I would like to answer you all together, as I was the one who started this thread, ASN1 is a simple data encapsulation, the problem occurs when the decapsulation procedure fails because of any reason. in the case at hand, the data slips into the code segment. My intention was not a worm that spreads by ASN1 but one that locates VoIP based communication and attacks it ! you can do a lot by inserting code into these devices that are software driven ! Here is a simple description of the h323 protocol, BASED ON ASN1, feel free to access any one of these items and use the exploit :-) End-Point: q931 - port 1720 - initial hand shake h225 - port 1720 - media capabilities negotiations for h245 h235 - port 1720 - negotiate security h245 - dynamic port - negotiate media real-time protocol, and data channel h45x - Waiting call, pressed keys (to save line bandwidth), etc. . RTP - (Real Time Protocol) dynamic ports UDP/TCP- transfer media codecs (video and audio), T38 (fax), T120 (data) T120 - Send files, share documents, etc. - implemented in netmeeting GateKeeper: H324 - Authenticate user for call * Long time didn't touch the VoIP so forgive me if I had a mistake somewhere in the Hxxx. Companies today have introduced the VoIP into their systems to save telephony resources, calls between offices and to manage&control their equipment (Telephony Service Providers) a worm can nest until it will find a VoIP infrastructure and attack, if it is "smart" it will take access of the infrastructure ! There is usualy a DIRECT CONNECTION between the internet --> LAN --> VoIP equipment ! In my humble opinion, we're not going to see an outbreak but some surgical attacks. I must underline that I don't know if all use the same parser, BUT, let me refer you to Berkley's SNMP protocol precedent that was copied and pasted everywhere with the exploit inside ... Sincerely, Zak Dechovich, Managing Director SecureOL Ltd. Mobile: +972 (53) 828 656 Office: +972 (2) 675 1291 Fax: +972 (2) 675 1195 -----Original Message----- From: Michal Zalewski [mailto:lcamtuf@ghettot.org] Sent: Tuesday, February 17, 2004 6:23 PM To: Gadi Evron Cc: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com; Zak Dechovich Subject: Re: [Full-Disclosure] ASN.1 telephony critical infrastructure warning - VOIP On Tue, 17 Feb 2004, Gadi Evron wrote: > ASN is what VOIP is based on, and thus the critical infrastructure for > telephony which is based on VOIP. > > This may be a false alarm, but you know how worms find their way into > every network, private or public. It could (maybe) potentially bring the > system down. Balooney. ASN.1 is not a network service, is a notation standard used in, among other things, some network protocols. A worm that targets one of the protocols, if is going to show up at all - some disagree with your assessment the vulnerability is "very easy to exploit", so perhaps it would be good to substantiate your claim - would not magically start attacking a wholly different protocol, where ASN.1 is used in a different way, just like this. Such a worm would have to target VoIP specifically to attack it successfully (and this is unlikely, as this is not a vector commonly open on desktop systems), for starters. Even then, a relatively small percentage of all VoIP applications, particularly the mission-critical ones, are running off of Windows, I suppose. The world is not going to end tomorrow. That is no say there is no risk; quite the opposite. An aggressive worm may quite efficiently bring down large parts of critical infrastructure by simply overloading systems and networks. But then, it would be no different from Nachi and whatnot, and there's nothing about ASN.1 to it. -- ------------------------- bash$ :(){ :|:&};: -- Michal Zalewski * [http://lcamtuf.coredump.cx] Did you know that clones never use mirrors? --------------------------- 2004-02-17 17:17 -- http://lcamtuf.coredump.cx/photo/current/
