VoIP Wars: Return of the SIP
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Özavcı, Fatih
NGN (Next Generation Network) is modern TDM/PSTN system for communication infrastructure. SIP (Session Initiation Protocol) Servers are center of NGN services, they provide signaling services. SIP based communication is insecure, because of protocol implementation. Based on this fact, NGN is not actually Next Generation. It can be hacked with old stuff, but a few new attack types will be demonstrated in this presentation. This presentation includes that basic attack types for NGN infrastructure, old school techniques for SIP analysis, a new hacking tool to analysis of SIP services and SIP Trust Hacking technique. Also a few fuzzing techniques will be explained in this presentation. SIP networks provide its services based on Trust Infrastructure. SIP Soft Switches trust each other and accept calls from trusted SIP servers. A new technique will be demonstrated in this presentation, Hacking Trust Relationships Between SIP Gateways. SIP trust will be detected and hacked with a sip trust analyzer tool. For explaining basic attack types, a few tools will be demonstrated such as footprinting, register, enumerator, bruteforcer, call analyzer and SIP proxy. Another dangerous thing is outdated software in NGN infrastructure. VoIP devices have responsibilities to serve signaling such as MSAN, MGW and Soft Switches. They support SIP protocol with vulnerable software which should be analyzed. New fuzzing techniques such as Response based fuzzing, MITM fuzzing and proxy tool usage will be explained. Fatih Ozavci is a Security Researcher and Consultant of Viproy Security, Turkey. He is author of Viproy VoIP Penetration and Exploitation Testing Kit, also he has published a paper about Hacking of SIP Trust Relationships. He has discovered many unknown private security vulnerabilities, design and protocol flaws in VoIP environments for his customers. Also he analyzes VoIP design and implementation flaws, and helps to improve VoIP infrastructures as a service. While Fatih's primary areas of expertise are VoIP penetration testing, mobile application testing and IPTV testing, he is also well versed at network penetration testing, web application testing, reverse engineering, fuzzing and exploit development. In addition to that, he is a well-known speaker at many security events in Turkey. He is one of the speakers of Athcon 2013 and Blackhat Arsenal USA 2013, he will present his VoIP research and tools.
 First of all, my apologies about my English level. It's Yoda level and it's a Jedi tradition. Just forgive me. I'm Fatou Zawjin. I'm a penetration tester for 13 years. My special expertise on voice over IP servers, voice over IP infrastructure, mobile applications, also other ones. I'm Otroff, Viproy Voice Over IP penetration testing kit. Also I published a small paper about SIPTRA's relationships hacking. Also I demonstrated Viproy Voice Over IP penetration testing kit yesterday in Blackhead Arsenal. Anyone from Blackhead Arsenal here? Okay. We should wrap up this Viproy part. Viproy is a penetration testing kit and I will discuss a few advanced attacks and Viproy have a few models to demonstrate or exploit these attacks. And this is a small Viproy demonstration. Viproy has a few models, time models right now, but I'm working on three models. It's a metasploit models pack. You can download and extract in metasploit root directory. So you can use it to discover SIP infrastructure, voice over IP infrastructure. You can collect information from SIP servers. Also you can get a few important things from SIP servers. Also you can enumerate target servers. Here is the Viproy in action. It has debug support. Also it has a verbal support. That means you can easily collect information from this debug data. Discovery can be used for collecting information. So we can use all methods, all SIP infrastructure and protocol methods in this collecting part and discovery part. So Viproy has register options, invite, subscribe and a few methods to discover features of SIP server. It's basically a SIP client, but a smart one. You can easily develop another model for your custom test or something else. It has a SIP library, actually metasploit RECS library. That's the register test. We can register an infrastructure or we can register a client or we can register a user using Viproy to a SIP server. Also we can initiate calls with a user or without a user or a SIP proxy or not. Also we have a few headers in request so we can manipulate these requests and it's headers to bypass billing, to bypass restrictions of SIP ACS or SIP firewalls. This is a basic demonstration, basic features of Viproy. I will talk about these basic features now but I will discuss a few advanced attacks in this session. Also I have another demo at last of this presentation and I will talk about this demo in a little bit. I will talk about this last of this presentation for this advanced attacks. It's really hard to get picked to speak at Defcon. Let's give them a big round of applause. So this is his first time speaking so we need him to do a shot on stage. Okay, cheers. Difficult price. Do you need another one? No, not now, maybe later. Alright, thanks a lot. Thank you guys. I was nervous and I'm fine right now. So, okay. We should pass this part, this action. Okay, we have a few people are coming. We can start actual presentation. You can watch this video, what I just played. It's already in YouTube. Also, I played this video in many security conferences to show Vipro's basic features and basic attack abilities. So, I will discuss these attacks and how can we use these attacks to bypass security features of CIP servers. And this is my agenda today. Discovery footprinting, collecting information, initiating a call, initiating a bypass for CDR or billing or restrictions or something else. Also, we have another attack, CIP bonus attack. I will explain it. Also, fake services and MITM. Yeah, we have another model for CIP proxy for MITM thing. Also, CIP servers should be available 7.24. So, we can attack them using those features or something else. Also, we have another feature, hacking CIP trust relationships because they trust each other. So, we can act like just one. Also, we can use these CIP features or CIP trust hacking features to attack another client, a specific mobile client and other desktop client. Also, fuzzing in advance, another subject for us. I will discuss a few fuzzing features. Autoscopies, actually RTP. I will add RTP features later. Also, additional services are not subject. Also, XML or JSON based supporting services is not required for this presentation. CIP is initiation protocol. It's just a sign-in protocol for NGN services or CIP based telephony services. Next generation network is post-modern TDM devices. Actually, sorry, HP blade-like systems. They have three or maybe more soft switches, RTP proxies, CIP proxies or something else. So, they should connect M-SAN or MEDUG-2P devices. I will show an infrastructure for this sample. So, CIP and MEGAGO protocol, also RTP, they are part of this NGN infrastructure. Also, CIP should be implemented securely, this NGN platforms. So, we will hack this CIP protocol and we will hack this NGN infrastructure. They use next generation network term, but I believe it's not because CIP is old protocol. CIP has many security weaknesses and we will discuss in this presentation these weaknesses. This is sample CIP server in your network. If you have a network, commercial network, it should be placed just like that. By the way, commercial services are completely different. This is sample next generation