Phonetic attack commands crash bank phone lines

By Darren Pauli onSep 17, 2012 5:46 PM

A security researcher has demonstrated a series of attacks capable of disabling touch tone and voice activated phone systems or forcing them to disclose sensitive information.

In one test, a phone system run by an unnamed Indian bank had dumped customer PINs.

Attacks including blind SQL injection and buffer overflows could be served to almost any interactive voice response (IVR) phone system, according to Rahul Sasi, a security researcher with iSight Partners.

He said the attacks could take down critical phone systems, cutting off banking services or the ability of call centres to field customer inquiries.

“If someone can crash a banking app from anywhere in the world, that’s critical,” Sasi said.

“No banks or organisations are testing IVRs because they think the systems are secure, but in reality they are not. No firewall or CAPTCHAs monitor voice traffic.” 

The attacks were limited to the characters available within dual-tone multi-frequency signalling (DTMF) systems, which could include numbers and letters, but not most special characters such as backslashes.

In demonstrations at the recent Hack in the Box conference to be replayed at the upcoming Ruxcon security event, Sasi ran fuzzy testing against IVR systems serving data via a keypad and by spoken commands.

video: http://player.vimeo.com/video/49583283

The attacks targeted the DTMF algorithms, which converted user commands into actions, such as pulling customer bank records from databases.

Vulnerabilities in those databases could be exploited by speaking attack commands down the phone. In one instance, Sasi trigged a buffer overflow against a demonstration system.

The targeted IVR systems responded by reading out error messages which provided attackers with valuable intelligence and data.

Sasi was developing a fuzzing program which would combine different DTMF algorithms with different frequencies. That could allow attackers to remotely crash a host of systems like phone banking applications that depend on DTMF.

from: http://www.scmagazine.com.au/News/315844,phonetic-attack-commands-crash-bank-phone-lines.aspx

文章来源于lcx.cc:Phonetic attack commands crash bank phone lines

相关推荐: 一步一步制作Windows7封装系统，封装制作 Windows 7 系统完全攻略

网上有很多的各种修改版的系统，如当年的xx花园，如x度，xx风等等，作为熟悉电脑的老手们是只使用纯净版系统的，毕竟，网上的修改版系统即使没有病毒木马，也给你塞了一堆你不喜欢的东西。 可是，每次自己重装纯净版系统还是要安装很多自己常用的软件，还要去挨个做下系统配…