35C3 - Compromising online accounts by cracking voicemail systems

35C3 preroll music

Herald Angel: We start the next talk. It's
by Martin Vigo. He stands here. He is a

product security lead and researcher and
he's responsible for mobile security,

identity, and authentication. So he helps
people design and secure systems and

applications. And he has worked on stuff
like breaking password managers or

exploiting Apple's FaceTime to create a
spy... yeah, a spy program. So give him a

warm applause for his talk.
Applause

Martin Vigo: Thank you for joining me in
this talk. I'm super excited to be here.

It's actually my second year at the
conference, so super super excited that

the first year I was sitting there, and
the second year I'm sitting here. This is

me, but an introduction was already made.
Just pointing out that this is me, 9 year

old, with an Amstrad CPC 6128. You had
this machine before? I see only one hand?

I think this was sold in Europe, but I was
playing here La Abadía del crímen, which

is the best video game ever written. If
you guys like abandonware, you should

definitely check it out. So like any good
research we have to start by looking at

previous art, right? We can learn a lot
from researchers that did stuff in the

past. And in this case I went all the way
back to the 80s to understand how freakers

of the time, when the hacking thing
started, we're doing to actually hack into

voicemail systems. I condensed everything
I learned in five different paragraphs of

five different essences, that I actually
got from frac website, which is an amazing

resource. So, here from the Hacking
Telephone Answering Machines, the

paragraph that I extracted was that "You
can just enter all 2-digit combinations

until you get the right one", "A more
sophisticated and fast way to do this is

to take advantage of the fact that such
machines typically do not read two numbers

at a time, and discard them, but just look
for the correct sequence". What is this

about? In older voicemail systems if you
will enter like 1234 for the 2-digit PIN,

it will not process 12 and 34 to to verify
the PIN, but it will also process 23,

which is very interesting. In fact, in
Hacking AT&T Answering Machines, again,

this is amazing from their 90s or 80s, we
actually get the correct sequence to cover

the entire 2-digit key space. So, if you
enter all these, you are basically brute

forcing the entire key space, without
having to enter in the entire thing that

covers it. I also learned, from A Tutorial
of Aspen Voice Mailbox Systems, that in

the 80s there was default passwords.
Surprise, surprise! But also that as

humans, we actually have patterns when we
choose PINs. And so we have the classics:

1111, 9999, 1234. And another thing that I
learned in Hacking Answering Machines in

the 90s, was that "There is also the old
'change the message' secret to make it say

something to the effect of this line
accepts all toll charges so you can bill

third party calls to that number". This is
basically a trick used by inmates to get

free calls. Basically, they would record
in the voicemail a greeting message "yes,

yes, yes", so when the automated system
comes in and asks "Do you want to accept

the toll charges from the call from the
penitentiary, it will go and they will be

able to do free calls. So, condensing
everything and summarizing what what I

learned from looking at what previous
hackers did in the 80s: we know that the

voicemail system security looked like...
there was default PINs, there was common

PINs, there was bruteforceable PINs, there
was efficient bruteforcing because we can

enter multiple PINs at the same time, that
the greeting message is actually an attack

vector. So let's play a game. Let's do
checklist and let's look at the voicemail

security today. So, I looked at the
American carriers because I live in the

US, but because I was invited to talk in
Germany, I took some friends to give me

some SIM cards and I actually wanted to
put about German carriers as well. So,

checklist time, default PINs: all American
carriers do have default PINs and

unfortunately they are really not a secret
because most of them is actually the last

digits of your phone number. When it comes
to German carriers it's actually a much

better state, for example Vodaphone it's
the last 4 digits of the client number

which you don't know. I mean, you know as
the customer, not others, it's a secret.

Or if it comes to the CallYa, that is the
card that I got, it's the last 4 digits of

the PUK. For Telekom it's the last 4
digits of the card number, which is the

card you get with the SIM card. For O2,
unfortunately, there is a default PIN,

which is 8705, which is the only PIN you
can't set, when you choose to set one.

