Video and Slides
Outline: Tools for Offensive RTC security. Introducing SIPVicious PRO and the demo server.
Sandro Gauci, CEO / Senior Penetration Tester / Chief mischief officer at Enable Security GmbH
In Sandro’s previous talk for TADSummit EMEA Americas 2020, he spoke about why it is critical to take an offensive approach when dealing with RTC security.
In this presentation, he shows how tools can help in testing RTC security as well as in learning more about offensive security for RTC.
After a general overview of the landscape, he will focus on the work that his team has done on SIPVicious PRO and the target demo server that helps learn and show vulnerabilities in a lab environment.
You can ask Sandro any questions about this presentation in the comments section of this weblog, or contact him directly with the info at the end of his presentation.
As mentioned above, in Sandro’s previous talk for TADSummit EMEA Americas 2020, he spoke about why it is critical to take an offensive approach when dealing with RTC security.
With this presentation he focused on their commercial offer SIPVicious PRO and the demo server to test out all the potential vulnerabilities SIPVicious can expose. They plan to open source the demo server once the code is tidied up. Please keep reminding Sandro 😉
SIPVicious PRO is an entirely new code base, it enables testing across SIP, RTP, and TURN, with full WebRTC, and custom protocols coming soon. Some of the features include:
- Various attacks, including SIP flood, RTP flood, SIP enumeration, digest leak, RTP Bleed and RTP inject
- Fuzzing to discover unknown vulnerabilities
- Support for SIP over different transport protocols: TCP, UDP, TLS and WebSockets
- Integration within QA automation systems, including CI/CD pipelines
- A flexible templating system so that SIP messages may be easily modified
- Support for RTP attacks
- Insane speed, especially useful for flood attacks with rate limiting capabilities
As always with Sandro, there are lots of live demos throughout the presentation to see the code in action.
Open source projects need to find a way to put food on their table, giving away software does not do that. In the awesome RTC hacking list there are some great projects that do not get maintained because of this issue. At TADSummit we try to promote projects to a broader audience, outside the open source community.
Some projects have a big sponsor (sugar-daddy) like Asterisk with Sangoma. SIPVicious PRO provides one of a number of revenue streams (in addition to training, consulting, and offensive security testing) to help Sandro continue to support the open source SIPVicious and demo server. It’s simply up to the community to keep him balanced between the OSS and commercial sides of SIPVicious; as we see with many other open source projects that lack a sugar-daddy 😉
Thank you Sandro for a clear and demo-rich presentation of SIPVicious Pro and the demo server.