<HTML>
<HEAD>
<TITLE>Re: [Freeswitch-users] No failure messages in log during SIPVicious attack</TITLE>
</HEAD>
<BODY>
<FONT FACE="Monaco, Courier New"><SPAN STYLE='font-size:11pt'>Theres rules on the wiki for iptables for banning friendly scanner completely<BR>
<BR>
<BR>
On 3/19/13 10:21 PM, "Phil Quesinberry" <<a href="philq@qsystemsengineering.com">philq@qsystemsengineering.com</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><SPAN STYLE='font-size:11pt'><FONT FACE="Calibri, Verdana, Helvetica, Arial">We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn’t catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">and reloaded</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">but</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">there was no change in behavior:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><param name="log-auth-failures" value="true"/><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">Interestingly, if I tell</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">the Aastra</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">on my desk</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">to register with the wrong password, there is a failure message logged.<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">I’m not sure why</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">this attack doesn’t generate a failure message but</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">I added a rule</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">under filter.d to ban IPs with too many registration attempts in a certain period of time.</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"> Of course</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">I’d prefer to ban</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">only</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">on failures.<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">The user agent string</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">would</FONT><FONT FACE="Monaco, Courier New"> </FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash.<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial">Here is an excerpt of the traffic:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">freeswitch@internal> sofia profile internal siptrace on<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">Enabled sip debugging on internal<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> REGISTER sip:xx.xx.xx.xx SIP/2.0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Content-Length: 0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> From: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Accept: application/sdp<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> User-Agent: friendly-scanner<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> To: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Contact: sip:<a href="123@1.1.1.1">123@1.1.1.1</a><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> CSeq: 1 REGISTER<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Call-ID: 1757394<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Max-Forwards: 70<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> <BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> SIP/2.0 401 Unauthorized<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> From: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> To: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>>;tag=tNtgHUjZSej3F<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Call-ID: 1757394<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> CSeq: 1 REGISTER<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Supported: timer, precondition, path, replaces<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Content-Length: 0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> <BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> REGISTER sip:xx.xx.xx.xx SIP/2.0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Content-Length: 0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> From: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Accept: application/sdp<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> User-Agent: friendly-scanner<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> To: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Contact: sip:<a href="123@1.1.1.1">123@1.1.1.1</a><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> CSeq: 1 REGISTER<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Call-ID: 2727970266<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Max-Forwards: 70<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> <BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>] from ip 70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier">send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> ------------------------------------------------------------------------<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> SIP/2.0 401 Unauthorized<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> From: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>><BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> To: "4623" <sip:<a href="4623@xx.xx.xx.xx">4623@xx.xx.xx.xx</a>>;tag=UyK9jp32pQ8NB<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Call-ID: 2727970266<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> CSeq: 1 REGISTER<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Supported: timer, precondition, path, replaces<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Consolas, Courier New, Courier"> Content-Length: 0<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Times New Roman"><I>Phil Quesinberry<BR>
</I></FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Arial">Q Systems Engineering, Inc.<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Arial">Electronic Controls and Embedded Systems Development<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT FACE="Arial">(410) 969-8002<BR>
</FONT><FONT FACE="Monaco, Courier New"><BR>
</FONT><FONT COLOR="#0000FF"><FONT FACE="Arial"><U><a href="http://www.qsystemsengineering.com">http://www.qsystemsengineering.com</a></U></FONT></FONT><FONT FACE="Monaco, Courier New"> <<a href="http://www.qsystemsengineering.com">http://www.qsystemsengineering.com</a>> <BR>
<BR>
<BR>
<HR ALIGN=CENTER SIZE="3" WIDTH="95%"></FONT></SPAN><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'>_________________________________________________________________________<BR>
Professional FreeSWITCH Consulting Services:<BR>
<a href="consulting@freeswitch.org">consulting@freeswitch.org</a><BR>
<a href="http://www.freeswitchsolutions.com">http://www.freeswitchsolutions.com</a><BR>
<BR>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<BR>
<a href="http://www.cudatel.com">http://www.cudatel.com</a><BR>
<BR>
Official FreeSWITCH Sites<BR>
<a href="http://www.freeswitch.org">http://www.freeswitch.org</a><BR>
<a href="http://wiki.freeswitch.org">http://wiki.freeswitch.org</a><BR>
<a href="http://www.cluecon.com">http://www.cluecon.com</a><BR>
<BR>
FreeSWITCH-users mailing list<BR>
<a href="FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><BR>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><BR>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><BR>
<a href="http://www.freeswitch.org">http://www.freeswitch.org</a><BR>
</SPAN></FONT></FONT></BLOCKQUOTE><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'><BR>
</SPAN></FONT></FONT><FONT FACE="Monaco, Courier New"><SPAN STYLE='font-size:11pt'>-- <BR>
Ken<BR>
<FONT COLOR="#0000FF"><U><a href="http://www.FreeSWITCH.org">http://www.FreeSWITCH.org</a><BR>
<a href="http://www.ClueCon.com">http://www.ClueCon.com</a><BR>
<a href="http://www.OSTAG.org">http://www.OSTAG.org</a><BR>
</U></FONT>irc.freenode.net #freeswitch<BR>
</SPAN></FONT>
</BODY>
</HTML>