Under the hood
The tool establishes a TCP connection and creates a Q.931 ‘SETUP’ message. If you run Wireshark, you can see the ‘SETUP’ message being sent with other fields in the Q.931 protocol.
If the remote videoconferencing equipment answers with the ‘ALERTING’ message, it implies that the equipment is ringing to indicate an incoming call. It also implies that ‘auto-answer’ is turned OFF. But if the videoconferencing equipment answers with the ‘CONNECT’ message, that implies that we are connected to the videoconference. The remote equipment is accepting incoming calls automatically (‘auto-answer’ is ON).
Why release this tool?
As we've seen, the process of detecting ‘auto-answer’ requires a real call to be placed on the videoconferencing equipment. At this time, we think this could be disruptive, possibly causing interruptions or annoyance, so we have provided the option to use auto-tect.py to detect wether 'auto-answer' is enabled manually.
Customers can use QualysGuard in conjunction with the auto-detect.py tool to identify videoconferencing systems with 'auto-answer' enabled as follows:
- Use QualysGuard scanner to find H.323 equipment. For existing scans, this can be achieved by creating a report filtered by service and port. If your existing scans are stale, you can do a selective scan on QID 82023 which lists all TCP services and then create a report filter.
- Use the tool above to manually confirm if ‘auto-answer’ is enabled.
This videoconferencing vulnerability, like the printer vulnerability identified in January, is a timely reminder that, while most vulnerability management effort is focused on the core set of servers and end-user devices like PCs, it's important to consider the potential vulnerability of all devices in your network.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.