SIP Password Security - How much is yours worth?

Written in 2012, and the costs below are that year's cloud prices. Password cracking hardware has become much faster and cheaper since, so treat the recommended lengths as the least you should use. SIPSorcery now generates SIP account passwords for you: 22 random letters and digits, which is length rather than symbols doing the work, and far beyond anything the figures below could brute force.

Overview

SIP uses a challenge response mechanism to authenticate certain types of requests, in particular REGISTER and INVITE requests. The SIP standard does dictate that other types of requests such as ACKs, BYEs and CANCELs should be authenticated as well, but SIP servers will often overlook that requirement.

Assuming the SIP request is being authenticated, the typical procedure is that the SIP client sends a request without credentials to the server, and the server responds with an authentication challenge. The simplest authentication challenge that a SIP server can send contains a realm and a nonce.

WWW-Authenticate: Digest realm="sipsorcery.com",nonce="16409782311597338199"

The client combines the realm and nonce along with the username, password, request type and request URI to construct an MD5 hash that is then sent back to the server. In the example below the response field contains the 128 bit MD5 hash.

Authorization: Digest username="someuser",realm="sipsorcery.com",nonce="16409782311597338199", uri="sip:sipsorcery.com",response="4bafec8d920b26740681dd286b316f85",algorithm=MD5

The server then performs the same process to arrive at its own MD5 hash, and if it's the same as the one supplied by the client it can have a degree of confidence that the client knows the password.

MD5 algorithm

The server can't be certain the client knows the password. For example the client could be a malicious party that managed to get hold of a previous request from a genuine client and resent it without ever knowing the password. That's where the nonce comes in: it's how the server protects against replay attacks. This means the server must have a good policy for how it generates and accepts nonces in authorisation headers. A typical approach is for a server to encode a timestamp in the nonce and only accept the header if the timestamp is within a short time of the current time.

Replay and other attacks aside, the protection offered by SIP digest authentication comes down to the cryptographic strength of the MD5 hash and the length of the password supplied to it; with a short or common password an attacker can quickly use a brute force or dictionary attack to try lots of different passwords until they generate the same hash, and then they know the password.

Assuming a strong password is being used, the strength of the MD5 algorithm is the next point of vulnerability. The algorithm was invented in 1991 and since then it has been subject to extensive scrutiny, and a number of weaknesses have been found, such that in December 2008 the United States Computer Emergency Readiness Team (US-CERT) issued a vulnerability notice for MD5 that contained the paragraph below.

Do not use the MD5 algorithm

Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. As previous research has demonstrated, it should be considered cryptographically broken and unsuitable for further use.

The US-CERT advisory uses the example of attackers generating an SSL certificate to impersonate a trusted Certificate Authority (CA). For a Certificate Authority a compromise of their certificate is a very serious issue: their whole business of selling SSL certificates relies on people trusting their signatures, so an attacker able to forge one would put many millions of dollars of revenue at risk.

Brute forcing SIP MD5 hashes

But what does it mean for SIP? How easy is it for an attacker to use an MD5 hash obtained from a SIP authentication header to recover the original password? How much does it cost to simply brute force an MD5 hash?

I'm not a cryptanalyst, so exploiting the flaws identified in the MD5 algorithm is beyond me. From my limited understanding the flaws revolve around generating a hash collision, where two plain text values produce the same MD5 hash. That's a big problem for someone like a Certificate Authority relying on their hashes for years, but for SIP, where the nonce can be rotated every few minutes or seconds, even if a fake SIP request could be made to produce the same hash as a genuine one it would only be useful for a short time. Even then, the changes needed to the request to cause the collision would probably make it an invalid request and stop it reaching the authentication stage at all.

That leaves dictionary and brute force attacks. Dictionary attacks aren't that interesting, since it's a certainty that if plain words, or even variations such as replacing vowels with numbers, are used, the password can be found in minutes if not seconds with extensive word lists.

