Featured Research

from universities, journals, and other organizations

Computer scientists find vulnerabilities in Cisco VoIP phones

Date:
January 4, 2013
Source:
Columbia University Fu Foundation School of Engineering and Applied Science
Summary:
Researchers have found vulnerabilities in Cisco VoIP telephones, recently demonstrating how they can insert malicious code into a Cisco VoIP phone (any of the 14 Cisco Unified IP Phone models) and start eavesdropping on private conversations—not just on the phone but also in the phone’s surroundings—from anywhere in the world.

Cui designed the device above to plug into a Cisco phone and download malware.
Credit: Image courtesy of Columbia University Fu Foundation School of Engineering and Applied Science

Columbia Engineering's Computer Science PhD candidate Ang Cui and Computer Science Professor Salvatore Stolfo have found serious vulnerabilities in Cisco VoIP (voice over internet protocol) telephones, devices used around the world by a broad range of networked organizations from governments to banks to major corporations, and beyond. In particular, they have discovered troubling security breaches with Cisco's VoIP phone technology. At a recent conference on the security of connected devices, Cui demonstrated how they can easily insert malicious code into a Cisco VoIP phone (any of the 14 Cisco Unified IP Phone models) and start eavesdropping on private conversations -- not just on the phone but also in the phone's surroundings -- from anywhere in the world.

Related Articles


"It's not just Cisco phones that are at risk. All VoIP phones are particularly problematic since they are everywhere and reveal our private communications," says Stolfo. "It's relatively easy to penetrate any corporate phone system, any government phone system, any home with Cisco VoIP phones -- they are not secure."

Cui and Stolfo analyzed the phones' firmware (the software running in the computer inside the phone) and they were able to identify many vulnerabilities. They are particularly concerned with embedded systems that are widely used and networked on the Internet, including VoIP phones, routers, and printers, and have focused their research on developing new advanced security technology to protect these systems.

"Binary firmware analysis is commonly used to identify faulty software by the 'white hat' hackers and security scientists and researchers like our team," Stolfo says. "We performed this analysis to demonstrate a new defense technology, called Software Symbiotes, that protects them from exploitation."

Software Symbiotes is designed to safeguard embedded systems from malicious code injection attacks into these systems, including routers and printers.

"This is a host-based defense mechanism that's a code structure inspired by a natural phenomenon known as symbiotic defensive mutualism," Cui notes. "The Symbiote is especially suitable for retrofitting legacy embedded systems with sophisticated host-based defenses."

The researchers see these Symbiotes as a kind of digital life form that tightly co-exists with arbitrary executables in a mutually defensive arrangement. "They extract computational resources (CPU cycles) from the host while simultaneously protecting the host from attack and exploitation," explains Cui. "And, because they are by their nature so diverse, they can provide self-protection against direct attack by adversaries that directly target host defenses."

"We envision a general-purpose computing architecture consisting of two mutual defensive systems whereby a self-contained, distinct, and unique Symbiote machine is embedded in each instance of a host program," adds Stolfo. "The Symbiote can reside within any arbitrary body of software, regardless of its place within the system stack. It can be injected into an arbitrary host in many different ways, while its code can be 'randomized' by a number of well-known methods."

The Symbiote, which at runtime is required by its host to successfully execute in order for the host to operate, then monitors its host's behavior to ensure it continues to operate correctly, and, if not, it stops the host from doing harm. Removal, or attempted removal, of the Symbiote renders the host inoperable.

"The beauty of the Symbiote," says Cui, "is that it can be used to protect all kinds of embedded systems, from phones and printers to ATM machines and even cars -- systems that we all use every day."

Cisco has since released a patch to repair these vulnerabilities but it is ineffective. "It doesn't solve the fundamental problems we've pointed out to Cisco," Cui observes. "We don't know of any solution to solve the systemic problem with Cisco's IP Phone firmware except for the Symbiote technology or rewriting the firmware. We plan to demonstrate a Symbiote-protected Cisco IP Phone at an upcoming conference."