network infrastructure. CIP server, also known as soft switch, part of this infrastructure. STP servers, also other servers such as VAS or DBI or CDR, these servers should be connected with soft switch. Also, M-SAN devices and MEGAGO devices should be implemented for end-point termination. For between M-SAN mediated devices and soft switches, the protocol is MEGAGO. Other connections, especially redirecting calls between soft switches, it should be CIP. Also, you should know you used many soft phone applications in your mobile phones. That means you already have CIP services and you are a customer of a CIP provider. But here's the thing. They think they are secure, but it's not. Especially their infrastructure is vulnerable. This infrastructure not closed, but they think it's closed. Actually, it's open physical access. Also, you can easily manipulate end-point terminators such as MEGAGO devices, smart modems or something else. They think abusing voice over IP requires specific knowledge. That's no longer the case with VEPRO. Because we have many features to easily test these CIP servers' features and security. Also, they focused on toll-based attacks, toll throughout or something else. But we have many attacks, spying, phishing, surveillance, or DDoS attacks, or attacking actual mobile clients or desktop clients. Also, value-added services are another important vulnerable servers. Also, they think they are vulnerable devices, well-confirmed and securely. They are vulnerable. They use all softwares. They use actually legacy softwares. Solaris 5 or Linux Slackware 2.1 or something else. So we can easily bypass and exploit them. But that is not our real subject. We will discuss specific one, CIP protocol. VEPRO is a Vulcanish word. That means call. VEPRO has many models to test CIP servers' security. So we can actually initiate a few advanced attacks and mostly all basic attacks for these target CIP servers using VEPRO's models. Also, it has custom header support. It has authentication support, but in many ways. It has proxy authentication, server authentication for different hashing algorithms and a few ones. Also, I have a few new models such as Thrust Analyzer, short message service tester, or bounce scan model, DDoS initializer, or directly MITM proxy tool. We can use this tool to test attacks which we will discuss now. Basic attacks are important. They are not new, but we have no sufficient tool to analyze this type of attacks. So Androgochal left CIP wishes. Also, CIPshack and other tools, not sufficient for penetration testing of CIP servers. I should create another one because I need it. So I create VEPRO to analyze security of CIP servers, especially their features, discovering CIP servers, enumerating CIP servers, collecting remote users, internal numbers, or clients, brute force attacks for internal numbers, users with a password list or not. Also, identifying specific numbers, identifying value added services, or something else. If you use this test after authentication, you have no choice except VEPRO. By the way, brute forcing or MITM features, they are required to test special features of CIP security. Also, we can initiate direct in-mode attacks. We can initiate in-mode spoofing attacks, or we can initiate proxy direct in-mode attacks. So we can easily bypass CDR records or ACS or maybe in-mode things. VEPRO easily automate this type of attacks. This is basic discovery thing. This discovery step is basic, just like other penetration testing types. We should send a request and we will wait for response to analyze. So we can send options, register in my subscribe message, or all methods. So we have all in VEPRO. Another one is we should analyze headers in response. So left side, generic headers, and the right side, proxy headers and warnings. We can collect many information from these headers. M-SAN devices, invoice information, remote service software, or it's vulnerable or not. Register is another important test because many value-added services have no authentication. Another thing is these specific services or specific trunks or specific gateways has no authentication to speed up the connection. So we can initiate register attack to detect this no authentication services. Also we can register our specific port and IP address to initiate row attacks, such as row fuzzing. We will discuss in fuzzing section. But you should know, CIP servers have many authentication skills. So if it has an authentication, just like that, it waits your registration and it send a privileged ACL or it accepts your specific IP address and port for other requests without authentication. If this type of authentication is available, you can register your specific port and IP address to initiate other attacks, such as directing might, spoofing, or fuzzing things. By the way, register attack could be used for brute force or something else. We have many more attack type. Also we can bypass many things using proxy headers or a few specific features, such as changing from field, changing contact field, adding specific proxy headers, such as charging vector or changing identity over proxy headers, such as P asserted identity, calling party ID, or P preferred identity. These headers could be used to bypass billing or security ACLs or CIP specific firewalls, acting just like another CIP proxy. We can use these attacks. We have another attack, just really invite or update. We can send really invite request or update request during a call to change its charging vector, change its billing features. So we can use these features. Also you can develop specific tool or specific model for VEPRO. Invite request issues just like that. We will send an invite and we will get a specific response. We can change many headers. So we can easily bypass rules, protect it or not. Specific headers I've already mentioned. Also it's just basic usage. But we will use invite for specific tests, for another test, just trust analyze or something else. This is CIP bounce attack. It's similar to FTP bounce attack. If remote target has a proxy support, we can use it to scan other servers which is trust or not. So we can use it basically. Here are the screenshots. This tool exposes user agent or servers of fair, remote servers and untrusted ones. It works just like that. We will send a register or option or invite request to target remote server. Also we will change its real or URI to connect another one. So we can collect this information. It's important for us because remote servers and front-end servers are well protected. And this server has many call ACLs. So we can use this remote targets if it has a proxy support, scan other specific features and other inaccessible servers. Also we can initiate other attacks such as CIP trust relationships. Also just now I should mention another thing. I have a friend for you. I will mention after the video, but I already shot. So this is my friend. It's a gift for best question. It's five-year-old Turkish record. I'm from Turkey, as you know. So if you shot me a good question, you will have this ball. If we will have no time to create QA section, you will find me at a Chile bar or QA section or just push me or attack me to ask a question. So we will continue again. Fake services and other subjects. We should discuss about fuzzing features or specific MITM attacks. Because our regular CIP clients, generic CIP clients, has no features to bypass billing or security features. Also it has no support to invite spoofing. So we will add MITM tool. We can change our client's features. For example, adding MITM support, specific proxy headers support to bypass billing. Also we can use this feature