Legacy software has a way of "hanging around." Just about a week ago I was reminded of a website I created for a friend in or around 1998, which has not changed since then (embarrassing links omitted). It went down after an upgrade to PHP 8.1 ;-). 

So it isn't surprising that ever so often, attackers are probing for some old flaws again. The following URL made our "First Seen" list this week:

/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fasterisk%2fsip.conf%00

A quick search shows that VTiger 5.1.0 was affected by a directory traversal vulnerability that could lead to arbitrary file inclusion (CVE-2012-4876). The exploit looks for an Asterisk configuration file, likely to exfiltrate credentials.

We have seen more and more attempts to go after VoIP configurations, brute forcing VoIP credentials or gaining access to respective APIs. There is a lot of pressure right now to clamp down on spam calls and SMS messages. Telcos are more likely to filter spam, and third-party software is becoming more popular. It is a bit like email spam, where attackers are for many years now been interested in compromising accounts with large email providers just to use them to send spam. Attackers are looking for "clean" phone numbers to send their messages from. After all, how else will you get that extended warranty for your car? I recently wrote about some SIP brute forcing that appeared to be more linked to toll fraud, but using these systems for spam is another way to monetize compromised VoIP systems.

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|