** Security issue with Bandwidth.com **

Submitted by Hoover87 on Tue, 02/02/2010 - 13:20

I just found a major security issue with 2 systems using Bandwidth.com.  The end users are unrelated.
 
The issue is with Bandwidth's Edgemarc.  Bandwidth.com has opened port 5060 to the entire Internet, unrestricted, and forwards anything received on 5060 to the cutomer's PBX, router, gateway, UC500.  With this configuration anyone on the Net can point a SIP client to the Edgemarc's public IP and make a phone call.  When the SIP messages are forwarded to the router/UC500 they appear to be sourced from the "trusted" Edgemarc IP, but in fact are sourced from anywhere on the Net.  Note: Bandwidth.com doesn't use SIP registration, they expect you to "trust" the IP of their servers or gear.
 
The disturbing points, the Bandwidth techs had a difficult time understanding why this was a risk....even after watching multiple rougue international calls traverse the Edgemarc.  Also disturbing, one of these Edgemarcs was locked down at one time because I tested for this vulnerability at the time if install, but now that is no longer the case and Bandwidth techs insisted that port 5060 should be open to the entire Internet!?!?!
 
Bottom line, if you are connecting to Bandwidth.com using an Edgemarc or any Bandwidth gear at your site, check the security.  Better yet, do not trust Bandwidth.com with the security of your network.  On a similar, but unrelated note, in one of these cases the end customer also advised me that Bandwidth.com had also left the default passwords on the Edgemarc as well.  The passwords have since been changed due to efforts by the end customer.

5
Average: 5 (1 vote)
Your rating: None
‹ iPhone SipPhone client working with Cisco UCME 7970 Contrast Problem ›

Comments

Bandwidth.com's SOP for Edgemarc installs

by Bandwidth.com - 02/03/2010 - 16:16

Thanks for pointing out this issue.  This circumstance is not indicative of our standard Edgemarc deployment procedure. The default setting for Edgemarcs that Bandwidth.com sends to customers is for the proxy ports 5060 to be locked-down to Bandwidth.com's proxy facilities only (this is a simple check-box in the Edgemarc set-up).  In this case, it appears that the Edgemarc may have been "factory defaulted" (since it was locked-down properly in the beginning, as you indicated), which may also explain the default passwords... our standard is not to use the factory defaults for passwords.
We are constantly looking for ways to improve our security processes, so rest assured that we will look further into this situation to see if there are any additional measures we can take to protect the security of our customers and the integrity of our network.Feel free to contact Sean Rivers (srivers at bandwidth.com) if you would like to discuss further.  Thanks!
Bandwidth.com

Thank you for the response

by Hoover87 - 02/03/2010 - 18:28

Thank you for the response however, a concern is that the engineers on shift thought we were crazy to even suggest that the Edgemarc be locked down to only Bandwidth.com's proxies.  Possibly your training plans should be reviewed.
 
Only one of the compromised sites had default passwords, but in any case it appears that you are reviewing your processes.
 
Thank you for your efforts.
 
 

From outside your network,

by Hoover87 - 02/03/2010 - 11:55

From outside your network, take a simple SIP client like xlte, point it to the public IP of the Edgemarc, tell xlite not to register.  Then dial a number as if you were on your network, i.e. 9.........., or even internal ext.

Xlite

by dsar - 02/03/2010 - 12:12

When you used Xlite to test this, did you enter a username and password to authenticate in the SIP account config?  I'm asking because without this information it seems that Xlite will not enable the SIP account.

You can enter the user naem,

by Hoover87 - 02/03/2010 - 12:17

You can enter the user naem, password, Auth name......domain should be the Edgmarc IP....uncheck Register with domain.  I click the proxy button and enter the Edgemarc IP there too.
 
click OK and it should do its thing.

This is concerning

by dsar - 02/03/2010 - 11:50

Can you elaborate on how you came to realize this?  I have two clients currently using Edgemarcs.  I just checked and they are both configured to use the default username and password and the web interface is accessible from the internet.  I'd like to verify if the Edgemarc is also allowing connections on port 5060 from anyone.

Wow!  Thanks for posting this

by babul - 02/03/2010 - 10:48

Wow!  Thanks for posting this information.  Hopefully Bandwidth.com will respond publically about this.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.