VoIP phone systems at risk of Shellshock Bash attacks

The Shellshock Bash bug was found in a typical voice-over-IP (VoIP) phone system, opening up the possibility that many more of the business communication systems could be vulnerable if attacked.

The bug uncovered this week in a widely used component of Linux, Unix and Mac OS X was found in a VoIP phone vendor's session initiation protocol (SIP) server, Jaime Blasco, director of AlienVault Labs, said Friday. Because many vendors use similar servers, the vulnerability is likely widespread.

Blasco declined to name the vendor.

"I'm pretty sure that there are a bunch of them (vendors), if not a lot of them, that you can exploit," Blasco said.

A SIP server, which often runs on Unix or Linux, is the main component of a VoIP system for configuring and adding new phone hardware to the system. The server does not transmit or receive audio, which is typically handled by a media server.

Many SIP servers run GNU Bash, which is the component with the critical flaw. Bash, which stands for Bourne Again Shell, is the default command shell for the operating system.

The bug lets an attacker trick Bash into executing malicious command code by sending it via the Common Gateway Interface, an underlying component of the SIP server's administrative interface.

"Even if you don't have the username and password (for the SIP server), you can exploit the vulnerability," Blasco said.

Depending on the architecture of the phone system, an attacker could upload malware to the SIP server and gain access to a company's internal network, Blasco said. Also, once inside the phone system, a hacker could infect components that allow him to intercept communications.

Security researchers reported Thursday that hackers were trying to exploit Shellshock in Web servers. On Friday, firewall vendor Incapsula reported that in a 12-hour period, it recorded 725 attacks per hour against a total of 1,800 domains.

"This is pretty high for a single vulnerability," Tim Matthews, vice president of marketing at Incapsula, said.

The attacks originated from 400 unique IP addresses. More than half of the attacks started from China and the U.S.

In general, the attackers were running automated scripts from compromised servers in existing botnets in an attempt to add more systems to the network. Several botnet operators were using repurposed distributed denial of service (DDoS) bots in an attempt to exploit Shellshock.

Join the CSO newsletter!

Error: Please check your email address.

Tags VulnerabilitiesShellshockapplicationsbecaExploits / vulnerabilitiesdata protectionmalwaregnuShellsecurityddosAlienVaultGatewaysoftware

More about GatewayLinuxVoIP

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Antone Gonsalves

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts