Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 


666 posts

Ultimate Geek
+1 received by user: 10


  Reply # 1079330 3-Jul-2014 13:28
Send private message

For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6

'That VDSL Cat'
7965 posts

Uber Geek
+1 received by user: 1632

Trusted
Spark
Subscriber

  Reply # 1079331 3-Jul-2014 13:29
Send private message

gchiu: For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6


probably your router if you dont have it open on your asterisk box. 




#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.


26499 posts

Uber Geek
+1 received by user: 6041

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  Reply # 1079372 3-Jul-2014 13:58
Send private message

gchiu: Here's the first message from tcpdump:

10:38:59.926315 IP (tos 0x0, ttl 111, id 29952, offset 0, flags [none], proto UDP (17), length 795)
62.210.187.134.5070 > 192.168.1.180.5060: [udp sum ok] SIP, length: 767
INVITE sip:90060972595561294@58.28.152.22 SIP/2.0
To: 90060972595561294<sip:90060972595561294@58.28.152.22>
From: 10001<sip:10001@58.28.152.22>;tag=57da019d
Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport
Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE
Contact: <sip:10001@62.210.187.134:5070>
Max-Forwards: 70
Allow: INVITE, ACK, CANCEL, BYE
User-Agent: sipcli/v1.8
Content-Type: application/sdp
Content-Length: 284

v=0
o=sipcli-Session 1617787993 291094220 IN IP4 62.210.187.134
s=sipcli
c=IN IP4 62.210.187.134
t=0 0
m=audio 5072 RTP/AVP 18 0 8 101
a=fmtp:101 0-15
a=rtpmap:18 G729/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=ptime:20
a=sendrecv




Classic capture of a bot trying to exploit your system.




666 posts

Ultimate Geek
+1 received by user: 10


  Reply # 1079396 3-Jul-2014 14:13
Send private message

The User-Agent: sipcli/v1.8 does suggest this! lol

It's pretending to be a remote extension 10001 on my system, but after that I have no idea of what it is trying to achieve.


26499 posts

Uber Geek
+1 received by user: 6041

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  Reply # 1079446 3-Jul-2014 15:05
Send private message

By the look of that single capture it's possible it's trying to route a call to Malaysia by dialing 90060 + number (just a guess since Mayalsia is +60 as it's IDD code)

Predigits are still the norm in many places so it's trying 9 as the predigit.





666 posts

Ultimate Geek
+1 received by user: 10


  Reply # 1079528 3-Jul-2014 17:11
Send private message

So dissecting this a bit more

INVITE sip:90060972595561294@58.28.152.22 SIP/2.0

This guy wants to talk to 90060972595561294@58.28.152.22 which is an extension on my network

To: 90060972595561294<sip:90060972595561294@58.28.152.22>

And the To: header says the same

From: 10001<sip:10001@58.28.152.22>;tag=57da019d

Purporting to be from extension 10001 on my network

Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport

but calling from  62.210.187.134:5070

Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE

...

Contact: <sip:10001@62.210.187.134:5070>

and wants me to contact him here if I need to!

So, he is asking my Asterisk server to call the extension 90060972595561294 which is actually an international dial string. And the 9 is hoping it will allow the call to access an outside line.

Interesting.

Pretty sure I setup rules to block overseas calls, but I'll have to review what I did when I setup the server 2 years ago :(

PS: I read the sipscanner on this joker, and it looks like it's a 2008 server running there

sip thief





666 posts

Ultimate Geek
+1 received by user: 10


  Reply # 1079735 4-Jul-2014 08:03
Send private message

Success.  Although I still had 10Mb of traffic overnight, Asterisk now reports no inbound calls. Which means I won't be playing that gsm file anymore.

It has changed again so now only 2Mb of uploads, and 8mb of downloads.  I guess 6mb of that iare attacks on my server, and 4mb is return traffic to the VOIP providers who keep connecting/registering/options etc.

Does that sound right?

1 | 2 | 3 | 4 
View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Cove sells NZ's first insurance policy via chatbot
Posted 25-Jun-2018 10:04


N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34


Enable doubles fibre broadband speeds for its most popular wholesale service in Christchurch
Posted 2-Jun-2018 20:07


All or Nothing: New Zealand All Blacks arrives on Amazon Prime Video
Posted 2-Jun-2018 16:21


Innovation Grant, High Tech Awards and new USA office for Kiwi tech company SwipedOn
Posted 1-Jun-2018 20:54


Commerce Commission warns Apple for misleading consumers about their rights
Posted 30-May-2018 13:15


IBM leads Call for Code to use cloud, data, AI, blockchain for natural disaster relief
Posted 25-May-2018 14:12


New FUJIFILM X-T100 aims to do better job than smartphones
Posted 24-May-2018 20:17



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.