Yeah. So, voicemail security today when it
comes to common PINs: according to like a

fantastic research from Data Genetics,
this is actually about people choosing

PINs for their credit cards, but there was
a lot of conclusions that I learned from

this research and basically, to summarize
the most important regarding this work, is

that for example by trying the top 20 most
common PINs, you have a 22 percent chance

of getting the right one. What this means
in other words is for every fourth victim

that I tried to brute force the PIN from
their voicemail system, I will get it

right every fourth person. There are other
conclusions that are very interesting

like, the PINs mostly start by 19. Who has
an idea why is that? Birth year, right? Is

very common to set as your birth year.
Most of us were born in the 20th

century... to set it as a PIN.
Bruteforceable PINs. Same thing in Germany

and in the US, it accepts 4-digit PINs
which, we will see later, is just not

enough key space. Efficient bruteforcing
all the carriers accept concatenation of

payload. So, in this case I use it to try
different PINs and I don't even have to

wait for error messages. I just use the
pound as kind of like an enter in a

voicemail system and I can try three PINs
at a time. Usually carriers will hang up

when you enter three PINs wrong, for
security purposes, but we will take

advantage of that. So with everything that
I learned from the 80s, I verified that it

was still a problem today. I decided to
write a tool that allows you to brute

force voicemail system fast, cheap,
easily, efficiently, and undetected. So,

fast: I used Twilio... who is familiar
with Twilio here? Some of you? So a Twilio

is basically an online services that
allows you to programmatically interact

with phone calls. You can make phone
calls, interact with them, and all that.

So I use it to launch hundreds and
hundreds of calls at the same time in

order to brute force PINs. It's cheap! The
entire 4-digit keyspace costs 40 dollars.

So if I want to have a 100 percent chance
of getting your 4-digit PIN, I only have

to pay 40 bucks. A 50 percent chance,
according to the research from Data

Genetics, it will cost me five dollars. So
once every two victims, I will get the

PIN. Actually, if I want to take a
different approach and instead of just

trying to brute force only yours, I want
to brute force the PIN from everyone here,

according to Data Genetics, and in this
case, according to the fact that that is

default PINs... I'm not going to ask how
many of you have O2, now that they know

that there is a default PIN to their
voicemail system. It will be more

interesting to actually try a thousand
phone numbers for that default PIN for O2

customers, only for 13 dollars. It's easy:
fully automated, the tool does everything

for you, you just have to provide the
victim number, the carrier, and couple

other parameters and it's efficient! It
optimizes brute forcing, I use the

research from Data Genetics to favor the
PINs that are most common, and obviously

it tries different PINs and all that
stuff. But the most important here is

detection, because think about it. In
order for me to interact with your

voicemail system I need to call you and
you cannot pick up, because if not, it

doesn't go to the voicemail system. So I
was trying to find ways, because I need

to, in the end, make a lot of calls,
trying different PINs. How can I interact

directly with your voicemail? I try call
flooding like basically doing three calls

at a time, because the line gets flooded
just with three calls, it goes directly to

the voicemail, but it wasn't very
reliable. You can use OSINT techniques, a

lot of people likes to tweet that they,
you know, they go on a trip, they are

about to board a plane, so it goes into
airplane mode, or you go in a remote area,

or you are in a movie theater, or at night
you put in Do Not Disturb. Those are all

situations in which calls go directly to
the voicemail. You can use HLR database to

find out if mobile devices are
disconnected or the SIM cards have been

discarded, but they are still assigned to
an account. And you can use online

services like realphonevalidation.com
which I actually reached out and they

provide services that allow you to know if
a phone is acutally connected to a tower

at the moment, so it's basically
available, so you could use that too. You

can also use class 0 SMS, which gives you
feedback. It's basically a type of SMS

that will... it has more priority and will
basically display on the screen and you'll

get the feedback if it was displayed. So,
that's a nice trick to find out if the

phone actually connected to a tower. But
in reality, I wanted a bullet proof way to

do this and in the U.S. I found that there
is this concept of backdoor voice mail systems.

