[Freeswitch-users] SIP attack SPA2102

[Miha]

I figure it out from logs. I guess it was pade call forward on SPA:)

thx!

Miha

Dne 7/15/2013 9:01 AM, piše Jeff Leung:
> More than likely somebody used the UA string from a SPA2102 instead of their
> default SIPVicious UA string which btw gets blocked anyways at the firewall
> level.
>
>> -----Original Message-----
>> From: freeswitch-users-bounces at lists.freeswitch.org [mailto:freeswitch-
>> users-bounces at lists.freeswitch.org] On Behalf Of Miha
>> Sent: Sunday, July 14, 2013 11:38 PM
>> To: FreeSWITCH Users Help
>> Subject: [Freeswitch-users] SIP attack SPA2102
>>
>> Hi,
>>
>> last night we noticed SIP attack from one of our costumar. Interesting
> thing is
>> that the call come from Linksys SPA2012 which was behind NAT.
>> The port forward was made for web access(xxx.xxx.xxx.xxx:8099).
>>
>> How it is possible do call from SPA2012 (relay calls)? I am looking at SPA
> but
>> do not see any of that options. How SIP traffic could be send to SPA from
>> which calls was send as there was no SIP port fwd on router?
>>
>> The device from which calls was send is SPA2012.
>>
>> THank you very much for all explenation!!!
>> Miha
>>
>> __________________________________________________________
>> _______________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>>
>> 
>> 
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>