to fuzz CIP clients or servers. We can easily change specific data with fuzzing requests. So we will have a few crash from CIP clients or servers. Fake servers is not yet ready. Not ready yet. By the way, MITM is ready. I updated the repository. So you can easily download it and you can use it. This MITM feature is useful for testing or adding specific features. You can use it freely. But I should mention, if you use it to collect information, collect credentials from clients such as MITM attacks or something else, you should use ARP scan or ARP spoof or VLAN hopping attacks. You should be a man in the middle to collect this information. Also those is another important thing when we will discuss about CIP servers. It's not server. It's a business. So money is really important for them. So we can attack their availability. Lacking all users if they have account locking policy. Also we can initiate many calls at the same time. So we can overflow call limits of server. Or we can ring all clients at the same time. It's possible. So we can use this those things easily. By the way, we can use these attacks to bypass a few features. For example, if you need to act just like with a CIP proxy, you should disable it. So you can use these tools to disable or unresponsive this remote CIP server. By the way, we have another attack. CIP servers send many responses. It's an RFC. So we can initiate a bogus request. For example, unauthenticated invites or something else. They will send us many responses. 10 plus, 20 plus, maybe more. So we can send IP spoofed requests to target CIP servers. So this remote CIP server will send responses to another DDoS target. Just like that. So we can search many servers, many CIP servers, and we can collect all of them to initiate a DDoS attack. You should remember all CIP servers should contain many CIP servers for gateway connection, for international connection, for redirection or backup. So we can use all of them in same network. And acting another one we cannot access. Also, trust relationship hacking is another subject. We can act just like CIP proxy. So we can act and we can initiate call, we can send messages, or we can attack mobile clients via these CIP trust relationships. Engine servers should trust each other. Because TCP's, slow and TLS or other encryption are slow. By the way, they require many CIP usage. So engine infrastructure and vendors prefer UDP based CIP authentication and UDP based trust. So we can attack just like CIP proxy or something else. We need a specific information for this attack. We should have an internal number. Actually we should be a customer of this service because we should have a software or hardware client to view caller ID. We will spread IP spoofed and port spoofed packets, this target server. And if this server trust other IPs, there will be a call and we will learn its basic IP address and port. It's in baby steps. We should find trust CIP networks, mostly B class. We should send request, invite request for each IP and port. That means 60,000, maybe more requests. If this server, target server accepts one of them, we will have a call. But we will have no idea about which one is trusted. Here is the thing. We have a spoofing section. So I will add IP and port section in front field. That means when we will have a call, we should see which IP and port is trusted in front field and calling number. Okay. Here is the demo. There is an attacker. Attacker have no idea about Ankaras or Istanbul IP addresses and networks. He should know only B class network, maybe C class network. He should have a soft client from eSmir server, this production server. He will initiate IP spoofed packets from this field, just like sending from Istanbul or Ankara. And when we have a call, we will see IP address and port. That means eSmir trusts Istanbul IP address and port. Okay. How can we use it? What? We can initiate a call. If we have a specific IP address and port, we can send specific IP address and port and we can send specific front field. And we can initiate a call. So it's an in mind spoofing also. It's CDR and building bypass. By the way, probably you should ask or you will ask, it's just one package and we used IP spoofing and we have no responses. And how the call works? How will it resume? It's not. All required is we have a packet to send another one. For example, internal number 101. One packet is sufficient for main attacks. I will show you. By the way, in message protocol, a message method has no resume or no state. So you can send this message, short message or something else to the server. Just like came from Istanbul or something else. That means you can exploit specific voice over IP features, voicemail box features, value edit services, just like send a register request for us with short message service. Invoiced me at this month. We can spoof this message. So we can change billing features or we can act in a few features. I'm not here redirect me for something else. Okay, just send us a message. Which one is required or where you will be available. Okay, redirect space, my internal number. This is a small message. We can send it. So we can handle all calls. It's possible. By the way, we can use it to initiate those attacks, the low service attacks. For example, ringing all clients by passing a few features, initiating many calls to overloading servers or VES services or CDR fields. By the way, we can attack specific mobile clients or desktop clients. When we send this in-mind request or message request, we have a few features. From name, contact fields will be same. We can send this request to remote server and redirect these fields to client. So we can fuzz it or we can crash it with many AAAs in front field or from name field or contact field. Also we have message support. So we can exploit this vulnerability over message too. Also maybe, you know, CIP and STP has many features. So this type of STP request or STP content should be redirected. Also mine time support should be available. And you can manipulate mine types or its contents of this request to crash mobile application. These clients trust remote IP address and port. So we can initiate IP spoofing easily. See I crashed an application. Other iPhone, CIP client, you can download it from app store. Has a vulnerability. It has no border control in front field. So we can send 550 charts in this field and it will crash. It will be crashed. So we can exploit it. Okay, we should summarize and collect it. We can send a packet from Istanbul. We have no idea and we cannot access this Istanbul to Izmir, the production server. We have its IP address, yes. But it will redirect this call to another one, something else. We have no idea its IP address. But it has internal number, just your cell number or something else. So there is no user interaction. The application will crash. There is a client attack. So many applications can be vulnerable, this type of attacks. Asterisk has a limit for this front field. Only 1,000 charts maybe more. By the way, CIP sex or other commercial products has no restriction for this front field. So we can use this front field, from name field, contact field or other mine types to crash specific application. Also we have fuzzing. Anybody love fuzz? But fuzzing is completely different in CIP protocol. You have many fuzzers. But these fuzzers are old. And it's really important because vendors use these old tools to evolve their products. So you have no vulnerabilities to find using these tools. You should change your perspective and vision. We can fuzz it in many ways, acting just like CIP server, CIP client, MITM attack or just like acting like