How I got a proxy server working with my PAP2

[inet777]

OK, I just want to give feedback on my findings and how I got a working prototype with my ATA. For obvious reasons, I will not keep this at "design level". To be very blunt, if anyone reading this is assuming that they will find a cookie cutter solution that they can implement on their end, then they will be disappointed. Bomb making manual this is not, but rather a design/architectural description of chemical periodic table. So here it goes...

So the main objective (on Dan's part) of this counter measure was to get MJ dongle back in the footprint of SIP protocol. Like every one, I used to use Stroth's Utils, fished out password and from there on, there was no need for dongle. Now Dan got the dongle back in the footprint by a two step process. During first call to SIP server (REGISTER, INVITE etc.), a failure is returned; along with a token. Then dongle generated a new nonce from that token. This time the call will be successful, because the server authenticates this nonce. Clear so far? The token for REGISTER is long lived; whereas the token for INVITE is per call. (There are other thread on this forum about how authentication fails first time around when dongle talks directly to Dan's server, and then subsequent attempts by dongle for REGISTER/INVITE are successful - Wireshark it and you will see).

To trick the Dan's server into thinking that the client is the dongle; when it is not, I introduced a proxy server in the middle. There are gazillion of them on the web, I used SIPProxyServlet that comes with Sailfin server (Glassfish). The Architecture then looks like this - on PC 1, I stuck MJ in USB port. On that PC I mapped Dan's server name to another PC (call it PC 2) in my network (just add an entry in /etc/hosts to map Dan's SIP server to my server). The SIPProxyServlet is installed on PC 2. Thus, I can intercept all calls from MJ dongle. My ATA registers to the proxy server on PC 2. The proxy server essentially drives MJ dongle on PC 1 to make a fake call (and essentially start the internal SIP protocol state machine inside the dongle). My proxy server then intercepts the call, makes another call to Dan's server, and responded to both MJ dongle as well as ATA. REGISTER was very easy to implement; it required harvesting token only once. INVITE required intercepting a fake call from MJ dongle, getting the correct nonce, making a call to Dan's server with correct destination params and then responding to ATA. Lot of details, but not complicated. If you know how to parse SIP messages in Java; then it is trivial. The wire protocol between Dan's server and my proxy server is exactly same as the wire protocol between Dan's server and dongle.

So, in a way; Dan succeeded in keeping MJ dongle in the SIP foot print, because I use MJ as a black box to generate correct nonce. But now ECMs do not matter, I can update MJ dongle and still handle other counter measures; at the same time make calls through my ATA. My ATA registers and makes calls as before; just registers with my proxy server and not Dan's. I was running HTTP server, SMTP server, 3CX server; I now run one more sevlet (SIPProxyServlet) on HTTP server. I am very satisfied with the outcome, my ATA is back in action and the solution I have is robust enough for my needs. There is a kludge in my design where the Proxy server on PC2 drives MJ dongle on PC 1, but I have a better design in mind to make it more scalable. I can make simultaneous calls from ATA through different lines, so I am very happy.


Clearly, this is not a solution that can be implemented by everyone, but I wanted to give feedback to the community about what can be done.

Finally, I do not read this forum regularly; so do not expect any more info. The above description is for advanced user and advanced users; given the design/architecture; will figure out the details.

Peace out.

[Matt9876]

Very good information,Thanks for all the hard work !!

[lostsoul]

Great work, thanks for the information you've provided. Glad ya got your ATA working again.

[az1324]

While you're messing around with proxys why don't you do an ssl mitm attack and dump the provisioning file? You will probably have to patch the mj cert in running memory with one you generate so that it will validate, but it should be easier than a lot of rce.

[Stryker]

Now this would be nice to have as a "cookie cutter" fix. As mentioned by the above author it is too advanced for the beginner such as myself. Would be really nice if someone with a clear understanding of this to put complete detailed fix for us to use. Thanks.

Stryker

[agriffiths]

inet, really thanks for the hard work and sharing it with us. As the others stated, this is prob above most of our heads. But, hopefully this will get the ball rolling for someone who feels like creating the novice users solution to the complex problem. Kind of like how Stroth's Utility brought a lot of us into the game when we were previously scratching our heads.
Really appreciate it.