Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 


1089 posts

Uber Geek

Trusted
DR

  #1079330 3-Jul-2014 13:28
Send private message

For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6

'That VDSL Cat'
11906 posts

Uber Geek

Trusted
Spark
Subscriber

  #1079331 3-Jul-2014 13:29
Send private message

gchiu: For what it's worth, I ran sipscanner on my address, and it says nothing found.  Not sure why port 80 is open ... need to close it.

http://sipscanner.voicefraud.com/report/9L1CcegDGcA6


probably your router if you dont have it open on your asterisk box. 




#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.

 


 
 
 
 


28812 posts

Uber Geek

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  #1079372 3-Jul-2014 13:58
Send private message

gchiu: Here's the first message from tcpdump:

10:38:59.926315 IP (tos 0x0, ttl 111, id 29952, offset 0, flags [none], proto UDP (17), length 795)
62.210.187.134.5070 > 192.168.1.180.5060: [udp sum ok] SIP, length: 767
INVITE sip:90060972595561294@58.28.152.22 SIP/2.0
To: 90060972595561294<sip:90060972595561294@58.28.152.22>
From: 10001<sip:10001@58.28.152.22>;tag=57da019d
Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport
Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE
Contact: <sip:10001@62.210.187.134:5070>
Max-Forwards: 70
Allow: INVITE, ACK, CANCEL, BYE
User-Agent: sipcli/v1.8
Content-Type: application/sdp
Content-Length: 284

v=0
o=sipcli-Session 1617787993 291094220 IN IP4 62.210.187.134
s=sipcli
c=IN IP4 62.210.187.134
t=0 0
m=audio 5072 RTP/AVP 18 0 8 101
a=fmtp:101 0-15
a=rtpmap:18 G729/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=ptime:20
a=sendrecv




Classic capture of a bot trying to exploit your system.




1089 posts

Uber Geek

Trusted
DR

  #1079396 3-Jul-2014 14:13
Send private message

The User-Agent: sipcli/v1.8 does suggest this! lol

It's pretending to be a remote extension 10001 on my system, but after that I have no idea of what it is trying to achieve.


28812 posts

Uber Geek

Moderator
Trusted
Biddle Corp
Lifetime subscriber

  #1079446 3-Jul-2014 15:05
Send private message

By the look of that single capture it's possible it's trying to route a call to Malaysia by dialing 90060 + number (just a guess since Mayalsia is +60 as it's IDD code)

Predigits are still the norm in many places so it's trying 9 as the predigit.





1089 posts

Uber Geek

Trusted
DR

  #1079528 3-Jul-2014 17:11
Send private message

So dissecting this a bit more

INVITE sip:90060972595561294@58.28.152.22 SIP/2.0

This guy wants to talk to 90060972595561294@58.28.152.22 which is an extension on my network

To: 90060972595561294<sip:90060972595561294@58.28.152.22>

And the To: header says the same

From: 10001<sip:10001@58.28.152.22>;tag=57da019d

Purporting to be from extension 10001 on my network

Via: SIP/2.0/UDP 62.210.187.134:5070;branch=z9hG4bK-69ca466cab181a1529d61d41f5ac747f;rport

but calling from  62.210.187.134:5070

Call-ID: 69ca466cab181a1529d61d41f5ac747f
CSeq: 1 INVITE

...

Contact: <sip:10001@62.210.187.134:5070>

and wants me to contact him here if I need to!

So, he is asking my Asterisk server to call the extension 90060972595561294 which is actually an international dial string. And the 9 is hoping it will allow the call to access an outside line.

Interesting.

Pretty sure I setup rules to block overseas calls, but I'll have to review what I did when I setup the server 2 years ago :(

PS: I read the sipscanner on this joker, and it looks like it's a 2008 server running there

sip thief





1089 posts

Uber Geek

Trusted
DR

  #1079735 4-Jul-2014 08:03
Send private message

Success.  Although I still had 10Mb of traffic overnight, Asterisk now reports no inbound calls. Which means I won't be playing that gsm file anymore.

It has changed again so now only 2Mb of uploads, and 8mb of downloads.  I guess 6mb of that iare attacks on my server, and 4mb is return traffic to the VOIP providers who keep connecting/registering/options etc.

Does that sound right?

1 | 2 | 3 | 4 
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Intel introduces 10th Gen Intel Core H-series for mobile devices
Posted 2-Apr-2020 21:09


COVID-19: new charitable initiative to fund remote monitoring for at-risk patients
Posted 2-Apr-2020 11:07


Huawei introduces the P40 Series of Android-based smartphones
Posted 31-Mar-2020 17:03


Samsung Galaxy Z Flip now available for pre-order in New Zealand
Posted 31-Mar-2020 16:39


New online learning platform for kids stuck at home during COVID-19 lockdown
Posted 26-Mar-2020 21:35


New 5G Nokia smartphone unveiled as portfolio expands
Posted 26-Mar-2020 17:11


D-Link ANZ launches wireless AC1200 4G LTE router
Posted 26-Mar-2020 16:32


Ring introduces two new video doorbells and new pre-roll technology
Posted 17-Mar-2020 16:59


OPPO uncovers flagship Find X2 Pro smartphone
Posted 17-Mar-2020 16:54


D-Link COVR-2202 mesh Wi-Fi system now protected by McAfee
Posted 17-Mar-2020 16:00


Spark Sport opens its platform up to all New Zealanders at no charge
Posted 17-Mar-2020 10:04


Spark launches 5G Starter Fund
Posted 8-Mar-2020 19:19


TRENDnet launches high-performance WiFi Mesh Router System
Posted 5-Mar-2020 08:48


Sony boosts full-frame lens line-up with introduction of FE 20mm F1.8 G large-aperture ultra-wide-angle prime Lens
Posted 5-Mar-2020 08:44


Vector and Spark teamed up on smart metering initiative
Posted 5-Mar-2020 08:42



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.