenting with the forensics and PBX control techniques presented in the respective chapters. Chapter 1 gives an introduction to PBXs and the scene, statistics and involved actors. Con fi dentiality, integrity, and availability threats are discussed in Chap. 2 providing the background for the highly technical discussion of Chap. 3 . Having examined the threats and the technical background, Chap. 4 deals with security. Forensics involving PBXs are covered in Chap. 5 . Concluding the book, Chap. 6 synopsizes the previous chapters. Closing, I would like to thank my family for all the support and love, my profes- sors in Greece and Slovenia for their mentoring during my studies, and the security vii viii Preface researchers all over the world I have met and collaborated with. They are all too many to be listed here but they know who they are! Last but not least, I would like to thank my Editor, Brett Kurzman. This is our second book published, after M obile Phone Security and Forensics and our collaboration has been splendid from day 1. I hope you will like this book as much I as enjoyed writing it. Ioannina, Greece Iosif I. Androulidakis Ph.D. Contents 1 Introduction ............................................................................................... 1 1.1 About PBXs ........................................................................................ 1 1.2 PBXs as Critical Infrastructure........................................................... 3 1.3 The Scene ........................................................................................... 5 1.4 The Players ......................................................................................... 6 1.5 Conclusion .......................................................................................... 7 References ................................................................................................... 8 2 Confidentiality, Integrity, and Availability Threats in PBXs ................ 9 2.1 Introduction ........................................................................................ 9 2.2 Confidentiality .................................................................................... 9 2.3 Integrity .............................................................................................. 13 2.4 Availability ......................................................................................... 16 2.5 Other Threats ...................................................................................... 19 2.6 Specifically for VoIP .......................................................................... 20 2.7 Conclusion .......................................................................................... 21 References ................................................................................................... 21 3 PBX Technical Details .............................................................................. 23 3.1 The PBX Basic Structure ................................................................... 23 3.2 Connection to the Outside World ....................................................... 23 3.3 Distribution Frames-Cabling .............................................................. 23 3.4 Physical Parameters ............................................................................ 24 3.5 PBX Boards and Hardware ................................................................ 27 3.6 PBX Sets ............................................................................................ 29 3.7 The CPU and the Management Port ................................................... 35 3.8 Software, Administration, and Management Suite and Station ......... 39 3.9 Low Level Tools ................................................................................. 41 ix x Contents 3.10 Database ........................................................................................... 42 3.11 Non-predicted Feature Interaction.................................................... 43 3.12 The Most Exploited PBX Services ................................................... 44 3.12.1 Direct Inwards System Access (DISA) .............................. 44 3.12.2 Voice Mail .......................................................................... 44 3.13 Complementary Systems .................................................................. 45 3.14 Other Dangerous Points.................................................................... 46 3.15 On VoIP Security .............................................................................. 46 3.16 On a PBX Malware .......................................................................... 48 3.16.1 Start .................................................................................... 49 3.16.2 Search for Targets ............................................................... 50 3.16.3 Verify the Target Is a PBX ................................................. 50 3.16.4 Enter-Break into the Target ................................................ 50 3.16.5 Upload Itself and the Payload ............................................ 50 3.16.6 Stay Stealth Until the Period of Activation (Hatch Period) .............................................. 51 3.16.7 Use the Resources Compromised to Find Other PBXs ............................................................ 51 3.16.8 Activate the Payload ........................................................... 51 3.16.9 Delete Itself and Logs ........................................................ 51 3.17 Conclusion ........................................................................................ 52 References ................................................................................................... 52 4 PBX Security ............................................................................................. 53 4.1 Introduction ...................................................................................... 53 4.2 Physical Security .............................................................................. 53 4.3 Nontechnical Security Issues............................................................ 54 4.4 Technical Security Issues ................................................................. 57 4.4.1 Local and Remote Management......................................... 57 4.4.2 Settings and Configuration ................................................. 59 4.4.3 Software and Hardware ...................................................... 60 4.4.4 Audits ................................................................................. 61 4.4.5 In Conclusion ..................................................................... 62 4.5 Direct Inwards System Access (DISA) Security .............................. 62 4.6 Voice Mail Security .......................................................................... 63 4.7 Automated Attendant Security ......................................................... 63 4.8 VoIP Security .................................................................................... 64 4.9 Logs .................................................................................................. 64 4.10 The Most Important Tasks ................................................................ 65 4.11 Advice for Simple Users .................................................................. 67 4.12 On a Collaborative Project: PRETTY (PRivatE Telephony SecuriTY) ........................................................ 67 4.12.1 User and System Requirements ......................................... 67 4.12.2 Research and Development ................................................ 68