So instead of me calling you, I'm going to
call one of these services that you guys

have listed here for every carrier and
there I enter the number, in this case the

number of the victim from the voicemail I
want to interact to. And of course it

allows you to access to the logging
prompt. Actually in Germany I find it

interesting that you guys have it as a
service, because in the US it's more a

secret that I had to found using Google,
but here... Basically if I dial your phone

number and when it comes to Vodafone
between the area code and the rest of the

number I put 55, or for Telekom 13, or for
O2 33, I directly go to the voicemail, you

won't ring your phone. So I can use that.
Who was aware of this, that is from

Germany? OK, many of you. So that's what I
thought. Like here it's not really like

something you guys care too much about. In
the U.S. it's actually used a lot for

scammers or to leave directly voicemail
messages from spammers as well. So,

voicemailcracker actually takes advantage
of backdoor numbers, so it allows you to

be undetected. I don't need to call you, I
don't need to wait till you are flying, I

can do that. And for example for the U.S.
it's great, because when I launch that

many calls, the line gets flooded even if
you are offline. But when I use these

backdoor voicemail systems, because they
are meant to be used by everyone, those

don't get flooded. So I literally make
hundreds and hundreds of calls and it

never fails.So, but you know like
carriers, or some of them, add a brute

force protections, right? So that you
can't actually launch brute forcing

attacks. And I looked at the German
carriers and for example Vodafone, I saw

that it resets the 6 digit PIN and sends
it over SMS. So, I guess I can flood your

phone with text but who cares, that's not
a big deal, but I think it's actually a

pretty effective measure against
voicemail... against brute forcing.

Telekom blocks the Caller ID from
accessing the mailbox or even leaving

messages. I tried and after six times that
it's wrong every time, I call it says

"Hey, you can't do anything", and it hangs
up. And for O2 it connects directly to the

customer help-line, but someone started
talking German and my German is not that

good. So brute force, I wanted to be able
to bypass this writing and so if you look

at telecom I mentioned that it blocks the
caller I.D. but it turns out that Twilio

you can actually buy caller IDs you can,
well, you can buy phone numbers, right?

and they are really cheap. So it's very
easy for me to do randomization of caller

I.D.s for very very cheap and bypass
telecom's brute force protection. So

voicemailcracker also supports that. It
supports caller ID randomization. So let's

make the first demo. So as you can see
here on the left is the victim's mobile

device, and on the right is the tool. And
in this case I'm going to use the brute

force option. The brute force option
allows me to basically brute force the

pin. It makes hundreds of calls as I
explain and I'll try to guess it. And

there is a number of parameters like the
victim number, the carrier... the carrier

is important because they put their
specific payloads for every single carrier

because all the voicemail systems are
different, how you interact with them, and

in this case are using a backdoor number
because he's more efficient. And then

there is no detection. And in this case I
did the option of top pin. So this is

basically trying the top 20 pins according
to the research for four digits. So as you

can see it's trying actually three pins at
a time as I mentioned before rather than

one. So we have to do a third of the of
the of the calls, right? And how did you

think that I'm detecting if the pin was
correct or not? Any ideas?

Unintelligible suggestion from audience
M.V.: OK. So the disconnect and hang up.

That's what I heard. And that's exactly
right. If you think about it I can look at

the call duration because when I tried
three pins and it hangs up it's always the

same call duration. For T-Mobile in this
case it's like 18 seconds. So I instruct

Twilio to after dialing and putting the
payload to interact with the voicemail

system trying the pins to wait 10 extra
seconds. So all I got to do, I don't need

any sound processing to try to guess what
the voicemail voice is telling me if it's

correct or not. I just use the call
duration. So if the call duration is ten

times longer then I know that's the right
pin because because it locked in. So as

you can see it found out one of those
three is actually the correct one: in this

case it's 1983. So in order to give you
the exact one because at that time it

tried the three of them, now it's trying
one by one and it may look like it's

taking longer than it should for only 20
pins but remember failing pins is very

very quick. It's just that because in the
top 20 found already the right pin it

takes longer than it should, and there you
go. We got that it's 1983. Awesome. So

what is the impact really why am I here
talking to you at CCC that has such

amazing talks, right? And this is really
the thing about this. No one cares about

the voicemail. Probably if I ask here, who
knows his own voicemail pin?

laughter
M.V.: Nice. That's what I was expecting.

