September 23, 2017

Investigation of an Unofficial Ring API — Part 2

From the server it uses SIP, it sends back a Message header that seems just to be confirming the original SIP information, almost like the server is using a “reply’ button on an email. However the SIP Message Body is were all the info is for obtaining access to the feeds.

Sample of info returned:

connects to same server that it initiated SIP with. For this Sample SIP in Wireshark it only seemed to connect on ports 39474 and 22468 using SRTP to stream the data, however during this session I never tried using the 2 way talk. However the client(my computer) did try and access the other ports below(39475 and 22469 which connected via using SRTCP.

	•	Media Description, name and address (m): audio 39474 RTP/SAVP 0 101
    Media Type: audio
    Media Port: 39474
    Media Protocol: RTP/SAVP
    Media Format: 0
    Media Format: 101

	•	Media Attribute (a): rtpmap:0 PCMU/8000
    Media Attribute Fieldname: rtpmap
    Media Format: 0
    MIME Type: PCMU
    Sample Rate: 8000

	•	Media Attribute (a): rtpmap:101 telephone-event/8000
    Media Attribute Fieldname: rtpmap
    Media Format: 101
    MIME Type: telephone-event
    Sample Rate: 8000

	•	Media Attribute (a): fmtp:101 0-16
    Media Attribute Fieldname: fmtp
    Media Format: 101 [telephone-event]
    Media format specific parameters: 0-16

	•	Media Attribute (a): ptime:20
    Media Attribute Fieldname: ptime
    Media Attribute Value: 20

	•	Media Attribute (a): rtcp:39475 IN IP4 13.56.25.194
    Media Attribute Fieldname: rtcp
    Media Attribute Value: 39475 IN IP4 13.56.25.194

	•	Media Attribute (a): crypto:1 AES_CM_128_HMAC_SHA1_80 inline:XFWU/PQphVZqYu+jqJ2xgBIz2FT4g4RAF6ldu
    Media Attribute Fieldname: crypto
    tag: 1
    Crypto suite: AES_CM_128_HMAC_SHA1_80
    Key parameters
        Key and Salt: 584657552f50517068565a7159752b6a714a32786742
        Master Key: 5c5594fcf42985566a62efa3a89d
        Master salt: 1233d854f883844017a95d

	•	Media Description, name and address (m): video 22468 RTP/SAVP 96
    Media Type: video
    Media Port: 22468
    Media Protocol: RTP/SAVP
    Media Format: 96


	•	Media Attribute (a): rtpmap:96 H264/90000
    Media Attribute Fieldname: rtpmap
    Media Format: 96
    MIME Type: H264
    Sample Rate: 90000

	•	Media Attribute (a): fmtp:96 profile-level-id=42801F
    Media Attribute Fieldname: fmtp
    Media Format: 96 [H264]
    Media format specific parameters: profile-level-id=42801F
        Profile: 42801f
            0100 0010 = Profile_idc: Baseline profile (66)
            1... .... = Constraint_set0_flag: 1
            .0.. .... = Constraint_set1_flag: 0
            ..0. .... = Constraint_set2_flag: 0
            ...0 .... = Constraint_set3_flag: 0
            .... 0... = Constraint_set4_flag: 0
            .... .0.. = Constraint_set5_flag: 0
            .... ..00 = Reserved_zero_2bits: 0
            0001 1111 = Level_id: 31 [Level 3.1 14 Mb/s]

	•	Media Attribute (a): rtcp:22469 IN IP4 13.56.25.194
    Media Attribute Fieldname: rtcp
    Media Attribute Value: 22469 IN IP4 13.56.25.194

	•	Media Attribute (a): rtcp-fb:* fir
    Media Attribute Fieldname: rtcp-fb
    Media Attribute Value: * fir

	•	Media Attribute (a): crypto:1 AES_CM_128_HMAC_SHA1_80 inline:GWzO4FTMv6JwdUx0fH3rFXNJnmeyRhUpLTH
    Media Attribute Fieldname: crypto
    tag: 1
    Crypto suite: AES_CM_128_HMAC_SHA1_80
    Key parameters
        Key and Salt: 47577a4f3446544d76364a776455783066483372465
        Master Key: 196ccee054ccbfa270754c747c
        Master salt: 73499e67b24615292d31c2a