proxy or something else. But old school fuzzing is not sufficient. Request based and response based fuzzing difference, a few differences. Request based fuzzing is popular and we have many tools for request fuzzing. But they have no state feature. They cannot track all call and they cannot fast during a call. Our newest CIP fuzzing tool published in DEF CON 2007. So we have no new tool almost six years. We can develop our specific fuzzing tool. Especially for response based fuzzing. So we can use these features in the CIP library. We can initiate specific fuzzing features. How about smart fuzzing? Smart fuzzing should be real smart. It should have state support. It should have many methods such as subscribe, act, frag or invite, re-enlight, update. We have no support in meta tools. Also fuzzing after authentication is completely different thing because we have no tool to fast remote servers after authentication or read authentication. So we have another thing. Yes, fuzzing is cool, especially crashing an application. But in CIP servers, we should fast specific numbers for value-added services. Detecting its features, directing free call features or directing a few specific things. So you can easily create your basic fuzzer. Okay, Viproy, how it helps you? It is a basic CIP library. A few models have a dumb fuzzing support. I will show you. Also we have custom header support. So we can easily bypass meta thing before fuzzing. Also let's go on the Tvent lines maybe more. We can easily develop our tools. Also it has raw request support so you can combine it with your generic fuzzer. It's really free. Fuzzing CIP servers is request based. Okay, you already knew this request based fuzzing and I will bypass it. But you should know headers should be fast. Proxy headers or something else. Okay, here's the thing. Response based fuzzing is not popular. Also there is no tool to fast response features of CIP server. Just imagine you have two clients. One for acting just like remote CIP clients. Just one for attacking and fuzzing remote server during this call. You can initiate two clients separately and you can drive separately all of them. Also you can initiate many using this library. Starting one and starting two. After that you will initiate a call from starting two and target is one. Also you can add re-invite fuzzing feature during this call. You can add STP fuzzing feature during this call. Also this response is important because when we use send a request to a server, server redirects the request to another client. If this client send bogus responses, this remote server should assess and analyze and execute this response. 200 okay, such as. So we can send bogus responses. So it's a specific feature. You can develop your tools using VEPRO. VEPRO has many features. So we have a few things to develop such as advanced fuzzing support, RTP support, TCP TLS support or minimal. By the way, it's MSF licensed so you can download it freely. You can change it. You can develop your tools with this library. That's it. I will show another demo. This demo prepared to show SIP bounce attack, hacking SIP trust relationships, directing trust servers, initiating a fake call. After that, crashing a mobile client. This is a sample. I have a network, actually a small network, three SIP servers and four SIP clients. We can initiate this SIP bounce attack to the date servers and clients. Do it or not. We can use remote SIP proxy server. We will have two SIP servers now. One is ours. Another one is inaccessible for us. Also we have another range, 200 and 210. I will set this range to the date. Remove SIP servers and clients during the test. As you see, there are many SIP services. One of them SIP server, other SIP clients. SIP trust hacking is basic and old method, but we can use it easily for engine platforms, especially in local network. We can easily break physical network with smart modems, hacking or physical hacking, breaking locks or something else. We can initiate this attack. Also SIP services, also vulnerable, this type of attacks. SIP services, trust hacking, should be prepared with a specific target range. I set SIP server, the remote server, source remote host, its potential network. Also I can set a port range because they can use any ports for trust or something else. Also we should set interface for IP spoofing and a low request. Internal number 103 and we will initiate this attack. If you have a number, you have IP or something else, we will learn which host is trust. As you see, 202 and its port 5060 is trusted. It's a pair, it's a port for restructuring on ACN. So I can set specifically this one and I will initiate a call. This is trusted host and I set from field for in my spoofing. I can write anything, I write okupaygezi. If you already knew gezeppar resistance in Turkey, it's a tribute. By the way, if you don't know, you can search this tag in Twitter. As you see, we have a call. Also we can crash mobile application. This mobile application is Adore in iPhone. You can download it from App Store. I downloaded it and I initiate a secure shah session left side and I start a debugger and I crash it with a right terminal. I set only set action call. I set from field to Fuzz features. For example, set from Fuzz 550. Also I will set to field, that means our destination, our internal number removed. So I initiate a debugger. You can watch this video from YouTube too. It's available from Viproy WebKit's homepage. As you see, it's really easy to use because it's a metasploit module set. Left side, as you see, 138 is iPhone's IP address but I have no idea and I didn't set it in my tool. I initiate a debugger to debug Adore in iPhone application. It's PID. And the debugger will be initiated for this PID. It's continuing. When I start the attack, you should watch and you should see left side, a kernel email address issue. We have a memory corruption vulnerability and it's a basic dose attack. By the way, it can be exploited. You feel free to develop and exploit for this vulnerability using this tool. So you can download this presentation from my homepage, also Viproy's homepage. You can download this tool from Viproy's homepage, also it's GitHub source code section. By the way, you have a 15 minutes training video. You can use it, also these papers. Yeah, these people helped me to present. Also they encouraged me. I have many respect for them. Yes, I have only one minute. So I will be chilling out, cafe. I have this one for you. If you will come to ask specific question or smart question, I will give you. Okay? Thank you.
