There are serious vulnerabilities in Cisco VoIP (voice over Internet protocol) telephones as attackers could easily insert malicious code into a phone and start eavesdropping on private conversations from anywhere in the world.
“It’s not just Cisco phones that are at risk. All VoIP phones are particularly problematic since they are everywhere and reveal our private communications,” said Columbia University Computer Science Professor Salvatore Stolfo. “It’s relatively easy to penetrate any corporate phone system, any government phone system, any home with Cisco VoIP phones—they are not secure.” Stolfo researched the issue with Columbia Engineering’s Computer Science PhD candidate Ang Cui.
Cui and Stolfo analyzed the phones’ firmware (the software running in the computer inside the phone) and they were able to identify vulnerabilities. One concern was with embedded systems widely used and networked on the Internet, including VoIP phones, routers, and printers, and have focused their research on developing new advanced security technology to protect these systems.
“Binary firmware analysis is commonly used to identify faulty software by the ‘white hat’ hackers and security scientists and researchers like our team,” Stolfo said. “We performed this analysis to demonstrate a new defense technology, called Software Symbiotes, (can) protects them from exploitation.”
Software Symbiotes safeguards embedded systems from malicious code injection attacks into these systems, including routers and printers.
“This is a host-based defense mechanism that’s a code structure inspired by a natural phenomenon known as symbiotic defensive mutualism,” Cui said. “The Symbiote is especially suitable for retrofitting legacy embedded systems with sophisticated host-based defenses.”
The researchers see these Symbiotes as a kind of digital life form that tightly co-exists with arbitrary executables in a mutually defensive arrangement.
“They extract computational resources (CPU cycles) from the host while simultaneously protecting the host from attack and exploitation,” Cui said. “And, because they are by their nature so diverse, they can provide self-protection against direct attack by adversaries that directly target host defenses.”
“We envision a general-purpose computing architecture consisting of two mutual defensive systems whereby a self-contained, distinct, and unique Symbiote machine is embedded in each instance of a host program,” Stolfo said. “The Symbiote can reside within any arbitrary body of software, regardless of its place within the system stack. It can be injected into an arbitrary host in many different ways, while its code can be ‘randomized’ by a number of well-known methods.”
The Symbiote, which at runtime must successfully execute in order for the host to operate, then monitors its host’s behavior to ensure it continues to operate correctly, and, if not, it stops the host from doing harm. Removal, or attempted removal, of the Symbiote renders the host inoperable.
“The beauty of the Symbiote,” Cui said, “is that it can be used to protect all kinds of embedded systems, from phones and printers to ATM machines and even cars — systems that we all use every day.”
Cisco released a patch to repair these vulnerabilities but it is ineffective, the researchers said.
“It doesn’t solve the fundamental problems we‘ve pointed out to Cisco,” Cui said. “We don’t know of any solution to solve the systemic problem with Cisco’s IP Phone firmware except for the Symbiote technology or rewriting the firmware.”