Probably less hands here. So some of them
are lying but that's the thing, right? We

don't care about the voicemail. We don't
even use it, which is the crazy thing

here. We have we have an open door for
discussing an issue that we don't even

know about or we don't even remember. So
many people is not familiar with the fact

that you can a reset passwords over phone
call. We are familiar with resetting

passwords over e-mail. You get a unique
link maybe over SMS you get a code that

you that you then have to enter in the UI.
But a lot of people cannot receive SMS, or

that's what services claim. So they allow
you to provide that temporary code over a

phone call, and that's exactly what we
take advantage of, because I ask you what

what happens if you don't pick up the
phone if basically I go to a service,

enter your e-mail or your phone number and
reset a password, and everyone can do

that. Anyone can reset it, initiate the
reset password process, and I know that

you are not going to pick up the phone. I
know that thanks to my tool I got access

to your voicemail system. So basically the
voicemail system will pick up the call and

it will start recording, so it will record
the voice spelling out the code that I

need to basically reset your account and
get access to it. So -- oops! -- and I

press play here.
Static

M.V.: Okay, so, what does the attack
vector look like? You brute force the

voicemail system using the tool ideally
using backdoor numbers. For that

particular call -- that is, the call that
the victim will receive once you initiate

the password reset -- that one it cannot
go through the backdoor number, right?,

because it's gonna-- PayPal is gonna
directly call the victim. So for that one

you need to make sure that the victim is
not connected to a tower through all the

methods that I showed before. You start
the password reset process using the

economy feature. You listen to the
recorded message, secret code and profit.

You hijacked that account, and
Voicemailcracker can do all that for you.

Let's compromise Whatsapp. So on the left
you see my number, right?, with a secret

lover group, and a secret group, and all
that stuff. On the right notice that I'm

not even using an actual device. It's an
android emulator that I installed, an APK.

And there is some sound to this, and you
are gonna see -- so again on your left

it's the victims number. On the right is
an emulator of the attacker. So you'll see

that I'm going to use my tool with the
message payload, with the message option.

So in this case what I'm doing is I'm
setting the victim's phone to airplane

mode, simulating that it's now offline for
some reason, and I detected that. So if

you see, WhatsApp allows sends you a text
to actually register as a WhatsApp user,

but if you don't reply in a minute it
allows you-- it gives you an option to

call, to call me, right? And that's
exactly what I click. So now WhatsApp is

basically calling the victim which is
again in airplane mode, because he went on

a remote trip or on a plane, and so I'm
using Voicemailcracker with the option

"message" to automatically retrieve that
newest message. So the tool is gonna

provide me as you can see the last option
is the pin, because I brute forced it

before. So it's going to give me a URL
with the recording of the newest message,

which, hopefully -- it's a recorded demo
-- hopefully contains actually the code.

So let's see... I got the URL.
Phone alert sound

Computerized phone voice: New Message! --
M.V.: It's interacting with the voicemail

system right now.
Phone voice: -- your verification code is:

3 6 5 9 1 5. Your verification code is: 3
6 5 9 1 5. Your ver--

M.V.: And that simple. We just hijacked
that person's WhatsApp, and I -- here I'm

fast forwarding just to show you--
Applause

M.V: --that you get actually that. Thank
you. I do want to point out that WhatsApp

is super secure, it like-- end to end
encryption all that -- and there is a

number of things that you can notice this
attack. For example you wouldn't be able

to see the previous messages that were
there but you can just hold on and ask

people, right? The groups will pop up. So
you hijacked that WhatsApp account. There

is also fingerprinting. But who really
pays attention to the fingerprinting when

someone changes the device, right? So are
we done? Not yet. Because the truth is,

some researchers talked about this in the
past then and actually services tried to

slowly pick up. So that is actually
something that I found in several

services. That is what I call the user
interaction based protection. So when you

received that phone call that provides you
with the temporary code in reality it's

not giving it away. You have to press a
key. It comes in three different flavors

from what I found from my tests. Please
press any key to hear the code, so when

you get the call, you have to press, and
then it will tell you the code; please

press a random key so specifically please
press 1, please press 2, or please enter

the code. PayPal does that, and instead of
you having to press a key to hear the code