 First of all, my apologies about my English level.  It's Yoda level and it's a Jedi tradition.  Just forgive me.  I'm Fatou Zawjin.  I'm a penetration tester for 13 years.  My special expertise on voice over IP servers,  voice over IP infrastructure, mobile applications,  also other ones.  I'm Otroff, Viproy Voice Over IP penetration testing kit.  Also I published a small paper about  SIPTRA's relationships hacking.  Also I demonstrated Viproy Voice Over IP penetration  testing kit yesterday in Blackhead Arsenal.  Anyone from Blackhead Arsenal here?  Okay.  We should wrap up this Viproy part.  Viproy is a penetration testing kit  and I will discuss a few advanced attacks  and Viproy have a few models to demonstrate  or exploit these attacks.  And this is a small Viproy demonstration.  Viproy has a few models, time models right now,  but I'm working on three models.  It's a metasploit models pack.  You can download and extract in metasploit root directory.  So you can use it to discover SIP infrastructure,  voice over IP infrastructure.  You can collect information from SIP servers.  Also you can get a few important things from SIP servers.  Also you can enumerate target servers.  Here is the Viproy in action.  It has debug support.  Also it has a verbal support.  That means you can easily collect information  from this debug data.  Discovery can be used for collecting information.  So we can use all methods, all SIP infrastructure  and protocol methods in this collecting part  and discovery part.  So Viproy has register options, invite, subscribe  and a few methods to discover features of SIP server.  It's basically a SIP client, but a smart one.  You can easily develop another model for your custom test  or something else.  It has a SIP library, actually metasploit RECS library.  That's the register test.  We can register an infrastructure or we can register a client  or we can register a user using Viproy to a SIP server.  Also we can initiate calls with a user or without a user  or a SIP proxy or not.  Also we have a few headers in request  so we can manipulate these requests and it's headers  to bypass billing, to bypass restrictions  of SIP ACS or SIP firewalls.  This is a basic demonstration, basic features of Viproy.  I will talk about these basic features now  but I will discuss a few advanced attacks in this session.  Also I have another demo at last of this presentation  and I will talk about this demo in a little bit.  I will talk about this last of this presentation  for this advanced attacks.  It's really hard to get picked to speak at Defcon.  Let's give them a big round of applause.  So this is his first time speaking  so we need him to do a shot on stage.  Okay, cheers.  Difficult price.  Do you need another one?  No, not now, maybe later.  Alright, thanks a lot.  Thank you guys.  I was nervous and I'm fine right now.  So, okay.  We should pass this part, this action.  Okay, we have a few people are coming.  We can start actual presentation.  You can watch this video, what I just played.  It's already in YouTube.  Also, I played this video in many security conferences to show Vipro's basic features and basic attack abilities.  So, I will discuss these attacks and how can we use these attacks to bypass security features of CIP servers.  And this is my agenda today.  Discovery footprinting, collecting information, initiating a call, initiating a bypass for CDR or billing or restrictions or something else.  Also, we have another attack, CIP bonus attack.  I will explain it.  Also, fake services and MITM.  Yeah, we have another model for CIP proxy for MITM thing.  Also, CIP servers should be available 7.24.  So, we can attack them using those features or something else.  Also, we have another feature, hacking CIP trust relationships because they trust each other.  So, we can act like just one.  Also, we can use these CIP features or CIP trust hacking features to attack another client, a specific mobile client and other desktop client.  Also, fuzzing in advance, another subject for us.  I will discuss a few fuzzing features.  Autoscopies, actually RTP.  I will add RTP features later.  Also, additional services are not subject.  Also, XML or JSON based supporting services is not required for this presentation.  CIP is initiation protocol.  It's just a sign-in protocol for NGN services or CIP based telephony services.  Next generation network is post-modern TDM devices.  Actually, sorry, HP blade-like systems.  They have three or maybe more soft switches, RTP proxies, CIP proxies or something else.  So, they should connect M-SAN or MEDUG-2P devices.  I will show an infrastructure for this sample.  So, CIP and MEGAGO protocol, also RTP, they are part of this NGN infrastructure.  Also, CIP should be implemented securely, this NGN platforms.  So, we will hack this CIP protocol and we will hack this NGN infrastructure.  They use next generation network term, but I believe it's not because CIP is old protocol.  CIP has many security weaknesses and we will discuss in this presentation these weaknesses.  This is sample CIP server in your network.  If you have a network, commercial network, it should be placed just like that.  By the way, commercial services are completely different.  This is sample next generation network infrastructure.  CIP server, also known as soft switch, part of this infrastructure.  STP servers, also other servers such as VAS or DBI or CDR, these servers should be connected with soft switch.  Also, M-SAN devices and MEGAGO devices should be implemented for end-point termination.  For between M-SAN mediated devices and soft switches, the protocol is MEGAGO.  Other connections, especially redirecting calls between soft switches, it should be CIP.  Also, you should know you used many soft phone applications in your mobile phones.  That means you already have CIP services and you are a customer of a CIP provider.  But here's the thing.  They think they are secure, but it's not.  Especially their infrastructure is vulnerable.  This infrastructure not closed, but they think it's closed.  Actually, it's open physical access.  Also, you can easily manipulate end-point terminators such as MEGAGO devices, smart modems or something else.  They think abusing voice over IP requires specific knowledge.  That's no longer the case with VEPRO.  Because we have many features to easily test these CIP servers' features and security.  Also, they focused on toll-based attacks, toll throughout or something else.  But we have many attacks, spying, phishing, surveillance, or DDoS attacks, or attacking actual mobile clients or desktop clients.  Also, value-added services are another important vulnerable servers.  Also, they think they are vulnerable devices, well-confirmed and securely.  They are vulnerable.  They use all softwares.  They use actually legacy softwares.  Solaris 5 or Linux Slackware 2.1 or something else.  So we can easily bypass and exploit them.  But that is not our real subject.  We will discuss specific one, CIP protocol.  VEPRO is a Vulcanish word.  That means call.  VEPRO has many models to test CIP servers' security.  So we can actually initiate a few advanced attacks and mostly all basic attacks for these target CIP servers using VEPRO's models.  Also, it has custom header support.  It has authentication support, but in many ways.  It has proxy authentication, server authentication for different hashing algorithms and a few ones.  Also, I have a few new models such as Thrust Analyzer, short message service tester, or bounce scan model, DDoS initializer, or directly MITM proxy tool.  We can use this tool to test attacks which we will discuss now.  Basic attacks are important.  They are not new, but we have no sufficient tool to analyze this type of attacks.  So Androgochal left CIP wishes.  Also, CIPshack and other tools, not sufficient for penetration testing of CIP servers.  I should create another one because I need it.  So I create VEPRO to analyze security of CIP servers, especially their features, discovering CIP servers,  enumerating CIP servers, collecting remote users, internal numbers, or clients, brute force attacks for internal numbers, users with a password list or not.  Also, identifying specific numbers, identifying value added services, or something else.  If you use this test after authentication, you have no choice except VEPRO.  By the way, brute forcing or MITM features, they are required to test special features of CIP security.  Also, we can initiate direct in-mode attacks.  We can initiate in-mode spoofing attacks, or we can initiate proxy direct in-mode attacks.  So we can easily bypass CDR records or ACS or maybe in-mode things.  VEPRO easily automate this type of attacks.  This is basic discovery thing.  