I am interested in demonstrating an attack to my university's security team on IP phones installed at the university. The IP phone models are Siemens optipath410.

Basically, using nmap, I identified a few IP phones on the network. The IP phone have the following ports open: https (443), telnet (21) and ssh (22). When I visit https://IP address, I get the webpage which asks for administrator password. The default password works here.

Now I have full control over all the settings. Is it possible that I can listen to and record conversations? Is it possible to sniff packets on Wireshark and then convert to an audio stream?

Or is possible to perform a man in the middle attack while routing the traffic on my IP and then forwarding it?

This is the main admin page. enter image description here


Yes it is very easy if you know the current sip or voip platform use (and you must know because you can access the admin page of the phone) and you know how to create a sip or voip relay with asterisk or anyother VOIP gateway.

You could then reconfigure phone so they use your voip gateway and send the packet to the IPBX of your university.

This would be like a man in the middle, the problem you can have here is finding which is the user connection credential to the university VOIP gateway, if there's one.

  • i have uploaded the admin page screen shot. can you be a bit more directive according to the settings? Where should I read on voip?
    – M T
    Mar 24 '14 at 11:28
  • I can explain you a concept, I will certainly not explain you in details how to listen to conversation when it's that easy to do.
    – Kiwy
    Mar 24 '14 at 11:29
  • OK. i am ok with the concept explaination
    – M T
    Mar 24 '14 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.