Avaya's IP Phone Security Research - Part A

This report documents a detailed technical analysis of Avaya 9608G VoIP phones: extracting unencrypted firmware, reverse-engineering EEPROM structures, desoldering and reading NAND flash (including OOB and Broadcom BCH ECC handling), mounting JFFS2 partitions via nandsim, and finally patching SSH/PAM configuration in the root filesystem to gain root SSH access (root:root). The write-up is a proof-of-concept showing how a skilled adversary with physical access and flash-programming capability can obtain persistent root access to the device.