when you reset the password you will see a
four digits code that you have to enter

when you receive the call and then it will
reset the password. So I'm going to get

the help from all of you guys. Can we beat
this currently recommended protection what

is nowadays recommended to prevent these
kind of attacks? And we're going to play a

game. I'm going to give you two hints.
This is the first one. So, you probably

guys are familiar with this, but Captain
Crunch. Again we go back today it is we

can learn so much from them, use this to
generate specific sounds at a specific

frequency to basically -- you can go and
read it -- to get free international

calls. So he will create that sound and
the system will process it on the on the

line. And the second one is that I
cheated. When we did the checklist, I

actually skipped one , which was the
greeting message is an attack vector. So I

ask you guys how can we bypass the
protection that requires user interaction

in order to get the code recorded on the
voicemail system?

Inaudible suggestion from audience
M.V.: What was that?... Exactly. Record

DTMF tones as the greeting message. We own
the voice mail system so we can alter the

greeting message. So this is exactly how
it works: We just alter the greeting

message we call the DTMF that the system
is expecting and it works every single

time. The best thing of this is what
really is so awesome about about all of us

that really care about technology. We want
to have a deep understanding because when

I was asking people when when you know I
wanted to show them this I was asking them

how does this protection really work. And
they will say well you have to press a key

and then you know it will give you the
code. But that's not really true. That's

what you have to do is to provide a
specific sound that the system is

expecting. That is different than saying
you have to press a key, because if you

say I have to press a key that requires
physical access. If you say I have to

provide a sound, now we know it doesn't
require physical access. That is why

hackers are so cool, because we really
want to understand what is happening

backstage, and we take advantage of that.
So how does the attack vector look like?

Bruteforcing voicemail systems as before.
So basically we have an extra step which

is update the greeting message according
to the account to be hacked in voicemail.

Cracker can do that for you. Let's
compromise PayPal.

Laughter
M.V.: So on the left side you see that as

before I brute force the pin of the voice
mail. And in this case on the right side

I'm going to start a password reset for
that account. So I do that and I choose

"please call me with a temporary code".
But in this case PayPal works differently

because it will show me a four digits code
that I need to enter when I receive the

call in order to reset the password. So
you see that here I'm using the greeting

option. So the greeting is going to allow
me to enter a payload that I want to

record as the greeting message. In this
case is 6 3 5 3. So I may be very very

verbose for this demo. There you see
the last option use PayPal code and I

enter 6 3 5 3. Now the tool is going to
use the pin to log into the voicemail

system, interact with it, change the
greeting message, record the DTMF tones

according to 6 3 5 3 and then it should be
able to fool the call. In this case I'm

asking to call again, because it didn't
have enough time to do that. And in 3 2 1

we should get that we actually compromise
PayPal's account, and there we go. We can

now set our own password.
Applause

M.V.: Thank you. So, I showed you some
vulnerable servers. Let's go very quick

about it because I'm I'm concerned I'm
running out of time. So, I'm just

mentioning Alexa top 100 types of
services, no favoring anything, but... so

for password reset that supports over
phone call: PayPal, Instagram-- no,

Snapchat-- Netflix, Ebay, LinkdIn. I'm
still on Facebook. What can I say? 2FA for

all they major forms so 2FA over phone
call for Apple, Google, Microsoft,

Yahoo... Verification: So basically you
don't register with a username and

password on on WhatsApp or Signal you
actually use directly the phone number,

right? As we saw before and you register
through a phone call or SMS. So you can

compromise this too. Twilio, the own
service that I use for these is actually

really cool because you can own a caller
I.D. by verifying it by getting a phone

call so I can actually own your caller ID
and make calls on your behalf, send texts,

and these all legitimately, right?,
because you've pressed one. Google Voice,

it's actually another interesting service
because it's used a lot by scammers,

right? And this is the same thing: you
have to verify ownership so you can do

those phone calls and you can fool it as
well with this, but I found I was looking

like what other services really take
advantage of this? And this is super

common in San Francisco, where I live. You
can buzz in people like when they want to

enter, right?, they enter your house
number, and then your phone rings and you

press any key to open the door. So we are
talking about physical security now. And

I've seen this in offices as well. They
all work this way, basically because they

want to be able -- for tenants, that you
know, come and go -- be able to switch

that very quickly. So it works just
through the phone that you buzz people in.

