[Freeswitch-users] Hacker Attack?

[Cliff Wells]

On Sat, 2011-01-29 at 15:39 -0800, Joao Leme wrote:
> I just downloaded and compiled the latest Git and a little after
> starting freeswitch I'm getting non stop the following:
> 
> 
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia
> profile ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236

> it's non-stop and doesn't let me do nothing else. After the first time
> I went on to vars and changed the 1234 password....restarted and same
> thing happened, I also try denying the ip on acl.conf (not sure if has
> something to do with it but gave it a try):

It seems obvious, but since no one else mentioned it, I will: have you
tried contacting the owner of attacking machine?   Chances are it's a
compromised machine and the owner is unaware of the situation.   I
experienced the same thing about a week ago, did a WHOIS lookup on the
IP, contacted the owner who was quite grateful to be alerted of the
issue, and had it resolved pretty quickly.

As an aside, if the script that's attacking you is the same one that was
attacking me, it won't stop once you setup the iptables rule.  In my
case it continued to send over 1Mbit/s of registration attempts even
when it could no longer connect (as measured by pfSense).

Regards,
Cliff