This discovery step is basic, just like other penetration testing types.  We should send a request and we will wait for response to analyze.  So we can send options, register in my subscribe message, or all methods.  So we have all in VEPRO.  Another one is we should analyze headers in response.  So left side, generic headers, and the right side, proxy headers and warnings.  We can collect many information from these headers.  M-SAN devices, invoice information, remote service software, or it's vulnerable or not.  Register is another important test because many value-added services have no authentication.  Another thing is these specific services or specific trunks or specific gateways  has no authentication to speed up the connection.  So we can initiate register attack to detect this no authentication services.  Also we can register our specific port and IP address to initiate row attacks, such as row fuzzing.  We will discuss in fuzzing section.  But you should know, CIP servers have many authentication skills.  So if it has an authentication, just like that,  it waits your registration and it send a privileged ACL or it accepts your specific IP address and port  for other requests without authentication.  If this type of authentication is available, you can register your specific port and IP address  to initiate other attacks, such as directing might, spoofing, or fuzzing things.  By the way, register attack could be used for brute force or something else.  We have many more attack type.  Also we can bypass many things using proxy headers or a few specific features, such as  changing from field, changing contact field, adding specific proxy headers, such as  charging vector or changing identity over proxy headers, such as P asserted identity,  calling party ID, or P preferred identity.  These headers could be used to bypass billing or security ACLs or CIP specific firewalls,  acting just like another CIP proxy.  We can use these attacks.  We have another attack, just really invite or update.  We can send really invite request or update request during a call to change its charging  vector, change its billing features.  So we can use these features.  Also you can develop specific tool or specific model for VEPRO.  Invite request issues just like that.  We will send an invite and we will get a specific response.  We can change many headers.  So we can easily bypass rules, protect it or not.  Specific headers I've already mentioned.  Also it's just basic usage.  But we will use invite for specific tests, for another test, just trust analyze or something  else.  This is CIP bounce attack.  It's similar to FTP bounce attack.  If remote target has a proxy support, we can use it to scan other servers which is trust  or not.  So we can use it basically.  Here are the screenshots.  This tool exposes user agent or servers of fair, remote servers and untrusted ones.  It works just like that.  We will send a register or option or invite request to target remote server.  Also we will change its real or URI to connect another one.  So we can collect this information.  It's important for us because remote servers and front-end servers are well protected.  And this server has many call ACLs.  So we can use this remote targets if it has a proxy support, scan other specific features  and other inaccessible servers.  Also we can initiate other attacks such as CIP trust relationships.  Also just now I should mention another thing.  I have a friend for you.  I will mention after the video, but I already shot.  So this is my friend.  It's a gift for best question.  It's five-year-old Turkish record.  I'm from Turkey, as you know.  So if you shot me a good question, you will have this ball.  If we will have no time to create QA section, you will find me at a Chile bar or QA section  or just push me or attack me to ask a question.  So we will continue again.  Fake services and other subjects.  We should discuss about fuzzing features or specific MITM attacks.  Because our regular CIP clients, generic CIP clients, has no features to bypass billing  or security features.  Also it has no support to invite spoofing.  So we will add MITM tool.  We can change our client's features.  For example, adding MITM support, specific proxy headers support to bypass billing.  Also we can use this feature to fuzz CIP clients or servers.  We can easily change specific data with fuzzing requests.  So we will have a few crash from CIP clients or servers.  Fake servers is not yet ready.  Not ready yet.  By the way, MITM is ready.  I updated the repository.  So you can easily download it and you can use it.  This MITM feature is useful for testing or adding specific features.  You can use it freely.  But I should mention, if you use it to collect information, collect credentials from clients  such as MITM attacks or something else, you should use ARP scan or ARP spoof or VLAN  hopping attacks.  You should be a man in the middle to collect this information.  Also those is another important thing when we will discuss about CIP servers.  It's not server.  It's a business.  So money is really important for them.  So we can attack their availability.  Lacking all users if they have account locking policy.  Also we can initiate many calls at the same time.  So we can overflow call limits of server.  Or we can ring all clients at the same time.  It's possible.  So we can use this those things easily.  By the way, we can use these attacks to bypass a few features.  For example, if you need to act just like with a CIP proxy, you should disable it.  So you can use these tools to disable or unresponsive this remote CIP server.  By the way, we have another attack.  CIP servers send many responses.  It's an RFC.  So we can initiate a bogus request.  For example, unauthenticated invites or something else.  They will send us many responses.  10 plus, 20 plus, maybe more.  So we can send IP spoofed requests to target CIP servers.  So this remote CIP server will send responses to another DDoS target.  Just like that.  So we can search many servers, many CIP servers, and we can collect all of them to initiate  a DDoS attack.  You should remember all CIP servers should contain many CIP servers for gateway connection,  for international connection, for redirection or backup.  So we can use all of them in same network.  And acting another one we cannot access.  Also, trust relationship hacking is another subject.  We can act just like CIP proxy.  So we can act and we can initiate call, we can send messages, or we can attack mobile  clients via these CIP trust relationships.  Engine servers should trust each other.  Because TCP's, slow and TLS or other encryption are slow.  By the way, they require many CIP usage.  So engine infrastructure and vendors prefer UDP based CIP authentication and UDP based  trust.  So we can attack just like CIP proxy or something else.  We need a specific information for this attack.  We should have an internal number.  Actually we should be a customer of this service because we should have a software or hardware  client to view caller ID.  We will spread IP spoofed and port spoofed packets, this target server.  And if this server trust other IPs, there will be a call and we will learn its basic  IP address and port.  It's in baby steps.  We should find trust CIP networks, mostly B class.  We should send request, invite request for each IP and port.  That means 60,000, maybe more requests.  If this server, target server accepts one of them, we will have a call.  But we will have no idea about which one is trusted.  Here is the thing.  We have a spoofing section.  So I will add IP and port section in front field.  