home
    blog
    feed
    eyes
    info

Fri, 25 Aug 2006

ohrwurm-0.1 - an RTP fuzzer

ohrwurm is a small and simple RTP fuzzer, I tested it on a small number of SIP phones, none of them did withstand.
Features:

• reads SIP messages to get information of the RTP port numbers
• reading SIP can be omitted by providing the RTP port numbers, sothat any RTP traffic can be fuzzed
• RTCP traffic can be suppressed to avoid that codecs learn about the "noisy line"
• special care is taken to break RTP handling itself
• the RTP payload is fuzzed with a constant BER
• the BER is configurable
• requires arpspoof from dsniff to do the MITM attack
• requires both phones to be in a switched LAN (GW operation only works partially)

• ohrwurm-0.1.tar.bz2

ICMP3, and cisco insecurity

I am at ICMP3 a nice hacker's event meeting nice people and having fun with lots of HW and SW. I will give a speech tomorrow, for which I still have to prepare some slides.


I was assuming I can find a lot of VoIP/SIP HW here to play around with, but I was a little bit disappointed not to find too much. I had prepared a piece of SW to stress VoIP phones (later there will be more on this), I also had success on all of them (as in crashing them).

The only exception is a Cisco 7905 SIP phone, where I couldn't even get to the point of attacking the SIP stack or codecs. The market leader in IP networking HW has implemented a remote reboot procedure:

# arpspoof 194.150.169.59
44:44:44:44:44:44 ff:ff:ff:ff:ff:ff 0806 42: arp reply 194.150.169.59 is-at 44:44:44:44:44:44

CP-7905G
App Load ID
  CP7905080000SIP060111A
Boot Load ID
  LD0100BOOT021112A

validate HTML