Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Sontaran Status Update 1
Date
04 June 2013
Foundational Work:
- SDK unpacked and built
- Toolchain builds user and kernel code
- Bill P. provided useful scripts and knowledge
Establishing Initial Access:
- enable SSHSecure Shell through web interface
- use TFTPFile transfer software to upload tshd
- write tshd to writable directory (/usr/sbin)
- add tshd.cmd to webroot -- un-authenticated execute trick found by Bill P.
- add tshd to start-up script
- persistent root shell access!
General Design of Siemens OpenStage 15 HFA VoIP Phone:
- Two processors -- 1 dedicated to phone functionality, 1 running Linux and providing interface to User
- Communication between two processors through Linux OSOperating System device drivers. There is a "command" channel with multiple "data" channels (4-8+)
- Linux device drivers expose kernel functions; or ioctls to user-space apps once /dev/device is opened
- Several drivers provide access to voice processor: ifx_mps and drv_tapi
- ifx_mps - present on the Siemens phone and provides a low-level interface
- drv_tapi - NOT present on the Siemens phone. Provides a higher-level interface that is better documented.
ifx_mps (multi-processor system):
- Example APIApplication Programming Interface functionality:
- MPS event registration
- MPS mailbox read and write (most important -- although commands to pass are not well defined)
- MPS get status
- MPS get command history
- MPS reset, restart
- MPS download [firmware]
- SDK provide limited example user-space applications. The provided stream application works where the tone generation is the easiest to demonstrate:
stream application (May 28 2013, 12:19:17)
Usage: stream [OPTIONS]
Example: stream -f firmware.bin -T -a -L
Options:
-f <file> Firmware file download
-e <codec> Codec select
-a Activate Streaming
-L High level loop
-l Local narrowband loop
-w Local wideband loop
-p <dclfreq> Local PCM loop
-t Tonegenerator
-v Print Firmware Version
-R Restart VCPU
-r Reset VCPU
-b Print command history buffer
-u <IP>:<port> Start UDPUser Datagram Protocol Connection
-c <IP>:<port> Start TCPTransport Control Protocol Client
-s <IP>:<port> Start TCPTransport Control Protocol Server- ifx_mps interface is cryptic. In the stream application, for example, I don't understand where it gets the values it passes to the ifx_mps driver. These values are hard-coded. They are not defined in a header file, nor can I find them in the driver source code. They appear to be passed directly to the voice processor without further interpretation.
drv_tapi Example API:
- NOT present in the Siemens. Requires 2+ modules. Used SDKSoftware Development Kit to build drv_tapi, drv_vmmc, and hapi.o. drv_tapi and drv_vmmc load without problems on the phone. hapi.o fails to load and reports error. According to documentation, hapi.o is a parrallel interface -- supposedly higher level, but of less interest. The fact that it doesn't load seems to be unimportant. After drv_vmmc is loaded, the appropriate device files are created under /dev.
- In a sample application, I attempt to use the TAPITelephony Application Programming Interface interface, but have yet to achieve any useful functionality. Opening the device files are successful and return valid file descriptors. After opening the devices (command and data channels), I send commands that would:
- initialize channels (claims success, but success seems to be the default return value -- also, not sure initialization is needed) -- Sec 2.9
- register for events (like on/off-hook) -- Sec 2.7
- query for hook status -- Sec 4.1.9.9
- play tones -- Sec 3.5.2
- Could try other functionality, possibly other prerequisite configuration needed that I'm not doing or not doing properly, such as:
- channel initialization
- attaching / associating data channels to resources
- setting up audio modes
- Additional functionality one could try:
- detect room noise -- Sec 3.2.3
- configure hook timing thresholds -- Sec 2.8.1
- attempt to ring phone -- Sec 3.6
Next Steps?
- Phone can't find call manager and reports "Telephony is down (HO2)". Could this impact functions available?
- Diagnose HAPIHL7 Application Programming Interface load failure
- I know little about the Phone Application (PA) produced by Siemens (appears to be called "Opera") and I could begin reversing these. These predominantely take the form of:
- (93 processes) SvcConfig services.conf -startLogDaemon -logAll V2 R0.92.0 HFA 120822
- (58 processes) PhoneletLauncher messageshfa.phd V2 R0.92.0 HFA 120822 WP1 Siemens HFA GB en DD.MM.YYYY 24HR 0
- Google searches on Opera and ifx_mps have yielded no additional insight; however, a fresh look with what we know know may put open source information into better context.