Zoom ZTP & AudioCodes Phones Flaws Uncovered, Exposing Users to Eavesdropping

Various security vulnerabilities have been disclosed in AudioCodes desk telephones and Zoom’s Zero Contact Provisioning (ZTP) that could be possibly exploited by a destructive attacker to carry out distant attacks.

“An external attacker who leverages the vulnerabilities discovered in AudioCodes Ltd.’s desk telephones and Zoom’s Zero Touch Provisioning element can gain complete distant handle of the equipment,” SySS security researcher Moritz Abrell said in an examination released Friday.

The unfettered accessibility could then be weaponized to eavesdrop on rooms or phone phone calls, pivot via the gadgets and attack corporate networks, and even build a botnet of contaminated products. The exploration was presented at the Black Hat United states of america security meeting before this week.

The challenges are rooted in Zoom’s ZTP, which lets IT administrators to configure VoIP products in a centralized fashion this kind of that it helps make it straightforward for organizations to observe, troubleshoot and update the units as and when demanded. This is attained by indicates of a web server deployed in the neighborhood network to supply configurations and firmware updates to the products.

Specially, it was located to lack customer-side authentication mechanisms throughout the retrieval of configuration data files from the ZTP provider, thus foremost to a state of affairs wherever an attacker could potentially result in the download of destructive firmware from a rogue server.

The research additional uncovered incorrect authentication issues in the cryptographic routines of AudioCodes VoIP desk telephones (which help Zoom ZTP) that enable for the decryption of delicate information and facts, these as passwords and configuration information transmitted by means of a redirection server employed by the phone to fetch the configuration.

The twin weaknesses, i.e., the unverified ownership bug and flaws in the licensed hardware, could then be fashioned into an exploit chain to provide malicious firmware by abusing Zoom’s ZTP and triggering arbitrary products into installing it.

“When merged, these vulnerabilities can be utilized to remotely consider more than arbitrary equipment. As this attack is remarkably scalable, it poses a important security risk,” Abrell mentioned.

The disclosure arrives approximately a calendar year following the German cybersecurity firm identified a security issue in Microsoft Teams Direct Routing performance that could render installations prone to toll fraud attacks.

“An exterior, unauthenticated attacker is capable to mail specially crafted SIP messages that fake to originate from Microsoft and are hence appropriately categorised by the victim’s Session Border Controller,” Abrell noted at the time. “As a end result, unauthorized exterior phone calls are designed by the victim’s phone line.”

Found this article exciting? Comply with us on Twitter  and LinkedIn to examine far more unique written content we submit.

Some elements of this short article are sourced from:
thehackernews.com