We went over Kahevo the way an attacker would. What we found, what we closed, and what it means for your calls.
A phone system on the internet is knocked on all day by people who should not be there. This week we went over Kahevo the way one of them would, and closed what we found. None of it was found by an attacker first. Here is the plain account.
What we closed
- Audio is taken only from where the caller really is. Before, on a call that was not encrypted, someone who sent sound at the right port could have been heard, and sent the other side of the call.
- A transfer is obeyed only from the extension that is on the call. An outside caller cannot ring in and have the call sent out again at your expense.
- A sign-in answer is good only from the address it was asked of, and only for the thing it was asked for.
- The page the two services use to talk to each other refuses to start open to the network without a key.
Staying up in a flood
Anyone can write any address on a request. So an address is a stranger until it has proven itself, by signing in or by being your provider.
| Who | How Kahevo treats them |
|---|---|
| A phone or provider it knows | Answered, always |
| A stranger | Answered and forgotten at once |
| An address that keeps failing | No reply at all |
Strangers make way for one another, never for the phones on your desks.
Inside the house
We also tried to climb from a plain user to more. Two steps were found and closed: a mailbox PIN is now shown only to those who manage extensions, and a locked account's open pages and softphone are closed within a minute.
On a server shared by several businesses, we went looking for anything one could see of another, and closed each one.
The honest part
These were tested with simulated phones and attackers, not yet under a real flood. Encrypting your phones is still the best protection there is, and Kahevo can do that today.