| Name |
Blue Boxing |
|
| Likelyhood of attack |
Typical severity |
| Medium |
Very High |
|
| Summary |
This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions. |
| Prerequisites |
System must use weak authentication mechanisms for administrative functions. |
| Solutions | Implementation: Upgrade phone lines. Note this may be prohibitively expensive Use strong access control such as two factor access control for administrative access to the switch |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-285 |
Improper Authorization |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-220 |
An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions. |
|