That means when we will have a call, we should see which IP and port is trusted in front  field and calling number.  Okay.  Here is the demo.  There is an attacker.  Attacker have no idea about Ankaras or Istanbul IP addresses and networks.  He should know only B class network, maybe C class network.  He should have a soft client from eSmir server, this production server.  He will initiate IP spoofed packets from this field, just like sending from Istanbul or  Ankara.  And when we have a call, we will see IP address and port.  That means eSmir trusts Istanbul IP address and port.  Okay.  How can we use it?  What?  We can initiate a call.  If we have a specific IP address and port, we can send specific IP address and port and  we can send specific front field.  And we can initiate a call.  So it's an in mind spoofing also.  It's CDR and building bypass.  By the way, probably you should ask or you will ask, it's just one package and we used  IP spoofing and we have no responses.  And how the call works?  How will it resume?  It's not.  All required is we have a packet to send another one.  For example, internal number 101.  One packet is sufficient for main attacks.  I will show you.  By the way, in message protocol, a message method has no resume or no state.  So you can send this message, short message or something else to the server.  Just like came from Istanbul or something else.  That means you can exploit specific voice over IP features, voicemail box features, value  edit services, just like send a register request for us with short message service.  Invoiced me at this month.  We can spoof this message.  So we can change billing features or we can act in a few features.  I'm not here redirect me for something else.  Okay, just send us a message.  Which one is required or where you will be available.  Okay, redirect space, my internal number.  This is a small message.  We can send it.  So we can handle all calls.  It's possible.  By the way, we can use it to initiate those attacks, the low service attacks.  For example, ringing all clients by passing a few features, initiating many calls to overloading  servers or VES services or CDR fields.  By the way, we can attack specific mobile clients or desktop clients.  When we send this in-mind request or message request, we have a few features.  From name, contact fields will be same.  We can send this request to remote server and redirect these fields to client.  So we can fuzz it or we can crash it with many AAAs in front field or from name field  or contact field.  Also we have message support.  So we can exploit this vulnerability over message too.  Also maybe, you know, CIP and STP has many features.  So this type of STP request or STP content should be redirected.  Also mine time support should be available.  And you can manipulate mine types or its contents of this request to crash mobile application.  These clients trust remote IP address and port.  So we can initiate IP spoofing easily.  See I crashed an application.  Other iPhone, CIP client, you can download it from app store.  Has a vulnerability.  It has no border control in front field.  So we can send 550 charts in this field and it will crash.  It will be crashed.  So we can exploit it.  Okay, we should summarize and collect it.  We can send a packet from Istanbul.  We have no idea and we cannot access this Istanbul to Izmir, the production server.  We have its IP address, yes.  But it will redirect this call to another one, something else.  We have no idea its IP address.  But it has internal number, just your cell number or something else.  So there is no user interaction.  The application will crash.  There is a client attack.  So many applications can be vulnerable, this type of attacks.  Asterisk has a limit for this front field.  Only 1,000 charts maybe more.  By the way, CIP sex or other commercial products has no restriction for this front field.  So we can use this front field, from name field, contact field or other mine types to  crash specific application.  Also we have fuzzing.  Anybody love fuzz?  But fuzzing is completely different in CIP protocol.  You have many fuzzers.  But these fuzzers are old.  And it's really important because vendors use these old tools to evolve their products.  So you have no vulnerabilities to find using these tools.  You should change your perspective and vision.  We can fuzz it in many ways, acting just like CIP server, CIP client, MITM attack or just  like acting like proxy or something else.  But old school fuzzing is not sufficient.  Request based and response based fuzzing difference, a few differences.  Request based fuzzing is popular and we have many tools for request fuzzing.  But they have no state feature.  They cannot track all call and they cannot fast during a call.  Our newest CIP fuzzing tool published in DEF CON 2007.  So we have no new tool almost six years.  We can develop our specific fuzzing tool.  Especially for response based fuzzing.  So we can use these features in the CIP library.  We can initiate specific fuzzing features.  How about smart fuzzing?  Smart fuzzing should be real smart.  It should have state support.  It should have many methods such as subscribe, act, frag or invite, re-enlight, update.  We have no support in meta tools.  Also fuzzing after authentication is completely different thing because we have no tool to  fast remote servers after authentication or read authentication.  So we have another thing.  Yes, fuzzing is cool, especially crashing an application.  But in CIP servers, we should fast specific numbers for value-added services.  Detecting its features, directing free call features or directing a few specific things.  So you can easily create your basic fuzzer.  Okay, Viproy, how it helps you?  It is a basic CIP library.  A few models have a dumb fuzzing support.  I will show you.  Also we have custom header support.  So we can easily bypass meta thing before fuzzing.  Also let's go on the Tvent lines maybe more.  We can easily develop our tools.  Also it has raw request support so you can combine it with your generic fuzzer.  It's really free.  Fuzzing CIP servers is request based.  Okay, you already knew this request based fuzzing and I will bypass it.  But you should know headers should be fast.  Proxy headers or something else.  Okay, here's the thing.  Response based fuzzing is not popular.  Also there is no tool to fast response features of CIP server.  Just imagine you have two clients.  One for acting just like remote CIP clients.  Just one for attacking and fuzzing remote server during this call.  You can initiate two clients separately and you can drive separately all of them.  Also you can initiate many using this library.  Starting one and starting two.  After that you will initiate a call from starting two and target is one.  Also you can add re-invite fuzzing feature during this call.  You can add STP fuzzing feature during this call.  Also this response is important because when we use send a request to a server, server  redirects the request to another client.  If this client send bogus responses, this remote server should assess and analyze and  execute this response.  200 okay, such as.  So we can send bogus responses.  So it's a specific feature.  You can develop your tools using VEPRO.  VEPRO has many features.  So we have a few things to develop such as advanced fuzzing support, RTP support, TCP  TLS support or minimal.  By the way, it's MSF licensed so you can download it freely.  You can change it.  You can develop your tools with this library.  That's it.  I will show another demo.  This demo prepared to show SIP bounce attack, hacking SIP trust relationships, directing  trust servers, initiating a fake call.  