But my favorite is consent, because when
we think about consent we think about

lawyers and we think about signing papers
and we think about all of these difficult

things. And I find out about these
location smart service that is not anymore

there and you will see why... But this was
recently in the news because, basically

Brian Krebs wrote a really great article
about it. But I'm going to let you hear

then their YouTube channel, how Location
Smart works.

LS vid speaker 1: The screen that you're
showing, that you're seeing right now is a

demo that we have on our Web site it's at
location smart.com/pride, and I've entered

my name, my email, my mobile phone number,
and it's again going to get my permission

by calling my phone, and then it'll
locate. So let's go ahead and, I clicked

the box to say yes I agree, click the
locate, and the screen now shows that it's

going to call my device to get my
permission.

vid speaker's phone vibrates, sounds like an airhorn in video
LS vid speaker 2: Heh, that's a nice ring

tone --
M.V.: No, it's not--

LS vid speaker 1's phone: To log into
Location Smart Services, press 1 or say

'Yes'. To repeat, press 2 or say 'Repeat'.
LSVS1: Yes

Phone: Congratulations. You have been
opted in to Location Smart Services.

Goodbye
M.V.: So as you see, this service, this

Web site had a free demo, had a free demo
that allow you to put out a phone number

-- yours, of course -- and you will get a
phone call and then you will give

permission by pressing one. So someone
could locate you and keep tracking -- I

mean, I checked with them -- for up to 30
days, real time. So now you know why they

don't exist anymore!
Applause

M.V.: Open source..
More Applause

M.V: Open source. So, and this was with
the permission of the carriers. This was

not some fishy thing. This was actually a
service. So I wanted to release code,

because I want you guys to verify that
what I mentioned is true and have code to

hopefully help push the industry forward
to make a voice mail systems more secure,

right?. We want to push carriers to do so.
A but I didn't want to provide on tool

that works out of the box and anyone can
very easily as we saw like just start to

bruteforce pins, especially because I saw
that there is so many people with the

default PINs out there. So I just removed
the brute forcing, so the tool allows you

to test it on your own. You can test, you
know, you can test the greeting message

you can test the retreiving messages
compromising the services and all that. So

the tool allows you to test on your own
device. I won't give you code to brute

force someone else's device. And feel free
to go to my github repo. So now like all

the talks comes the recommendations, but I
know what you guys are thinking, right?

When someone comes with all this paranoia
and stuff you still think "yeah but you

know still like no one is gonna come after
me. I don't have anything to hide" or

anything like that. So I wanted to give
you reasons why you should still care

about this, and why we need to do better.
Because do carriers set default PINs? Yes,

we saw that. Is testing for default pins
cheap, fast, undetected, and automatable?

Yes it is. Is updating reading the message
automatable? Yes it is. Is retrieving you

the newest message automatable? Yes it is.
Is there speech to text description, so

that I can get the sound that I played
before with the code and get it in text?

Yeah. Twilio gives you that as well. So
can the account compromise process be

automatable? Of course you can use
selenium if you want to automate the UI.

Or you can use a Web proxy and look at the
APIs and do it yourself. So it is only a

matter of time that someone actually does
all these steps that I showed you step by

step and just makes it all straight and
starts to go over phone numbers trying the

default PINs, and just automatically
compromising services like WhatsApp like

PayPal and all that. You can do basically,
not a worm, but, you know, you can

compromise a lot of devices without doing
anything. Recommendations for online

services. Don't use automated calls for
security purposes. if not possible detect

answering machines and fail. I mean this
is not very accurate and you can still

trick it. Require user interaction before
providing the secret. I just show you how

to bypass that, but that's with hope that
carriers ban DTMF tones from the greeting

message. I don't see why that should be
supported, right? Recommendations for

carriers. The most important thing: Ban
DTMF tones from the greeting message,

eliminate backdoor mobile services, or at
least a give no access to the login

prompt, right? There is no reason why you
should be able to access your voicemail

