RPS Configuration Security

[vbreyter]

The documentation around RPS setup indicate that after provisioning the phone on 3cx, when the phone boots and receives a response from the manufacturer's RPS server, the phone will need to authenticate with the extension number and the voicemail PIN. However, I just tried deleting a phone from 3CX, doing a factory reset, reprovisioning it in 3CX, and then another factory reset. The phone provisioned itself without any need to enter an extension number of the voicemail pin. Furthermore, when I enter the provisioning URL directly into a browser, i am able to download the config file, once again without any authentication. This config file contains the phone web UI admin password, as well as the authentication info for the phone to connect to the pbx. I did this test with a Grandstream 2170 that I have lying around.

If someone knows the MAC address of the phone (by let's say reading of the box before shipping me the phone), what prevents them from querying the manufacturer RPS server, getting the provisioning URL, and then using the authentication info in that file to setup a phone to connect to my 3cx PBX (My 3CX server is located remotely and I cannot use firewalls to block incoming traffic because we have several locations with dynamic IPs.)

 

[ivank]

If someone knows the MAC address of the phone (by let's say reading of the box before shipping me the phone), what prevents them from querying the manufacturer RPS server, getting the provisioning URL, and then using the authentication info in that file to setup a phone to connect to my 3cx PBX

RPS server won't give away this information to unauthorized entities. Also, PBX removes the RPS entry as soon as the phone registers for the first time or after two weeks.

As to the final provisioning link of the phone, it should be kept secret for obvious reasons. It is impossible to brute force it, but when leaked you're screwed.