After that, crashing a mobile client.  This is a sample.  I have a network, actually a small network, three SIP servers and four SIP clients.  We can initiate this SIP bounce attack to the date servers and clients.  Do it or not.  We can use remote SIP proxy server.  We will have two SIP servers now.  One is ours.  Another one is inaccessible for us.  Also we have another range, 200 and 210.  I will set this range to the date.  Remove SIP servers and clients during the test.  As you see, there are many SIP services.  One of them SIP server, other SIP clients.  SIP trust hacking is basic and old method, but we can use it easily for engine platforms,  especially in local network.  We can easily break physical network with smart modems, hacking or physical hacking,  breaking locks or something else.  We can initiate this attack.  Also SIP services, also vulnerable, this type of attacks.  SIP services, trust hacking, should be prepared with a specific target range.  I set SIP server, the remote server, source remote host, its potential network.  Also I can set a port range because they can use any ports for trust or something else.  Also we should set interface for IP spoofing and a low request.  Internal number 103 and we will initiate this attack.  If you have a number, you have IP or something else, we will learn which host is trust.  As you see, 202 and its port 5060 is trusted.  It's a pair, it's a port for restructuring on ACN.  So I can set specifically this one and I will initiate a call.  This is trusted host and I set from field for in my spoofing.  I can write anything, I write okupaygezi.  If you already knew gezeppar resistance in Turkey, it's a tribute.  By the way, if you don't know, you can search this tag in Twitter.  As you see, we have a call.  Also we can crash mobile application.  This mobile application is Adore in iPhone.  You can download it from App Store.  I downloaded it and I initiate a secure shah session left side and I start a debugger and  I crash it with a right terminal.  I set only set action call.  I set from field to Fuzz features.  For example, set from Fuzz 550.  Also I will set to field, that means our destination, our internal number removed.  So I initiate a debugger.  You can watch this video from YouTube too.  It's available from Viproy WebKit's homepage.  As you see, it's really easy to use because it's a metasploit module set.  Left side, as you see, 138 is iPhone's IP address but I have no idea and I didn't set it in  my tool.  I initiate a debugger to debug Adore in iPhone application.  It's PID.  And the debugger will be initiated for this PID.  It's continuing.  When I start the attack, you should watch and you should see left side, a kernel email  address issue.  We have a memory corruption vulnerability and it's a basic dose attack.  By the way, it can be exploited.  You feel free to develop and exploit for this vulnerability using this tool.  So you can download this presentation from my homepage, also Viproy's homepage.  You can download this tool from Viproy's homepage, also it's GitHub source code section.  By the way, you have a 15 minutes training video.  You can use it, also these papers.  Yeah, these people helped me to present.  Also they encouraged me.  I have many respect for them.  Yes, I have only one minute.  So I will be chilling out, cafe.  I have this one for you.  If you will come to ask specific question or smart question, I will give you.  Okay?  Thank you.
DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_0_311.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_312_1799.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_1800_2051.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_2052_3347.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_3348_3455.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_3456_3911.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_3912_4019.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_4020_4223.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_4224_4331.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_4332_4739.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_4740_4847.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_4848_5435.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5436_5507.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5508_5627.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5628_5747.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5748_5819.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5820_5927.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_5928_6251.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6252_6311.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6312_6563.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6564_6683.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6684_6743.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6744_6923.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_6924_7043.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_7044_7235.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_7236_8003.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_8004_10763.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_10764_12587.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_12588_12815.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_12816_14783.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_14784_17159.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_17160_18815.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_18816_21239.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_21240_21395.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_21396_22619.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_22620_24755.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_24756_26447.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_26448_27299.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_27300_28103.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_28104_32051.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_32052_33239.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_33240_34883.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_34884_35843.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_35844_36743.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_36744_40223.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_40224_41639.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_41640_43631.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_43632_45419.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_45420_47435.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_47436_49859.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_49860_51047.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_51048_54167.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_54168_54971.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_54972_55655.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_55656_58571.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_58572_58655.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_58656_60059.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_60060_62699.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_62700_67835.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_67836_68567.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_68568_69227.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_69228_69839.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_69840_70163.png DEF_CON_21_-_Fatih_Ozavci_-_VoIP_Wars_Return_of_the_SIP_d6cGlTB6qKw_70164_70768.png