directly to leave a message. But then I
can access the login prompt by pressing

star. Voicemail disabled by default. This
is very important and can only be

activated from the actual phone, or
online maybe with a special code. Oh great

I have time for questions. No default
pins. Learn from the German carriers:

don't allow common pins, detect and
prevent brute force attempts, don't

process multiple pins at once.
Recommendations for you which, is in the

end, very important here. disable the
voice mail if you don't use it. I found

though that some carriers you're still
through the backdoor voicemail numbers you

are unable to activate it again. So kind
of sucks. So I guess use the longest

possible random pin. Don't provide phone
numbers to online services unless

required, or is the only way to get 2FA.
2FA is more important. Use a virtual

number to prevent OSINT like a Google
Voice number so no one can you know learn

about your phone number digits by
resetting the password or do SIM swapping.

Use 2FA apps only. And I always like to
finish my talk with ones like that kind of

summarizes everything. Automated phone
calls are a common solution for password

reset, 2FA, verification, and other
services. These can be compromised by

leveraging old weaknesses and current
technology to exploit the weakest link

voicemail systems. Thank you so much.
Danke Schön, CCC!

Applause
Herald Angel: Thank you, Martin. We have

time for questions, so if you have any
questions or if someone in the Internet

has questions just go to these
microphones. Where is the microphone?

You've got it. Yes. You were black and the
microphone too. So maybe you start and we

take the question from the Internet.
Q: Yes I have a question. You mentioned

that the phone needed to be offline. Would
a call like a sim teen's call to the phone

that it would be in what is called in
english - besetzt?- like occupied so let's

say I already called the victim. So the
caller gets, yeah, the line's occupied

that would then go to voicemail, wouldn't
it?

M.V.: So that's a great question. I think
the question is if you are on a call and

someone else calls you, so your attack
will be: I somehow make up a story to keep

the person on the phone call while I
launch other calls... that will work. I

tried that but the problem is usually to
force, I mean that will not be too big of

a deal I guess but it supports two calls
right. They will warn you all there is

another incoming call. But I guess you
could keep doing more. So that's what I

meant a partly with a call flooding. In
that case what I tried was just launching

all of them at the same time. And if the
person picks up I don't care but it's

somewhat related to what you mentioned and
that's definitely possible.

Questioner: Okay. Thank you.
M.V.: Yeah.

Herald: Question from the internet please
Signal Angel: Does this work with the

phone calls that start talking
immediately, will the new code being

recorded then?
M.V.: if I understood the question

correctly it's that when the voicemail
picks up like basically the automated

system that spits out the code already
started to talk. I believe that's the

question.
Herald: We don't know it's from the

Internet.
M.V.: OK so if that is the question I

found actually that, because usually
greeting messages last like 15 seconds so

by the time it starts recording you
already finish the recording that gives

you the code, but you own the greeting
message so you make it as short as one

second. And I never found a problem with
that. You actually recorded DTMF tones for

like two seconds.
Herald: Ladies first let me take your

question.
Q: You talked about how you learned all of

that through reading e-zines. How are they
called, and how do I find them?

M.V: That's the best question I've ever
heard and it deserves an applause,

seriously. I like that because you also
want to learn about it. So that's that's

really fantastic. So the Phrack Web site
is the best resource you can get. I guess

everyone will agree here. So you just look
up google for phrack magazine and there is

a lot a lot of interesting stuff that we
can learn there still today.

Q: Are there any others?
M.V.: Yeah I mean you can then follow the

classic. I mean I like Twitter to get my
security news because it's very concise so

I kind of get like you know the 140
characters version.. if I'm interested

then I will read it. So I think you can
google for like top security people to

follow. Brian Krebs is great. It depends
also on your technical depth. There is

different people for that. And if not just
you know specialized blogs in magazines.

Q: All right. Thanks.
M.V.: Thank you.