What I'm interested in is random passwords made of a pseudo-random combination of the 95 printable ASCII characters, for example something like Jh53%aq()d. What length of password is likely to make it prohibitively expensive for an attacker to bother? Before answering that, a value needs to be put on a SIP password. It's somewhat arbitrary, but $100 is likely to be more than the credit in most SIP accounts, and it's also around the level at which fraud detection for unusual call patterns is likely to trigger, so it's around the amount an attacker could expect to get from a compromised account before being detected and blocked.

To answer the question I ran a brute force attack against MD5 hashes with passwords of different lengths and worked out what the computing power for it cost. An easy way to put a value on the computing power was to run the attack on Amazon's EC2, which charges by the hour. After a bit of trial and error I settled on an instance size and image, and found some easily accessible testing tools.

Cracking MD5s with John the Ripper, SIPCrack and Amazon's EC2

Of course the intention of this guide isn't to make it easier for bad people to compromise SIP passwords. Instead it's to show exactly what's involved for an attacker wanting to crack a password, and so hopefully encourage the use of SIP passwords of adequate strength.

1. Launch an EC2 High-CPU instance of a publicly available CentOS Linux image. The cost for the instance at the time of the test was $0.68 an hour. That image already had most of the developer tools installed; the OpenSSL development package was missing and was installed with yum install openssl-devel.
2. The tool used to brute force the SIP digest was SIPCrack. It's always good to be careful with security tools like this, and I did a quick review of the source code to make sure there were no obvious back doors. Since the test was on an EC2 image that was terminated afterwards, the risk was very limited.
3. As well as the brute force tool, a way to generate the password attempts is needed. For that I used another accessible and dramatically named tool, John the Ripper. Despite the gruesome name I used it solely to generate password attempts for SIPCrack.
4. Next, SIPCrack needs a SIP authentication digest to crack. The SIPCrack package includes a tool to extract digests from a Wireshark capture, but the file format SIPCrack needs is very simple so I created it by hand. The line below in a file called digest.txt is all it needs.

   10.1.1.2"69.59.142.213"someuser"sipsorcery.com"REGISTER"sip:sipsorcery.com"15624921921188954060 """"MD5"4bafec8d920b26740681dd286b316f85

5. A brute force attempt involves two steps running in parallel: John the Ripper generates password attempts into an in-memory pipe (better than a file on disk, given its size), and SIPCrack reads the passwords from the pipe and applies them to the digest. With lower case characters and passwords up to 6 characters long it took approximately five and a half minutes.

SIP MD5 brute force test results

The method was to increase the maximum password length and to use different character sets, to approximate how long an attacker would take to brute force a password of a given length from a given character set. From the results it's then possible to extrapolate to longer passwords.

As expected, the brute force attempts took a consistent time per password. I did some quick tests on other Amazon instance types to see whether any would be more cost effective.

The m1.large instance was the most cost effective, at $0.0000000000954 per password checked. Put another way, approximately $1 of computing was enough to brute force each of the following:

• a 7 character password using only lower case letters,
• a 6 character password using letters, numbers and a few other ASCII characters,
• a 5 character password using all the printable ASCII characters.

How much is a SIP password worth?

Assuming an attacker will be interested in brute forcing a SIP digest for anything under $100, the minimum lengths for a SIP password are:

• 9 characters for a password using only lower case letters,
• 7 characters for a password using letters, numbers and a few other ASCII characters,
• 6 characters for a password using the whole printable ASCII range.

These rely on the prices of Amazon's on demand EC2 instances, and prices can come down a lot; the m1.large instance could be had for $0.08 rather than $0.34 an hour. Amazon's hardware isn't renowned for being the cheapest way to buy computing power either, and a hosted dedicated server, or an attacker's own hardware, is likely to be cheaper. Hardware also keeps improving, so a password that's hard to brute force today may not be next year.

In conclusion, a password used in a SIP digest should be at least 8 characters long, preferably 10, and contain all of the following.

• Lower case letters,
• upper case letters,
• a number,
• a character that is neither a letter nor a number.