7 ms·

History seems to keep reminding us that in-band signalling is a convenient idea fraught with danger.

josh2600 14y ago
Look no further than the deprecated 5ESS switches which used to give up free calls due to 2600hz tones being signaled inband. Ask Steve Jobs and Woz about BlueBoxes; you need look no further to see the inherent dangers on inband signaling. Slightly off-topic, but still relevant IMHO.
- tptacek 14y ago
  Blue boxing predates 5ESS switches; 5ESS was notoriously the switch you couldn't blue-box.
  - josh2600 14y ago
    Oh really? I always thought SS7 was the first switch to move to out of band. What's the last blueBox-able switch?
    - dalke 14y ago
      Let's see. Phrack Volume Three, Issue 25 says "In March of 1982, the 5ESS switch first went into operation." Esquire published "Secrets of the Little Blue Box" in the October 1971 issue of Esquire, based on the phone system MF design from the 1950s/1960s. That means blue boxing started at least 15 years before 5ESS, as tptacek pointed out. The 1987 Phreakers Manual (http://fringe.davesource.com/Fringe/Hacking/Phreaking/Phreakers_Manual http://fringe.davesource.com/Fringe/Hacking/Phreaking/Phreak... ) says "Blue boxing becomes harder as all Bell switching and transmission facilities go under to CCIS. Then to further complicate things, digital microwave, fiber optic, and satellite transmission are all coming to be digital and do not recognize 2600hz for the hang up signal. I predict that around 1990, blue boxes will be obsolete from all major cities." The 2600 FAQ, Section C-07, says (the earliest date I found for this was August 9, 1993): "Because of ESS Blue boxing is impossible". This is incorrect. ... While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). ... So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. I don't know the switch models enough to say if it was exactly 5ESS, but everything suggests that that is the case.
      - josh2600 14y ago
        Thanks for the wonderfully educational comment :). I sincerely appreciate it!
    - RyJones 14y ago
      SS7 isn't a switch, it's an inter-switch OOB protocol.
- georgemcbay 14y ago
  Asking Steve Jobs a question is going to require a very impressive in-band signaling hack on a system that appears to have no such vulnerability.
  - mikeash 14y ago
    Asking Jobs is pretty easy. It's getting an answer that's difficult.
    - skrebbel 14y ago
      You're a ruby or obj-c coder, I assume?
      - jbrechtel 14y ago
        An Objective-C coder would get an answer thanks to Objective-C's terrible nil semantics.
- wglb 14y ago
  No, 5ESS was the switch that used out-of-band signalling and was not susceptible to 2600 tricks.
- jacquesm 14y ago
  Maybe you didn't get the memo about Steve Jobs?
aaronblohowiak 14y ago
This isn't an in-band signaling error, per se. This is not an issue of escaping the quotes or something, rather the way this issue works is that User.find_by_username(params[:username]) is interpreted wildly differently if params[:username] is a string compared to if it is a different data type. If it is not a string, then the "options" for the dynamic finder are automatically extracted. It turns out that you probably don't want to leave it up to your user to decide if that param should be a string or a more complex data type... for instance, before this patch you could do User.find_by_username('whocares', :conditions=>"ARBITRARY SQL")
- thenonsequitur 14y ago
  While the method itself may not be doing in-band signaling, the vulnerability is certainly very related. What was supposed to be strictly data, params[:username], actually becomes an in-band signal -- and that's the exploit.

Look no further than the deprecated 5ESS switches which used to give up free calls due to 2600hz tones being signaled inband. Ask Steve Jobs and Woz about BlueBoxes; you need look no further to see the inherent dangers on inband signaling. Slightly off-topic, but still relevant IMHO.

tptacek 14y ago
Blue boxing predates 5ESS switches; 5ESS was notoriously the switch you couldn't blue-box.
- josh2600 14y ago
  Oh really? I always thought SS7 was the first switch to move to out of band. What's the last blueBox-able switch?
  - dalke 14y ago
    Let's see. Phrack Volume Three, Issue 25 says "In March of 1982, the 5ESS switch first went into operation." Esquire published "Secrets of the Little Blue Box" in the October 1971 issue of Esquire, based on the phone system MF design from the 1950s/1960s. That means blue boxing started at least 15 years before 5ESS, as tptacek pointed out. The 1987 Phreakers Manual (http://fringe.davesource.com/Fringe/Hacking/Phreaking/Phreakers_Manual http://fringe.davesource.com/Fringe/Hacking/Phreaking/Phreak... ) says "Blue boxing becomes harder as all Bell switching and transmission facilities go under to CCIS. Then to further complicate things, digital microwave, fiber optic, and satellite transmission are all coming to be digital and do not recognize 2600hz for the hang up signal. I predict that around 1990, blue boxes will be obsolete from all major cities." The 2600 FAQ, Section C-07, says (the earliest date I found for this was August 9, 1993): "Because of ESS Blue boxing is impossible". This is incorrect. ... While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). ... So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. I don't know the switch models enough to say if it was exactly 5ESS, but everything suggests that that is the case.
    - josh2600 14y ago
      Thanks for the wonderfully educational comment :). I sincerely appreciate it!
  - RyJones 14y ago
    SS7 isn't a switch, it's an inter-switch OOB protocol.
georgemcbay 14y ago
Asking Steve Jobs a question is going to require a very impressive in-band signaling hack on a system that appears to have no such vulnerability.
- mikeash 14y ago
  Asking Jobs is pretty easy. It's getting an answer that's difficult.
  - skrebbel 14y ago
    You're a ruby or obj-c coder, I assume?
    - jbrechtel 14y ago
      An Objective-C coder would get an answer thanks to Objective-C's terrible nil semantics.
wglb 14y ago
No, 5ESS was the switch that used out-of-band signalling and was not susceptible to 2600 tricks.
jacquesm 14y ago
Maybe you didn't get the memo about Steve Jobs?

aaronblohowiak 14y ago

This isn't an in-band signaling error, per se. This is not an issue of escaping the quotes or something, rather the way this issue works is that User.find_by_username(params[:username]) is interpreted wildly differently if params[:username] is a string compared to if it is a different data type. If it is not a string, then the "options" for the dynamic finder are automatically extracted. It turns out that you probably don't want to leave it up to your user to decide if that param should be a string or a more complex data type... for instance, before this patch you could do User.find_by_username('whocares', :conditions=>"ARBITRARY SQL")

thenonsequitur 14y ago
While the method itself may not be doing in-band signaling, the vulnerability is certainly very related. What was supposed to be strictly data, params[:username], actually becomes an in-band signal -- and that's the exploit.