This document introduces Abhijeet Hatekar, a security researcher who works for Microsoft. It discusses his work developing hacking tools like Chupa Rustam for analyzing the security of VoIP phones. Chupa Rustam can crack the passwords on Grandstream video phones and enable unauthorized video streaming by exploiting vulnerabilities. The document urges vendors to improve authentication and documentation, and warns users against reusing passwords or bringing video phones to private spaces. Hatekar is available to answer questions about his research.

1. http://null.co.in/ http://nullcon.net/

2. Remember these Titans???

3. Spying was a manual labor!

4. Spying has become digital

5. Meet
Abhijeet Hatekar

6. A Geek who works for
Who happens to be a hardcore
Linux Guy

7. Delves into…

8. Loves to develop
New Security /
Hacking Tools

9. Also, a good cook!

10. I was at

11. Where I developed tools like…
oat.sf.net

12. Presented papers at…

13. And active contributor for
a magazine

14. Can be followed at my blog
and reached at my website: www.chackraview.net

15. What
brings
me here?

16. What
brings
me here?

17. What
brings
me here?

18. What
brings
me here?

19. What
brings
me here?

20. Let’s go
a step
ahead

22. Unified Communication

23. VoIP is a piece of technical excellence

24. VoIP Benefits
Cost efficient
Flexibility
Feature rich
Simple and Scalable
infrastructure

25. Competition: a Goose
race
To provide rich features,
Slick boxes within slim
timeline; vendors often
overlook security issues.

26. VoIP Attack Vectors
Eavesdropping
Denial of Service(DOS)
Call Hijack
Call Teardown
Call Fraud
Media Manipulations
Codec Manipulation

27. What’s at stake???
Money
Data
Reputation and faith
&...

28. YOU

29. Let’s focus on
something
more
interesting!

30. Prologue

31. Major Global Video Phone
Solutions Providers

32. Why Grandstream???
Cheap
Reliable
Feature Rich

33. Features of
Grandstream Video Phone

34. nmap scan

35. The Awareness Hurdle
Non-aware
95%

36. The Hack Begins….

37. Login Authentication

38. Survey Facts
78% people do not change the default password.
Out of remaining 22%, 42.98% just increment a number.
e.g.Password1, admin2 etc.
Source: Symantec Inc.
The Password 75% of social networking username and password samples
collected online were identical to those used for email
leaks some accounts.
69.30% people write down their password to remember.
facts ☺ Source: www.securityweek.com
63% people do not change their password often.
Source: www.cnet.com

39. The Wireshark Trace

40. The Wireshark Trace

41. The Research

42. After burning the midnight oil over couple of smokes
Grey cells
Packet captures
I found out different interesting configuration variables.

43. The Research:
Mapping Configuration Variables
P2 = password
P97 = iLBC Frame size
P927 = Video packet size
P39 = local RTP port
P928 = ??? <interesting>

44. The Research
These variables correspond
to some features directly
affecting the Grandstream
phone.
Among all the variables,P928
caught my attention because
as soon as I set that variable.

45. The Research:
2nd nmap Scan

46. The Research
P928 starts RTSP server
on phone
Can stream video from
the video phone camera
User is not aware of this
and moreover
User cannot control it
from phone menu

47. Cracking SRTP Authentication
• Phone tries to authenticate RTSP
client
• http digest authentication mode
• QoP is only auth and not
auth_int(little safe)
• Vulnerable to MiTM and
password brute force attacks

48. So far I have not seen this
room getting into
the sleeping zone…
I believe then it’s not that
boring ☺

49. Synopsis
Crack web password
Enable RTSP Server
Crack RTSP authentication
Profit / fun

50. Presenting

51. Chupa Rustam Fundamentals
Written in “C”..
Uses libvlc
For Linux Platform

52. Generic Grandstream Remote administration
web cracking support of surveillance feature
Chupa Rustam
Features
RTSP password cracker SSL support

53. Getting back to
“something more
interesting”…

55. Titans are back…
with ninja skills!

56. Worldwide Usage of
Grandstream Video Phones
Grandstream GXV 3xx Series Clients

57. Lessons Learned for Vendors
Use strong authentication
mechanisms
Document all features and secure
them
provide features only if necessary

58. Lessons Learned for End Users
Change default passwords
to something better than
alphanumeric
There is no fix for the human
stupidity
DON’T bring video phones to your bedroom ☺

59. How can I get Chupa-Rustam?
http://tools.chackraview.net/chuparustam

60. Got questions???
Hit ‘em!

61. Thank You
&
Stay safe!
ahatekar@microsoft.com