<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 08.00.0681.000">
<TITLE>No failure messages in log during SIPVicious attack</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We were the recipients of another script-kiddie SIPVicious attack this evening</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">, but Fail2ban didn</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">’</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">t catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">and reloaded</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">but</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">there was no change in behavior</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"><param name="log-auth-failures" value="true"/></FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Interestingly, if I tell</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">the</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> Aastra</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">on my desk</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">to register with the wrong password, there is a failure message logged.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">I</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">’</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">m n</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">ot sure why</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">this attack doesn</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">’</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">t generate a failure</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> message</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> but</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">I added a rule</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">under filter.d to ban IPs with too many registration attempts in a certain period of time</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri"> Of course</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">I</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">’</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">d prefer to</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> ban</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">only</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">on</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> failures.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">The user agent string</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">would</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">seem to indicate that this is an older version of SIPVicious</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> but I was unable to crash it with svcrash.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Here is an excerpt of the traffic:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">freeswitch@internal> sofia profile internal siptrace on</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">Enabled sip debugging on internal</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> REGISTER sip:</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas"> SIP/2.0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Content-Length: 0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> From: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Accept: application/sdp</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> User-Agent: friendly-scanner</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> To: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Contact: sip:123@1.1.1.1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> CSeq: 1 REGISTER</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Call-ID: 1757394</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Max-Forwards: 70</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> SIP/2.0 401 Unauthorized</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> From: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> To: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">>;tag=tNtgHUjZSej3F</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Call-ID: 1757394</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> CSeq: 1 REGISTER</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Supported: timer, precondition, path, replaces</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> WWW-Authenticate: Digest realm="</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Content-Length: 0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> REGISTER sip:</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas"> SIP/2.0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Content-Length: 0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> From: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Accept: application/sdp</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> User-Agent: friendly-scanner</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> To: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Contact: sip:123@1.1.1.1</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> CSeq: 1 REGISTER</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Call-ID: 2727970266</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Max-Forwards: 70</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">] from ip 70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas">send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> ------------------------------------------------------------------------</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> SIP/2.0 401 Unauthorized</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> From: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> To: "4623" <sip:4623@</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">>;tag=UyK9jp32pQ8NB</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Call-ID: 2727970266</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> CSeq: 1 REGISTER</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Supported: timer, precondition, path, replaces</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> WWW-Authenticate: Digest realm="</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">xx.xx.xx.xx</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Consolas">", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Consolas"> Content-Length: 0</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I></I></SPAN><SPAN LANG="en-us"><I></I></SPAN><I><SPAN LANG="en-us"></SPAN></I><I><SPAN LANG="en-us"><FONT FACE="Times New Roman">Phil Quesinberry</FONT></SPAN></I><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Q Systems Engineering, Inc.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">Electronic Controls and Embedded Systems Development</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT SIZE=2 FACE="Arial">(410) 969-8002</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="http://www.qsystemsengineering.com"><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><U></U></SPAN><U><SPAN LANG="en-us"></SPAN></U><U><SPAN LANG="en-us"><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.qsystemsengineering.com</FONT></SPAN></U><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>