Featured Research

from universities, journals, and other organizations

Computer scientists find vulnerabilities in Cisco VoIP phones

Date:
January 4, 2013
Source:
Columbia University Fu Foundation School of Engineering and Applied Science
Summary:
Researchers have found vulnerabilities in Cisco VoIP telephones, recently demonstrating how they can insert malicious code into a Cisco VoIP phone (any of the 14 Cisco Unified IP Phone models) and start eavesdropping on private conversations—not just on the phone but also in the phone’s surroundings—from anywhere in the world.

Cui designed the device above to plug into a Cisco phone and download malware.
Credit: Image courtesy of Columbia University Fu Foundation School of Engineering and Applied Science

Columbia Engineering's Computer Science PhD candidate Ang Cui and Computer Science Professor Salvatore Stolfo have found serious vulnerabilities in Cisco VoIP (voice over internet protocol) telephones, devices used around the world by a broad range of networked organizations from governments to banks to major corporations, and beyond. In particular, they have discovered troubling security breaches with Cisco's VoIP phone technology. At a recent conference on the security of connected devices, Cui demonstrated how they can easily insert malicious code into a Cisco VoIP phone (any of the 14 Cisco Unified IP Phone models) and start eavesdropping on private conversations -- not just on the phone but also in the phone's surroundings -- from anywhere in the world.

"It's not just Cisco phones that are at risk. All VoIP phones are particularly problematic since they are everywhere and reveal our private communications," says Stolfo. "It's relatively easy to penetrate any corporate phone system, any government phone system, any home with Cisco VoIP phones -- they are not secure."

Cui and Stolfo analyzed the phones' firmware (the software running in the computer inside the phone) and they were able to identify many vulnerabilities. They are particularly concerned with embedded systems that are widely used and networked on the Internet, including VoIP phones, routers, and printers, and have focused their research on developing new advanced security technology to protect these systems.

"Binary firmware analysis is commonly used to identify faulty software by the 'white hat' hackers and security scientists and researchers like our team," Stolfo says. "We performed this analysis to demonstrate a new defense technology, called Software Symbiotes, that protects them from exploitation."

Software Symbiotes is designed to safeguard embedded systems from malicious code injection attacks into these systems, including routers and printers.

"This is a host-based defense mechanism that's a code structure inspired by a natural phenomenon known as symbiotic defensive mutualism," Cui notes. "The Symbiote is especially suitable for retrofitting legacy embedded systems with sophisticated host-based defenses."

The researchers see these Symbiotes as a kind of digital life form that tightly co-exists with arbitrary executables in a mutually defensive arrangement. "They extract computational resources (CPU cycles) from the host while simultaneously protecting the host from attack and exploitation," explains Cui. "And, because they are by their nature so diverse, they can provide self-protection against direct attack by adversaries that directly target host defenses."

"We envision a general-purpose computing architecture consisting of two mutual defensive systems whereby a self-contained, distinct, and unique Symbiote machine is embedded in each instance of a host program," adds Stolfo. "The Symbiote can reside within any arbitrary body of software, regardless of its place within the system stack. It can be injected into an arbitrary host in many different ways, while its code can be 'randomized' by a number of well-known methods."

The Symbiote, which at runtime is required by its host to successfully execute in order for the host to operate, then monitors its host's behavior to ensure it continues to operate correctly, and, if not, it stops the host from doing harm. Removal, or attempted removal, of the Symbiote renders the host inoperable.

"The beauty of the Symbiote," says Cui, "is that it can be used to protect all kinds of embedded systems, from phones and printers to ATM machines and even cars -- systems that we all use every day."

Cisco has since released a patch to repair these vulnerabilities but it is ineffective. "It doesn't solve the fundamental problems we've pointed out to Cisco," Cui observes. "We don't know of any solution to solve the systemic problem with Cisco's IP Phone firmware except for the Symbiote technology or rewriting the firmware. We plan to demonstrate a Symbiote-protected Cisco IP Phone at an upcoming conference."

The research conducted by Stolfo and Cui was funded by DARPA (Defense Advanced Research Projects Agency), IARPA (Intelligence Advanced Research Projects Activity), and DHS (Department of Homeland Security).


Story Source:

The above story is based on materials provided by Columbia University Fu Foundation School of Engineering and Applied Science. The original article was written by Holly Evarts. Note: Materials may be edited for content and length.


Cite This Page:

Columbia University Fu Foundation School of Engineering and Applied Science. "Computer scientists find vulnerabilities in Cisco VoIP phones." ScienceDaily. ScienceDaily, 4 January 2013. <www.sciencedaily.com/releases/2013/01/130104155009.htm>.
Columbia University Fu Foundation School of Engineering and Applied Science. (2013, January 4). Computer scientists find vulnerabilities in Cisco VoIP phones. ScienceDaily. Retrieved September 30, 2014 from www.sciencedaily.com/releases/2013/01/130104155009.htm
Columbia University Fu Foundation School of Engineering and Applied Science. "Computer scientists find vulnerabilities in Cisco VoIP phones." ScienceDaily. www.sciencedaily.com/releases/2013/01/130104155009.htm (accessed September 30, 2014).

Share This



More Computers & Math News

Tuesday, September 30, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

Apple Releases 'Shellshock' Fix Despite Few Affected Users

Apple Releases 'Shellshock' Fix Despite Few Affected Users

Newsy (Sep. 29, 2014) Apple released a security fix for the "Shellshock" vulnerability Monday, though it says only "advanced UNIX users" of OS X need it. Video provided by Newsy
Powered by NewsLook.com
Do Video Games Trump Brain Training For Cognitive Boosts?

Do Video Games Trump Brain Training For Cognitive Boosts?

Newsy (Sep. 29, 2014) More and more studies are showing positive benefits to playing video games, but the jury is still out on brain training programs. Video provided by Newsy
Powered by NewsLook.com
New Facebook Ad Platform Goes Where You Go On The Web

New Facebook Ad Platform Goes Where You Go On The Web

Newsy (Sep. 29, 2014) Called Atlas, the platform allows advertisers to place ads based on Facebook info on sites outside of Facebook. Video provided by Newsy
Powered by NewsLook.com
Google Tightens Requirements For Android Manufacturers

Google Tightens Requirements For Android Manufacturers

Newsy (Sep. 27, 2014) Phonemakers who want to use Google’s software in their devices will have to stick to more stringent requirements. Video provided by Newsy
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:

Breaking News:

Strange & Offbeat Stories


Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile: iPhone Android Web
Follow: Facebook Twitter Google+
Subscribe: RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins