On the receiving end of a brute force SIP attack

Forums › VoIP › On the receiving end of a brute force SIP attack

aw

273 posts

Ultimate Geek
+1 received by user: 7

Subscriber

Topic # 84766 7-Jun-2011 23:08

I'm on the receiving end of a brute force SIP registration attack coming from 111.75.255.9, trying to log on to my Asterisk box with random extension numbers.

I've fixed my fail2ban but it's still coming in thick and fast despite now being blocked, and it's pushed my data usage up quite high, and is having a DoS effect. It's been going on all day.

Anyone else getting this? It's fierce.

edit: added details of the attack

maverick

3594 posts

Uber Geek
+1 received by user: 79

Trusted

WorldxChange

Reply # 478820 8-Jun-2011 01:50

This is actaully normal for a SIP attack, SIP Scans go on all the time so hence the reason to secure your box and to only respond to the SIP proxy you require , otherwise once they find you they will get trying.

These BOT's will have pre set scripts, once they get a SIP response from a insecure box they will go through through their pre programmed list and just keep trying unfortunatly

Yes I am a employee of WxC (My Profile) ... but I do have my own opinions as well

https://www.facebook.com/wxccommunications

sbiddle

27132 posts

Uber Geek
+1 received by user: 6576

Moderator

Trusted

Biddle Corp

Lifetime subscriber

Reply # 478824 8-Jun-2011 07:04

It's pretty common these days. Once the attack stats there isn't anything you can do to stop it until they give up.

IMHO fail2ban along with a good iptables firewall setup is an even more essential part of an Asterisk setup than phones themselves. Unless you have a very good reason to do so port 5060 should never be exposed to the internet, and if it is it should be locked down to the IP(s) of your VoIP provider. If you need remote endpoints on the internet there are plenty of ways of managing these such as via VPN that will reduce the security risks.

aw

273 posts

Ultimate Geek
+1 received by user: 7

Subscriber

Reply # 478847 8-Jun-2011 09:13

I use remote extensions, which is why I had this on. Just last week they all became iPhones so VPN has become an option, I'll investigate that.

fail2ban kicked in properly last night once I removed the typo in which log file it was scanning, but I'm still receiving 10-20 REGISTER packets per second, even now. It's ballooned my data usage (12GB where I would have otherwise used about 4), Phil can this offending IP (it's just been the one above) be blocked at the ISP level?

maverick

3594 posts

Uber Geek
+1 received by user: 79

Trusted

WorldxChange

Reply # 478851 8-Jun-2011 09:23

Will take a look

Yes I am a employee of WxC (My Profile) ... but I do have my own opinions as well

https://www.facebook.com/wxccommunications

maverick

3594 posts

Uber Geek
+1 received by user: 79

Trusted

WorldxChange

Reply # 478862 8-Jun-2011 09:42

should be dead now

Yes I am a employee of WxC (My Profile) ... but I do have my own opinions as well

https://www.facebook.com/wxccommunications

aw

273 posts

Ultimate Geek
+1 received by user: 7

Subscriber

Reply # 478877 8-Jun-2011 10:13

Thanks, just remoted in, the attack (with its DoS effect) looks to be successfully blocked.

I see it was affecting multiple Xnet customers:

http://www.ipillion.com/ip/111.75.255.9

rphenix

871 posts

Ultimate Geek
+1 received by user: 54

Subscriber

Reply # 478983 8-Jun-2011 15:14

aw: I use remote extensions, which is why I had this on. Just last week they all became iPhones so VPN has become an option, I'll investigate that.

Use an IAX2 client if possible for software based remote extensions, that way you can keep SIP closed except between WXC and yourself. If your using remote hard phones (or want to) look at something like Yealink SIP-T26P with openvpn support so can setup an openvpn server, have the phones connect to that, and from there to the private lan ip of the pbx.

If you must open SIP up to the outside world, then I would use something like a SIP Port knock (of sorts) rather clever ;)

richms

21533 posts

Uber Geek
+1 received by user: 4386

Trusted

Subscriber

Reply # 479962 11-Jun-2011 00:50

Is there any way that a IP PBX could just do a port unreachable for any incoming SIP stuff that would fail instead of sending back a response?

If traffic wasnt so expensive it would be more fun to let them register and put the call recordings up on youtube to funny pictures like that crank phone guy, but I have a feeling that they would all be in some minority language that would make it not very fun.

Richard rich.ms

Regs

Infrastructure Geek
4057 posts

Uber Geek
+1 received by user: 195

Trusted

Microsoft NZ

Subscriber

Reply # 480467 12-Jun-2011 23:25

richms: Is there any way that a IP PBX could just do a port unreachable for any incoming SIP stuff that would fail instead of sending back a response?

If traffic wasnt so expensive it would be more fun to let them register and put the call recordings up on youtube to funny pictures like that crank phone guy, but I have a feeling that they would all be in some minority language that would make it not very fun.

many firewalls just seem to be 'black holes' for packets. i.e. they accept but discard the packets so the sender never gets an ACK.

as for the phone calls, most of the hacks are from cheap phone calling card companies, or sip trunkers, so you'd just get a bunch of random regular calls in whatever language/country the plans are being sold in.

Technical Evangelist
Microsoft NZ
about.me/nzregs
Twitter: @nzregs