Phonetic attack commands crash bank phone lines

Powered by SC Magazine
 

Touch tone and voice activated systems open to attack.

A security researcher has demonstrated a series of attacks capable of disabling touch tone and voice activated phone systems or forcing them to disclose sensitive information.

In one test, a phone system run by an unnamed Indian bank had dumped customer PINs.

Attacks including blind SQL injection and buffer overflows could be served to almost any interactive voice response (IVR) phone system, according to Rahul Sasi, a security researcher with iSight Partners.

He said the attacks could take down critical phone systems, cutting off banking services or the ability of call centres to field customer inquiries.

“If someone can crash a banking app from anywhere in the world, that’s critical,” Sasi said.

“No banks or organisations are testing IVRs because they think the systems are secure, but in reality they are not. No firewall or CAPTCHAs monitor voice traffic.” 

The attacks were limited to the characters available within dual-tone multi-frequency signalling (DTMF) systems, which could include numbers and letters, but not most special characters such as backslashes.

In demonstrations at the recent Hack in the Box conference to be replayed at the upcoming Ruxcon security event, Sasi ran fuzzy testing against IVR systems serving data via a keypad and by spoken commands.

The attacks targeted the DTMF algorithms, which converted user commands into actions, such as pulling customer bank records from databases.

Vulnerabilities in those databases could be exploited by speaking attack commands down the phone. In one instance, Sasi trigged a buffer overflow against a demonstration system.

The targeted IVR systems responded by reading out error messages which provided attackers with valuable intelligence and data.

Sasi was developing a fuzzing program which would combine different DTMF algorithms with different frequencies. That could allow attackers to remotely crash a host of systems like phone banking applications that depend on DTMF.

Copyright © SC Magazine, Australia


Phonetic attack commands crash bank phone lines
Image credit
 
 
 
Top Stories
Content, cost & constant innovation: How Foxtel plans to take on Netflix
Nell Payne inhabits the “brave new world of blue strings and networking”. Just don't ask her to put a TV screen on your microwave.
 
Sending in the drones
Margins are getting tighter in the industrial services industry, so Transfield Services' Stephen Phillips looks offshore - and to the skies - for the solutions he needs to keep pace.
 
Westpac fires starting pistol on core banking upgrade
St George readies itself for move to Celeriti.
 
 
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  43%
 
No
  57%
TOTAL VOTES: 547

Vote