The IP Multimedia Subsystem (IMS) facilitates telecom operators in delivering multimedia applications and voice traffic over IP transport. Proxy Call Session Control Function (P-CSCF) is the first node in IMS Platform (figure 1) to interact with the User Equipment (UE) when initiating a VoLTE call.
|figure 1 – Placement of Proxy Call Session Control Function in IMS Platform|
Identify and Compromise Proxy Call Session Control Function with VoLTE phone:
1) Initiate a call with VoLTE phone and simultaneously open phone’s terminal to list currently established sessions. It was possible to identify the IP address of serving P-CSCF node, connected on port 5060 (figure 2).
|figure 2 – Identifying P-CSCF node connected on port 5060 (SIP protocol)|
2) Management console of an application server and Proxy Call Session Control Function application (figure 3 & figure 4) were found by performing a service scan on identified IP address.
|figure 3 – P-CSCF applications’s management console|
|figure 4 – Application server’s management console|
3) Application server, Oracle Glassfish, was found to be weakly configured and could be accessed using weak credentials (figure 5).
|figure 5 – Access to Oracle Glassfish server using weak credentials|
4) A reverse shell was triggered using a web shell and gained root access of the P-CSCF node (figure 6).
|figure 6 – Gained root access to P-CSCF (IMS)|
After gaining access to the IMS platform, Attacker can compromise other core telecom components in the network.
To prevent such attacks, telecom operators should ensure traffic segregation between user plane, control plane, and management plane. It is highly recommended to patch all the core network elements with the latest security patches released by the vendor. Also, develop and implement minimum security guidelines before integrating nodes in the network.
Hope you enjoyed reading, suggestions are always welcome.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.