Hi Skeeve,<div><br></div><div>I'm getting a ton of these on my asterisk server at home Most commonly they are trying extension numbers 1-9999 although occasionally they are using dictionary based or more rarely random [a-z] character scans. Typically a single IP will conduct the entire number range scan which should make it easier to set up filtering based on triggers. Having a good password policy on the accounts would also help.</div>
<div><br></div><div>So far this month I have logged 760493 failed SIP logins from 63 IPs.</div><div><div><br></div><div>Cheers,</div><div><br>Rob</div><div><br></div><br><div class="gmail_quote">On Tue, Sep 28, 2010 at 12:13 AM, Skeeve Stevens <span dir="ltr"><<a href="mailto:Skeeve@eintellego.net">Skeeve@eintellego.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div lang="EN-AU" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="color:#002060">Hey all,</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">I’ve got a few customers
who have noticed a large recent jump in SIP scans against their networks.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">Null routing helps the response
but doesn’t stop the registration initiation – loading up servers
with registrations.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">This is easy to stop on closed
VoIP systems, but not on hosted Voice platforms which users come from other ISP’s/networks,
this seems to be very difficult.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">Does anyone have any ideas –
we are fresh out at the moment, apart from beefing up security on the VoIP
servers themselves using fail2ban or other things that detect rapid
registrations and then firewalls them.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">Having a normal server hacked is
one thing but VoIP hacking has taken on a new intensity as the hackers can make
a LARGE amount of money by comprising a VoIP system.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">Recently, we’ve been
brought in to clean up the mess in several incidents where a couple of VoIP
systems have been compromised in incidents totalling over AU$100,000.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">And the carriers are rarely
sympathetic.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">If it isn’t obvious as to
how/why they’re doing this – the hackers get in, open a SIP account
so their VoIP system can register, and then they channel certain calls via the
comprised system. This has the effect of them charging the end user and
making money, while not paying for the calls to be delivered to the
destination.</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#002060">Advice:</span></p>
<p><span style="color:#002060"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="color:#002060">Block destinations
to obscure places that your customers are unlikely to call, and only unblock them
if they request</span></p>
<p><span style="color:#002060"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="color:#002060">Watch billing to
certain locations and if there is a massive jump, do something</span></p>
<p><span style="color:#002060"><span>-<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="color:#002060">Watch your customers
and if their billing jumps by a massive amount, alert them as fast as you can –
or you just might be liable</span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#002060"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">...Skeeve</span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:#002060"> </span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">--</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">Skeeve Stevens,
CEO</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">eintellego Pty
Ltd - The Networking Specialists</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060"><a href="mailto:skeeve@eintellego.net" target="_blank">skeeve@eintellego.net</a>
/ <a href="http://www.eintellego.net" target="_blank">www.eintellego.net</a></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">Phone: 1300 753
383, Fax: (+612) 8572 9954</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">Cell +61 (0)414
753 383 / skype://skeeve</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060"><a href="http://www.linkedin.com/in/skeeve" target="_blank">www.linkedin.com/in/skeeve</a>
; <a href="http://facebook.com/eintellego" target="_blank">facebook.com/eintellego</a></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">--</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">eintellego -
The Experts that the Experts call</span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#002060">- Juniper - HP
Networking - Cisco - Arista -</span></p>
<p class="MsoNormal"><span style="color:#002060"> </span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;color:#002060">Disclaimer:
Limits of Liability and Disclaimer: This message is for the named person's use
only. It may contain sensitive and private proprietary or legally privileged
information. You must not, directly or indirectly, use, disclose, distribute,
print, or copy any part of this message if you are not the intended recipient.
eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of
companies reserve the right to monitor all e-mail communications through its networks.
Any views expressed in this message are those of the individual sender, except
where the message states otherwise and the sender is authorised to state them
to be the views of any such entity. Any reference to costs, fee quotations,
contractual transactions and variations to contract terms is subject to
separate confirmation in writing signed by an authorised representative of
eintellego. Whilst all efforts are made to safeguard inbound and outbound
e-mails, we cannot guarantee that attachments are virus-free or compatible with
your systems and do not accept any liability in respect of viruses or computer
problems experienced.</span></p>
<p class="MsoNormal"> </p>
</div>
</div>
<br>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br></blockquote></div><br></div>