It is much appreciated that you share this with the community. I have seen known issues in proprietary firmware in embedded devices for AGES. And the vendors just think their security through obscurity modus operandi will go forever and noone would care to inspect their .bin files. In times like this i want to dedicate myself to toll fraud just to stick it to imbeciles pushing firmware. On Wed, Oct 23, 2013 at 11:38 PM, Cal Leeming [Simplicity Media Ltd] < cal.leeming@simplicitymedialtd.co.uk> wrote:

For those that missed it, you can watch the whole thing here; http://www.youtube.com/watch?v=raXkHi_uGF8

Slides here; https://www.dropbox.com/s/hp5fj7e7o1mdnyt/Auto%20provisioning%20sucks.pptx

Cal

On Tue, Oct 22, 2013 at 7:36 PM, Ken Rice <krice@freeswitch.org> wrote:

...

ClueCon Weekly will present a Special Security Episode Tomorrow at 1PM Eastern Live!

Cal Lemming, Will be making a 0day disclosure!

Don’t miss this exclusive presentation for the FreeSwitch community!

This is one you will not want to miss!

Join us on the FreeSWITCH Bridge for this Special Presentation!

For conference call access information visit *http://ss7.us/call888 * -- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://www.ss7.us/cluecon-gplus FB ClueCon : http://www.ss7.us/cluecon-fb G+ FreeSwitch : http://www.ss7.us/freeswitch-gplus FB FreeSWITCH : http://www.ss7.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Again Thanks Cal! Today was great! Check out the links below for those that missed it! Hopefully this will get some people thinking about what not to do in the future and get some vendors to address things. Tl;dr version: Cal found a multi-vendor problem with auto-provisioning services... See the youtube link for the presentation. On 10/23/13 4:38 PM, "Cal Leeming [Simplicity Media Ltd]" <cal.leeming@simplicitymedialtd.co.uk> wrote:

For those that missed it, you can watch the whole thing here; http://www.youtube.com/watch?v=raXkHi_uGF8

Slides here;  https://www.dropbox.com/s/hp5fj7e7o1mdnyt/Auto%20provisioning%20sucks.pptx

Cal

On Tue, Oct 22, 2013 at 7:36 PM, Ken Rice <krice@freeswitch.org> wrote:

...

ClueCon Weekly will present a Special Security Episode Tomorrow at 1PM Eastern Live!

Cal Lemming, Will be making a 0day disclosure!

Don¹t miss this exclusive presentation for the FreeSwitch community!

This is one you will not want to miss!

Join us on the FreeSWITCH Bridge for this Special Presentation!

For conference call access information visit http://ss7.us/call888

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch

The video has been marked private at vendor request... On 10/24/13 2:11 AM, "Gerald Weber" <gerald.weber@besharp.at> wrote:

Thanks, but youtube says this video is private.

Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Cal Leeming [Simplicity Media Ltd] Gesendet: Mittwoch, 23. Oktober 2013 23:38 An: FreeSWITCH Users Help Cc: freeswitch-dev@lists.freeswitch.org; freeswitch-cluecon@lists.freeswitch.org Betreff: Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern

For those that missed it, you can watch the whole thing here;

http://www.youtube.com/watch?v=raXkHi_uGF8

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch

They are indeed working hard to very quickly address this issue, but it is going to take them a week or 2 to get a new firmware out and otherwise address the issue. We are in active communications with them about progress on the solution, including actively discussing and testing with them until late last night. On Oct 24, 2013, at 10:13 AM, Abaci <abaci64@gmail.com> wrote:

Are they doing something about it and just need some time, or are they just trying to silence it.

On 10/24/2013 10:05 AM, Ken Rice wrote:

...

The video has been marked private at vendor request...

On 10/24/13 2:11 AM, "Gerald Weber" <gerald.weber@besharp.at> wrote:

Thanks, but youtube says this video is private.

Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Cal Leeming [Simplicity Media Ltd] Gesendet: Mittwoch, 23. Oktober 2013 23:38 An: FreeSWITCH Users Help Cc: freeswitch-dev@lists.freeswitch.org; freeswitch-cluecon@lists.freeswitch.org Betreff: Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern

For those that missed it, you can watch the whole thing here;

http://www.youtube.com/watch?v=raXkHi_uGF8

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I wonder if Yealink phones have a certificate that can verify the MAC address being provisioned, the way the newer Snom do. http://wiki.snomone.com/index.php?title=Plug_and_Play_for_snom_phones#Pairin... Thanks, Moishe Grunstein Tornado Computer Systems, Inc. 212.400.7650 888.IPPBX.US Service Request Email: support@nysolutions.com<mailto:support@nysolutions.com> Polycom Certified VAR Microsoft Small Business Specialist, Cisco SMB Select Certified [cid:image001.jpg@01C72F94.9EE45D60]<http://www.nysolutions.com/> Computer Networking * Managed Services * IP Video Surveillance * Network Assessments * Web Solutions * Voice over IP * Disaster Recovery * Network Security * Site Surveys * CMS From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Moshe3t Sent: Thursday, October 24, 2013 10:47 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern Hi I would suggest (I have Bcc'd Yealink as well) that as they have when a phone is reset to factory default it pops up on the screen of the phone local network option (DHCP/Static) and modifiable via phone keypad it should also ask encrypted provisioning or not and if encrypted is chosen it should let the end user put in the decryption key via phone keypad which will be available on the website of the provisioning server (assuming the its secure as in most cases might hold sip credes as well) so the end user will be able to setup and auto provision their phone without login to the phone web gui (ok! it won't zero touch it will be 1 touch provisioning, as if the doesn't have to touch the phone at all ;-) ) before submitting this approach to any vendors i would like to hear input and make sure the issue is addressed properly and hear if anyone have a better approach to fix this issue globally (at least with Yealink line ofproduct as they seem to be very cooperative and understanding in general especially when it comes to security, in hopes other companies will follow suit) Sincerely Moshe BT On 10/24/2013 10:05 AM, Ken Rice wrote: The video has been marked private at vendor request... On 10/24/13 2:11 AM, "Gerald Weber" <gerald.weber@besharp.at> wrote: Thanks, but youtube says this video is private. Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von Cal Leeming [Simplicity Media Ltd] Gesendet: Mittwoch, 23. Oktober 2013 23:38 An: FreeSWITCH Users Help Cc: freeswitch-dev@lists.freeswitch.org; freeswitch-cluecon@lists.freeswitch.org Betreff: Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern For those that missed it, you can watch the whole thing here; http://www.youtube.com/watch?v=raXkHi_uGF8 -- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Polycom has something like that functionality in current firmware - but I believe if you _upgrade_ to a current firmware, it doesn't work - it only works if it had that newer key installed in the factory image. -- Nathan On 10/24/2013 10:44 AM, Cal Leeming [Simplicity Media Ltd] wrote:

This is one of the concepts I'd raised yesterday, generating a nonce using a unique value that only the vendor and the phone knows (i.e. a serial number, or in future phones, TPM/RSA module). However if the keys are ever compromised, then this would be rendered useless. Encryption is also good, but relies on a strong password which is difficult to type in on a phone and removes the concept of zero touch.

To be honest, I don't think zero touch is going to be feasible if we want to keep security, because you are trusting that the keys stored at <vendors provisioning system here> haven't been compromised. One touch would be a much better solution (there have been some great suggestions on that so far).

Cal

On Thu, Oct 24, 2013 at 4:17 PM, Moishe Grunstein <max@nysolutions.com <mailto:max@nysolutions.com>> wrote:

I wonder if Yealink phones have a certificate that can verify the MAC address being provisioned, the way the newer Snom do.____

http://wiki.snomone.com/index.php?title=Plug_and_Play_for_snom_phones#Pairin...

__ __

__ __

__ __

Thanks,____

__ __

Moishe Grunstein____

Tornado Computer Systems, Inc.____

212.400.7650 <tel:212.400.7650> 888.IPPBX.US <http://888.IPPBX.US> *Service Request Email: support@nysolutions.com <mailto:support@nysolutions.com> *____

Polycom Certified VAR Microsoft Small Business Specialist, Cisco SMB Select Certified____

cid:image001.jpg@01C72F94.9EE45D60 <http://www.nysolutions.com/>____

Computer Networking * Managed Services * IP Video Surveillance * Network Assessments * Web Solutions * Voice over IP * Disaster Recovery * Network Security * Site Surveys * CMS____

__ __

*From:*freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org>] *On Behalf Of *Moshe3t *Sent:* Thursday, October 24, 2013 10:47 AM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern____

__ __

Hi

I would suggest (I have Bcc'd Yealink as well) that as they have when a phone is reset to factory default it pops up on the screen of the phone local network option (DHCP/Static) and modifiable via phone keypad it should also ask encrypted provisioning or not and if encrypted is chosen it should let the end user put in the decryption key via phone keypad which will be available on the website of the provisioning server (assuming the its secure as in most cases might hold sip credes as well) so the end user will be able to setup and auto provision their phone without login to the phone web gui (ok! it won't zero touch it will be 1 touch provisioning, as if the doesn't have to touch the phone at all ;-) )

before submitting this approach to any vendors i would like to hear input and make sure the issue is addressed properly and hear if anyone have a better approach to fix this issue globally (at least with Yealink line ofproduct as they seem to be very cooperative and understanding in general especially when it comes to security, in hopes other companies will follow suit)

Sincerely

Moshe BT

On 10/24/2013 10:05 AM, Ken Rice wrote:____

The video has been marked private at vendor request...

On 10/24/13 2:11 AM, "Gerald Weber" <gerald.weber@besharp.at <http://gerald.weber@besharp.at>> wrote:____

Thanks, but youtube says this video is private.

*Von:*freeswitch-users-bounces@lists.freeswitch.org <http://freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org] *Im Auftrag von *Cal Leeming [Simplicity Media Ltd] *Gesendet:* Mittwoch, 23. Oktober 2013 23:38 *An:* FreeSWITCH Users Help *Cc:* freeswitch-dev@lists.freeswitch.org <http://freeswitch-dev@lists.freeswitch.org>; freeswitch-cluecon@lists.freeswitch.org <http://freeswitch-cluecon@lists.freeswitch.org> *Betreff:* Re: [Freeswitch-users] [Special Announcement] ClueCon Weekly Special Security Edition! Wed Oct 23rd @ 1PM Eastern

For those that missed it, you can watch the whole thing here;

http://www.youtube.com/watch?v=raXkHi_uGF8____

_ _-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net <http://irc.freenode.net> #freeswitch

____

_____________________________________________________________________________

Professional FreeSWITCH Consulting Services:____

consulting@freeswitch.org <mailto:consulting@freeswitch.org>____

http://www.freeswitchsolutions.com____

__ __

FreeSWITCH-powered IP PBX: The CudaTel Communication Server____

http://www.cudatel.com____

__ __

Official FreeSWITCH Sites____

http://www.freeswitch.org____

http://wiki.freeswitch.org____

http://www.cluecon.com____

__ __

FreeSWITCH-users mailing list____

FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>____

http://lists.freeswitch.org/mailman/listinfo/freeswitch-users____

UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users____

http://www.freeswitch.org____

__ __

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 System Administrator - Architect