The research conducted by Stolfo and Cui was funded by DARPA (Defense Advanced Research Projects Agency), IARPA (Intelligence Advanced Research Projects Activity), and DHS (Department of Homeland Security).


Story Source:

The above story is based on materials provided by Columbia University Fu Foundation School of Engineering and Applied Science. The original article was written by Holly Evarts. Note: Materials may be edited for content and length.


Cite This Page:

Columbia University Fu Foundation School of Engineering and Applied Science. "Computer scientists find vulnerabilities in Cisco VoIP phones." ScienceDaily. ScienceDaily, 4 January 2013. <www.sciencedaily.com/releases/2013/01/130104155009.htm>.
Columbia University Fu Foundation School of Engineering and Applied Science. (2013, January 4). Computer scientists find vulnerabilities in Cisco VoIP phones. ScienceDaily. Retrieved October 24, 2014 from www.sciencedaily.com/releases/2013/01/130104155009.htm
Columbia University Fu Foundation School of Engineering and Applied Science. "Computer scientists find vulnerabilities in Cisco VoIP phones." ScienceDaily. www.sciencedaily.com/releases/2013/01/130104155009.htm (accessed October 24, 2014).

Share This



More Computers & Math News

Friday, October 24, 2014

Featured Research

from universities, journals, and other organizations


Featured Videos

from AP, Reuters, AFP, and other news services

The Best Apps to Organize Your Life

The Best Apps to Organize Your Life

Buzz60 (Oct. 23, 2014) — Need help organizing your bills, schedules and other things? Ko Im (@konakafe) has the best apps to help you stay on top of it all! Video provided by Buzz60
Powered by NewsLook.com
Nike And Apple Team Up To Create Wearable ... Something

Nike And Apple Team Up To Create Wearable ... Something

Newsy (Oct. 23, 2014) — For those looking for wearable tech that's significantly less nerdy than Google Glass, Nike CEO Mark Parker says don't worry, It's on the way. Video provided by Newsy
Powered by NewsLook.com
Chameleon Camouflage to Give Tanks Cloaking Capabilities

Chameleon Camouflage to Give Tanks Cloaking Capabilities

Reuters - Innovations Video Online (Oct. 22, 2014) — Inspired by the way a chameleon changes its colour to disguise itself; scientists in Poland want to replace traditional camouflage paint with thousands of electrochromic plates that will continuously change colour to blend with its surroundings. The first PL-01 concept tank prototype will be tested within a few years, with scientists predicting that a similar technology could even be woven into the fabric of a soldiers' clothing making them virtually invisible to the naked eye. Matthew Stock reports. Video provided by Reuters
Powered by NewsLook.com
Internet of Things Aims to Smarten Your Life

Internet of Things Aims to Smarten Your Life

AP (Oct. 22, 2014) — As more and more Bluetooth-enabled devices are reaching consumers, developers are busy connecting them together as part of the Internet of Things. (Oct. 22) Video provided by AP
Powered by NewsLook.com

Search ScienceDaily

Number of stories in archives: 140,361

Find with keyword(s):
 
Enter a keyword or phrase to search ScienceDaily for related topics and research stories.

Save/Print:
Share:  

Breaking News:

Strange & Offbeat Stories

 

Space & Time

Matter & Energy

Computers & Math

In Other News

... from NewsDaily.com

Science News

Health News

Environment News

Technology News



Save/Print:
Share:  

Free Subscriptions


Get the latest science news with ScienceDaily's free email newsletters, updated daily and weekly. Or view hourly updated newsfeeds in your RSS reader:

Get Social & Mobile


Keep up to date with the latest news from ScienceDaily via social networks and mobile apps:

Have Feedback?


Tell us what you think of ScienceDaily -- we welcome both positive and negative comments. Have any problems using the site? Questions?
Mobile iPhone Android Web
Follow Facebook Twitter Google+
Subscribe RSS Feeds Email Newsletters
Latest Headlines Health & Medicine Mind & Brain Space & Time Matter & Energy Computers & Math Plants & Animals Earth & Climate Fossils & Ruins