Herald: And your question please.
Q: Hi. And so for me the solution is

obvious: I just turn off my voicemail. But
thinking about some relatives which are

maybe too lazy or don't really care and
still use two factor authentication. I was

thinking about could I easily adapt your
script to automatically turn off voice

boxes or generate random pins?
M.V.: You can automate it to turn off the pin. Like

for example on Vodaphone I don't know why
that allows you to turn off the pin. To turn

off the voicemail... I don't... I haven't
tested that. I think you may have to call

the IT department but you know what. It
would be really great to do that. It would

be really awesome. Great question. I guess
if you can turn it off then you can turn

it on as well. Yeah.
Herald: Your question please.

Q: Did Twilio ban you or did they find out
what you did?

M.V.:I got some emails I got some emails
but they were really cool. I have to say

that. I explained to them what I was
coming from, I gave them my identity...

like I wasn't hiding anything. Actually I
had to pay quite some money and because of

all the calls that I was doing while I was
doing the research, so I do think hide my

identity at all. So, they did detect tact
that I was doing many calls and stuff like

that. So there is I guess at the high
volumes there is some detection, but

Twilio is not the only service. So again
you can switch between services, space it

out, change caller I.D.s, a number of
things.

Herald: And one more question here.
Q: Hi. You talked about being undetected

when making all these calls by going
directly to these direct access numbers.

In Germany it's very common that if
someone calls your voicemail you get an

SMS text even if they don't leave a
message. But I suspect there's some kind

of undocumented API to actually turn that
off through the menus. Have you looked

into that?
M.V.: No I haven't looked into that

specifically. The question is that usually
in Germany for the carriers you'll get an

SMS when you when you get a call. I
wonder... the test that I did on the

German carriers, I was getting a text if I
was leaving a message, not if someone was

calling there. I guess you are talking
about a missed call, that kind of

notification. I'm not sure about it. What
I do want to point out is remember that a

you can do these while the person is
offline maybe on a long trip so you can

time it, and that will be a good probation
I guess to just not launch at any, you

know, at any point in time, but you can
just always time it, and by the time the

person gets a million text it's too late.
Q: Thanks.

M.V.: Yeah.
Herald: One more question over here

please.
Q: Thank you. On apple phones you can

activate with some care the, what they
call visual voicemail. Would that prevent

your attack to work, or..?
M.V.: No there is actually, I believe he

was an Australian researcher, that looked
into the visual voicemail and he was able

to find that in reality uses the IMAP, If
I remember correctly, protocol, and for

some carriers he was able to to launch
brute force attacks because the

authentication wasn't with the same pin as
you get when you dial in. But he found at

least one carrier in Australia I believe
that was vulnerable through visual

voice mail protocol. And I check for
German carriers. I did that, I actually

follow the steps that he did, to see if
that was worth mentioned in here. I didn't

find it to be vulnerable, but that doesn't
mean that that's not the case.

Herald: One more last question.
Q: Thank you for the talk. What is your

recommendation to American carriers to
protect themselves against this attack?

M.V.: I put a slight slide there. Like for
me I guess the most important thing is

really look at what some German carriers
are doing I really like that in the recent

past where it sends it to you over SMS as
soon as it detects that someone dialed,

tried six times the wrong pin. I mean if
you have physical access to a locked

device you could claim that if someone has
the preview turned on the device you could

still see the pin, you know when you get
it so. But then it wouldn't be like a

remote attack anymore, so definitely
detect brute forcing and shut down. I mean

we know that with the caller I.D. is not
working so well for a Telecom, because I

was able to bypass it. But I know that,
because I did some test with HLR records

that you can actually tell the type of
device that it is, if it's a virtual

number. So if carriers could actually look
at the type of phone that is trying to

call in. I think if it's a virtual number,
you know, red flag. If it's not I don't

think someone is going to have... I guess
the government could like, you know have

3333 devices because you try one pin for
the 10000 keyspace, you know. You try 3

pins at a time and just have 3333 SIM
cards and so it will come from real

devices. But then at least it will quite
significantly mitigate it. And then like

again like if you ban DTMF tones from the
greeting message that will help as well.

Herald: Thank you Martin. I have never
provided any telephone number to any

platform and now thanks to you I know why.
Warm applause for Martin Vigo please.

M.V.: Thank you

applause

35c3 postroll music

subtitles created by c3subtitles.de
in the year 2019. Join, and help us!