#HITB2012AMS D2T2 - Rahul Sasi - CXML VXML IVR Pentesting for Auditors

## Overview

Rahul Sasi, a security researcher at iGAT Partners, presents a comprehensive guide on attacking and auditing Interactive Voice Response (IVR) systems using CXML and VXML languages. The talk covers practical exploitation techniques against phone banking and customer service applications, demonstrating that IVR systems widely trusted by financial institutions lack adequate security controls.

## What Are IVR Systems

IVR systems are automated telephone applications that respond to user input via Dual-Tone Multi-Frequency (DTMF) keypresses or voice commands. Common implementations include phone banking, customer support lines, and medical inquiry systems. The architecture consists of: a telephone network, TCP/IP network connecting the vxml server (which hosts the CXML/VXML application), and web application servers that perform actual authentication and data processing.

## Key Vulnerabilities Demonstrated

### Brute Force Attacks Sasi showed a real-world phone banking vulnerability where a 4-digit PIN combined with account numbers created exploitable conditions. The bank's system only blocked accounts after 3 failed attempts and reset them at midnight daily. Using an automated Python program with AT commands, an attacker could attempt multiple PIN combinations against many account numbers within each reset window, dramatically increasing success chances.

### SQL Injection via DTMF Despite DTMF limitations (only 0-9, *, #), SQL injection is possible using mathematical operations. The speaker demonstrated "true injection" (e.g., PIN*1*1 = PIN, evaluated as true) and "false injection" (e.g., PIN*1*0 = 0, evaluated as false). These payloads work because they're mathematically valid on MySQL and can be entered via phone keypads. Live demonstrations showed authentication bypass using payloads like "31337*1*1" (successful login) versus "31337*1*0" (no match found).

### Buffer Overflow and Error Disclosure IVR applications often reveal internal errors as voice messages, enabling fingerprinting and exploitation. Sending long DTMF sequences to vulnerable CGI applications caused stack overflows, resulting in HTTP 500 errors that the system read aloud: "error starting voice XML application failed fetch with code 500 server error... internal error." This disclosed URLs, session IDs, and backend information.

### Alpha-Numeric Input and Voice Payloads Applications accepting alpha-numeric voice input (common in banks using non-numeric user IDs) introduce additional attack surface. Using grammar files that map voice words to characters, attackers can construct URL-encoded payloads by spelling characters—for example, saying "percentage 27" translates to a single quote (%), enabling more sophisticated SQL injection via voice.

## Technical Demonstrations

The speaker provided live examples: - Automated phone banking login bypass successfully extracting balance information - DTMF processing demo showing the system recognizing "5" and speech recognition recognizing "red" - SQL injection testing showing different responses for valid vs. invalid payloads - Buffer overflow triggering internal server errors - Alpha-numeric input processing demonstrating payload construction via voice

## Audit Approach for IVR Systems

Unlike web application testing (which reveals HTML error pages), IVR auditing relies on triggering internal errors that the system reads aloud as voice output. By identifying application logic flows and sending malicious payloads, auditors can extract system information and exploit vulnerabilities through audio responses.

## Real-World Impact

Sasi confirmed finding vulnerabilities in an actual Indian bank's IVR system, highlighting the critical risk that attackers could crash phone banking applications remotely using only a phone, disrupting customer access and operations.

## Future Research

Ongoing work focuses on DTMF detection algorithms (particularly the Goertzel algorithm) embedded in PBX systems and vxml servers, with the goal of fuzzing different frequencies to remotely crash multiple phone banking applications.