Login | Register

Community

Community -> The Security Audit


The Security Audit is completed! A lot of fuzzing, testing and of course fixing. Everything just to make OpenSIPS more secure.


Following the OpenSIPS 3.2 major release (LTS), based on the community feedback, the decision of performing a professional security audit was taken. This security audit is based on the concept of White box Penetration Testing and it will be managed at the project level, with the help of community, for the benefits of the community. The Audit is an Open project - the results will be public and the all the derived fixes and enhancements will be of the benefit of the entire community- they will go into the public project/code.
Nevertheless, the success of this endeavor highly depends on the support and sponsoring of the community.


Why a security audit

OpenSIPS is one of the most used Open Source SIP Servers, used in thousands of deployments, for various purposes / scenarios. But one factor stands in all these cases - the security of your OpenSIPS, how reliable it is, how vulnerable it is or how robust it is to external attacks or to bogus traffic. These security concerns are very important, in all the OpenSIPS deployment cases, as they exceed the boundary of the operator itself, impacting the end user or the external parties connecting into the operator's OpenSIPS - we all know this when comes to service SLAs.

So far there was an attempt to individually address this security concerns (by private testing), but the effort is high and not shared, so the overall efficiency is rather small. The proper answer is an collective public effort, with public benefits for all.


The goals of this audit

The work aims to uncover critical vulnerabilities within some of the most exposed code in OpenSIPS. Enable Security will be using proven techniques, including instrumented fuzzing, black box fuzzing, manual code review and security testing with their toolset, SIPVicious PRO in a concentrated effort to discover security issues within the project.

The actual work includes development of automated tests, and fuzzing harness code as well as manual testing to identify vulnerabilities such as memory corruption issues, logic issues especially those that may lead to authentication bypass and denial of service vulnerabilities. The identification of such vulnerabilities will allow OpenSIPS to address these bugs which in turn will help the project become an even more robust and secure solution.

Enable Security is known for having dedicated RTC security expertise through its various bug reports, research publications, presentations and other resources that are compiled as part of their contributions to the community and the RTC world. In this case, Enable Security would be focusing on a security audit on OpenSIPS as they do within their commercial security services, thus making a dedicated effort to identify more than just _low hanging fruit_ security issues.

Apart from a technical report with full details of their exploits and methodology, their aim is to provide the community with contributions to the OpenSIPS project so that it can be integrated within the OSS-Fuzz project and other automated quality assurance processes. This will ensure that OpenSIPS can be easily tested for security vulnerabilities that may be introduced in future updates.


How it will be done

The developing team of OpenSIPS worked out together with the Enable Security's team what are the parts of OpenSIPS to be subject to Pen Tests. This decision was taken based on the (1) potential vulnerability of certain parts of the code and (2) the testing / fuzzing possibilities.

We already worked out an commercial agreement with Enable Security for running the Security Audit. And we do appreciate all the help and support from they side, considering the fact that we are a non-commercial Open Source Project.

Based on this agreement, we, as OpenSIPS Project, will have to raise the amount for 24,000 USD. This has to be an collective effort of all the people, companies or other entities which are using OpenSIPS and value the safety and reliability of their OpenSIPS deployments.

Once the amount is fully raise, Enable Security will proceed with performing all the White Box Pen Tests under the commercial agreement. The results of this testing will go public, to the benefits of the entire community.

We, as developers and maintainers of OpenSIPS Project will take on the job of working out the fixes for the potential issues revealed by the testing.


The current status

Collected amount at 13th of Sept 2021 : $27,220
Remaining to collect : -3220$ :)
Our Sponsors:

DateNameAmountChannel
24.06.2021Flavio Goncalves1000 USDPayPal
24.06.2021OpenSIPS Solutions2000 USDPayPal
24.06.2021OFFICErING SUPPORT500 USDGoFundMe
24.06.2021Giovanni Maruzzelli120 USDPayPal
24.06.2021Lounis Goudjil / Manifone1000 USDGoFundMe
24.06.2021Anonymous100 USDGoFundMe
24.06.2021Jose Alexandre Ferreira100 USDPayPal
24.06.2021Dave Horton100 USDGoFundMe
24.06.2021Mickael Hubert120 USDPayPal
24.06.2021Connex Carrier Services (Worldwide) Limited1000 USDPayPal
25.06.2021Mayama Takeshi100 USDGoFundMe
25.06.2021Dioris Moreno / Libereco Systems100 USDPayPal
27.06.2021Sharad Kumar200 USDGoFundMe
30.06.2021Mike Tesliuk100 USDGoFundMe
01.07.2021Peter Kelly1000 USDGoFundMe
01.07.2021Bernard Buitenhuis / MaxiTel2000 USDWire Transfer
04.07.2021Andrew Yager2000 USDGoFundMe
05.07.2021X-on Surgery Connect150 USDGoFundMe
16.07.2021Ivan Poddubnyi100 USDGoFundMe
17.07.2021Ameed Jamous / TelecomsXChange100 USDPayPal
22.07.2021Axeos Services BV1200 USDWire Transfer
22.07.2021Maksym Sobolyev200 USDPayPal
26.07.2021OpenSIPS Friends4500 USDWire Transfer
26.08.2021Vasilios Tzanoudakis / Voiceland SA1000 USDWire Transfer
07.09.2021Alexey Vasilyev100 USDPayPal
07.09.2021Jarrod Baumann500 USDPayPal
08.09.2021Maxim Sobolev / Sippy Software1000 USDPayPal
08.09.2021Sumit Birla100 USDGoFundMe
08.09.2021David Duffett150 USDGoFundMe
08.09.2021Voicenter / Shlomi Gutman1000 USDPayPal
08.09.2021OpenSIPS Solutions1000 USDPayPal
08.09.2021Adam Jeffery20 USDGoFundMe
08.09.2021Jonathan Abrams250 USDGoFundMe
09.09.2021Simon Devine500 USDGoFundMe
09.09.2021Umar Sear100 USDGoFundMe
09.09.2021QXIP BV1000 USDGoFundMe
09.09.2021Airbytes Communications Limited150 USDPayPal
10.09.2021Real World Group1360 USDGoFundMe
13.09.2021Antonis Psaras / Microbase P.C.1200 USDWire Transfer

Get involved by sponsoring

As said, this is a community effort, for the community's benefit.

So, please be part of this effort and sponsor this Security Audit work. There are multiple ways of doing that:

  • check our public fund raising via the GoFundMe platform. Here the target will be dynamically updated according to the overall collected amount, via all the channels
  • use our official paypal account to donate, paypal@opensips.org . Let us know if you need any info or support, we can generate custom PayPal request on demand
  • let us know if you are considering a wire transfer (bank account), we can assist that, with proper invoicing

All our sponsors, tiny or generous, will be publicly listed here, as a sign of gratitude for their contribution.

For any other information, please do not hesitate to contact us !


Copyright 2021, The OpenSIPS Project


Page last modified on April 28, 2022, at 06:00 PM