Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 


726 posts

Ultimate Geek
+1 received by user: 11


  Reply # 1079330 3-Jul-2014 13:28
Send private message

For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6

'That VDSL Cat'
8421 posts

Uber Geek
+1 received by user: 1814

Trusted
Spark
Subscriber

  Reply # 1079331 3-Jul-2014 13:29
Send private message

gchiu: For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6


probably your router if you dont have it open on your asterisk box. 




#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.


26925 posts

Uber Geek
+1 received by user: 6359

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  Reply # 1079372 3-Jul-2014 13:58
Send private message

gchiu: Here's the first message from tcpdump:

10:38:59.926315 IP (tos 0x0, ttl 111, id 29952, offset 0, flags [none], proto UDP (17), length 795)
62.210.187.134.5070 > 192.168.1.180.5060: [udp sum ok] SIP, length: 767
INVITE sip:90060972595561294@58.28.152.22 SIP/2.0
To: 90060972595561294<sip:90060972595561294@58.28.152.22>
From: 10001<sip:10001@58.28.152.22>;tag=57da019d
Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport
Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE
Contact: <sip:10001@62.210.187.134:5070>
Max-Forwards: 70
Allow: INVITE, ACK, CANCEL, BYE
User-Agent: sipcli/v1.8
Content-Type: application/sdp
Content-Length: 284

v=0
o=sipcli-Session 1617787993 291094220 IN IP4 62.210.187.134
s=sipcli
c=IN IP4 62.210.187.134
t=0 0
m=audio 5072 RTP/AVP 18 0 8 101
a=fmtp:101 0-15
a=rtpmap:18 G729/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=ptime:20
a=sendrecv




Classic capture of a bot trying to exploit your system.




726 posts

Ultimate Geek
+1 received by user: 11


  Reply # 1079396 3-Jul-2014 14:13
Send private message

The User-Agent: sipcli/v1.8 does suggest this! lol

It's pretending to be a remote extension 10001 on my system, but after that I have no idea of what it is trying to achieve.


26925 posts

Uber Geek
+1 received by user: 6359

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  Reply # 1079446 3-Jul-2014 15:05
Send private message

By the look of that single capture it's possible it's trying to route a call to Malaysia by dialing 90060 + number (just a guess since Mayalsia is +60 as it's IDD code)

Predigits are still the norm in many places so it's trying 9 as the predigit.





726 posts

Ultimate Geek
+1 received by user: 11


  Reply # 1079528 3-Jul-2014 17:11
Send private message

So dissecting this a bit more

INVITE sip:90060972595561294@58.28.152.22 SIP/2.0

This guy wants to talk to 90060972595561294@58.28.152.22 which is an extension on my network

To: 90060972595561294<sip:90060972595561294@58.28.152.22>

And the To: header says the same

From: 10001<sip:10001@58.28.152.22>;tag=57da019d

Purporting to be from extension 10001 on my network

Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport

but calling from  62.210.187.134:5070

Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE

...

Contact: <sip:10001@62.210.187.134:5070>

and wants me to contact him here if I need to!

So, he is asking my Asterisk server to call the extension 90060972595561294 which is actually an international dial string. And the 9 is hoping it will allow the call to access an outside line.

Interesting.

Pretty sure I setup rules to block overseas calls, but I'll have to review what I did when I setup the server 2 years ago :(

PS: I read the sipscanner on this joker, and it looks like it's a 2008 server running there

sip thief





726 posts

Ultimate Geek
+1 received by user: 11


  Reply # 1079735 4-Jul-2014 08:03
Send private message

Success.  Although I still had 10Mb of traffic overnight, Asterisk now reports no inbound calls. Which means I won't be playing that gsm file anymore.

It has changed again so now only 2Mb of uploads, and 8mb of downloads.  I guess 6mb of that iare attacks on my server, and 4mb is return traffic to the VOIP providers who keep connecting/registering/options etc.

Does that sound right?

1 | 2 | 3 | 4 
View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.