<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Plausible since I see a firmware release for the same and based on
my experience they largely share the same codebase. <br>
<br>
<br>
<div class="moz-cite-prefix">On 02/06/2013 02:29 PM, Erik Flournoy
wrote:<br>
</div>
<blockquote
cite="mid:CADUV08zAvSSqGuS15unQDzkzc6ZF74p1RHg70ep+6STcvx5ozw@mail.gmail.com"
type="cite">Hey do you know if that affcts the GXW as well?
<div><br>
</div>
<div><br clear="all">
<div>Erik Flournoy
<div>808-426-4527<br>
301-218-7325
<div><br>
</div>
<div><span>CONFIDENTIALITY NOTICE<br>
This e-mail message, including any attachments from
EESPRO.com - contain information which is CONFIDENTIAL
AND/OR LEGALLY PRIVILEGED. The information is intended
only for the use of the individual named above and may
not be disseminated to any other party without written
permission. If you are not the intended recipient, or
the employee or agent responsible for delivering the
message to the intended recipient, you are hereby
notified that any dissemination, disclosure,
distribution, copying or taking of any action in
reliance on the contents of this e-mailed information is
strictly prohibited. If you have received this
transmission in error, please immediately notify <span
style="color:blue"><a moz-do-not-send="true"
href="mailto:info@eespro.com" target="_blank"><font
color="#1155cc">i</font>nfo@eespro.com</a></span>,
and permanently delete this e-mail and the attachments
hereto, if any, and destroy any printout thereof. </span><span><span
style="font-size:x-small"><span
style="font-family:arial,helvetica,sans-serif"><span
style="font-style:italic"> </span></span></span></span>
</div>
</div>
</div>
<br>
<br>
<div class="gmail_quote">On Wed, Feb 6, 2013 at 12:15 PM, Ryan
Delgrosso <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:ryandelgrosso@gmail.com" target="_blank">ryandelgrosso@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
All,<br>
Over the last few months we have uncovered a vulnerability
in the HT502 that allows for theft of credentials from
customer devices. I am sending this out since the issue has
now been resolved in a new release of firmware BUT
Grandstream have NOT sent out any kind of pro-active
notifications nor included this fix in their release notes
for this build. After conferring with some other sizable
providers also using this device at scale, they were able to
"connect the dots" on their up-tick in fraud based on our
discovery.<br>
<br>
<br>
First some history:<br>
<br>
We currently have over 50,000 deployed HT502's in active
customer service.<br>
<br>
Beginning in December we saw an immediate and sizable
up-tick in fraud by easily an order of magnitude.<br>
<br>
Statistical analysis of the fraud showed the ONLY linking
factor to be the fact that the compromised accounts were ALL
using the HT502 device AND had WAN port access enabled to
the device, and we as the provider were locked out (admin
password changed, no longer provisioning from us on
scheduled interval)<br>
<br>
After some digging and conferring with Grandstream technical
gurus it was confirmed there was a buffer overflow
vulnerability that would allow a remote attacker to change
the admin password WITHOUT rebooting the device or otherwise
having any administrative access to it. Once the password
was changed the attacker could log in with the new password
and complete control. On all versions prior to 1.0.5.10 the
SIP credentials could be extracted from the admin website
with the "Download config" option. On versions up to 1.0.8.4
the sip credentials were STILL extractable from the telnet
interface if the provisioning values were known by the
attacker.<br>
<br>
All of these vulnerabilities are fixed in version 1.0.9.1. I
encourage you to test and deploy this version ASAP.<br>
<br>
<br>
I am sending this out in a purely advisory capacity in the
hopes that education will prevent further monetary damages.
Please feel free to contact me on or off list if you want to
know more about this issue.<br>
<br>
-Ryan<br>
_______________________________________________<br>
VoiceOps mailing list<br>
<a moz-do-not-send="true"
href="mailto:VoiceOps@voiceops.org" target="_blank">VoiceOps@voiceops.org</a><br>
<a moz-do-not-send="true"
href="https://puck.nether.net/mailman/listinfo/voiceops"
target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
</blockquote>
</div>
<br>
</div>
</blockquote>
<br>
</body>
</html>