[Freeswitch-users] SIP attack SPA2102

[Jeff Leung]

More than likely somebody used the UA string from a SPA2102 instead of their
default SIPVicious UA string which btw gets blocked anyways at the firewall
level.

> -----Original Message-----
> From: freeswitch-users-bounces at lists.freeswitch.org [mailto:freeswitch-
> users-bounces at lists.freeswitch.org] On Behalf Of Miha
> Sent: Sunday, July 14, 2013 11:38 PM
> To: FreeSWITCH Users Help
> Subject: [Freeswitch-users] SIP attack SPA2102
> 
> Hi,
> 
> last night we noticed SIP attack from one of our costumar. Interesting
thing is
> that the call come from Linksys SPA2012 which was behind NAT.
> The port forward was made for web access(xxx.xxx.xxx.xxx:8099).
> 
> How it is possible do call from SPA2012 (relay calls)? I am looking at SPA
but
> do not see any of that options. How SIP traffic could be send to SPA from
> which calls was send as there was no SIP port fwd on router?
> 
> The device from which calls was send is SPA2012.
> 
> THank you very much for all explenation!!!
> Miha
> 
> __________________________________________________________
> _______________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
> 
> 
> 
> 
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org