VoIP phone systems at risk of Shellshock Bash attacks

The Shellshock Bash bug was found in a typical voice-over-IP (VoIP) phone system, opening up the possibility that many more of the business communication systems could be vulnerable if attacked.

The bug uncovered this week in a widely used component of Linux, Unix and Mac OS X was found in a VoIP phone vendor’s session initiation protocol (SIP) server, Jaime Blasco, director of AlienVault Labs, said Friday. Because many vendors use similar servers, the vulnerability is likely widespread.

Blasco declined to name the vendor.

“I’m pretty sure that there are a bunch of them (vendors), if not a lot of them, that you can exploit,” Blasco said.

A SIP server, which often runs on Unix or Linux, is the main component of a VoIP system for configuring and adding new phone hardware to the system. The server does not transmit or receive audio, which is typically handled by a media server.

Many SIP servers run GNU Bash, which is the component with the critical flaw. Bash, which stands for Bourne Again Shell, is the default command shell for the operating system.

The bug lets an attacker trick Bash into executing malicious command code by sending it via the Common Gateway Interface, an underlying component of the SIP server’s administrative interface.

“Even if you don’t have the username and password (for the SIP server), you can exploit the vulnerability,” Blasco said.

Depending on the architecture of the phone system, an attacker could upload malware to the SIP server and gain access to a company’s internal network, Blasco said. Also, once inside the phone system, a hacker could infect components that allow him to intercept communications.

Security researchers reported Thursday that hackers were trying to exploit Shellshock in Web servers. On Friday, firewall vendor Incapsula reported that in a 12-hour period, it recorded 725 attacks per hour against a total of 1,800 domains.

“This is pretty high for a single vulnerability,” Tim Matthews, vice president of marketing at Incapsula, said.

The attacks originated from 400 unique IP addresses. More than half of the attacks started from China and the U.S.

In general, the attackers were running automated scripts from compromised servers in existing botnets in an attempt to add more systems to the network. Several botnet operators were using repurposed distributed denial of service (DDoS) bots in an attempt to exploit Shellshock.