<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks for such support and reply.<br></blockquote><div>
<br></div><div>Regards</div><div> </div><div>Shahzad Bhatti</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>---------- Forwarded message ----------<br>
From: Donny Hardyanto <<a href="mailto:hardyanto.donny@gmail.com">hardyanto.donny@gmail.com</a>><br>To: FreeSWITCH Users Help <<a href="mailto:freeswitch-users@lists.freeswitch.org">freeswitch-users@lists.freeswitch.org</a>><br>
Cc: <br>Date: Tue, 4 Mar 2014 10:21:51 +0700<br>Subject: Re: [Freeswitch-users] Call Without Authorization<br><div dir="ltr">Hi Shahzad,<div><br></div><div>1. Dont expose you SIP port on internet. If only for testing or local use, dont open it on internet. If you have to, use VPN.</div>
<div><br></div><div>2. Make sure all SIP/H.323 ALG on all Routers (they have one!) in your network is turn off. They can mask the intruder from outside and look like from local IP. </div>
<div><br></div><div>3. Change your default password! The one on vars.xml and every password on directory! </div><div><br></div><div>4. If you in control of your SIP client/ip phone, it good to change the default port 5060 and 5080 to some thing random (like 61351 etc). It make it harder for hacker to find your ports. Usually the SIP hacker is time and money oriented (not achivement-oriented), so most of the time it does not bother to find SIP port other than the default ports. They will quickly find another server IP to probe. They have organization behind them that can stream international phone call to the hacked servers. They usually test the softswitch first by sending alot of registration (some sip id is John etc). I think some show they can break the password using this because SIP authorization only using hash to check. So because hash has collision, they can calculate your password.</div>
<div><br></div><div>5. They usually try to break on weekdays (check your cdr) and use your hacked line on weekends! Please be carefull if you connected to PSTN line or operator! You can lose thousand of dollars in 1 day!</div>
<div><br></div><div>6. You can use SBC but you need very through on configuring. Unconfigured SBC same as no protection at all.</div><div><br></div><div>Lastly, the SIP world is VERY CRUEL. Honest mistake can destroy your life. Be EXTRA careful.</div>
<div><br></div><div>Donny</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Mar 2, 2014 at 9:25 AM, Shahzad Bhatti <span dir="ltr"><<a href="mailto:shahzad.bhatti@g-r-v.com" target="_blank">shahzad.bhatti@g-r-v.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi Everybody,<br></div>i am rephrasing my question that<br><br>i got a legal registered sip account 1001 on freeswitch <br>
<br>but some hacker who is not registered on my freeswitch <br>but use same 1001 account and make call.<br>
<br>i put condition in xml_dialplan to verify and allow only register sip accounts to call <br>as<br><br><b><condition field=</b><b><span><span>"${sofia_contact */1001@freeswitchIP}"</span> <span>expression</span>=<span>"^[^@]+@(.+)"</span><span>></span></span>><br>
<br></b>but hacker find someway to pass the regex through some back whole in my script and make calls<br><div><div><b><br>dialplan xml is </b></div><div><a href="http://pastebin.freeswitch.org/22054" target="_blank">http://pastebin.freeswitch.org/22054</a><br>
</div></div><div><div><b>fs_cli log as </b></div><div><a href="http://pastebin.freeswitch.org/22050" target="_blank">http://pastebin.freeswitch.org/22050</a><br>
</div><div><div><b>xml_cdr is</b> </div><div><a href="http://pastebin.freeswitch.org/22052" target="_blank">http://pastebin.freeswitch.org/22052</a><br></div><div><br></div></div></div>i also try to generate the scenario but got no success, but now want to know<br>
<div><div><div>how hacker made successful call in the above scenario and what is the best way to prevent from hacking in future<br><br></div><div>Regards<br><br></div><div>Shahzad Bhatti <br><br><br></div><div><div class="gmail_quote">
---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Shahzad Bhatti</b> <span dir="ltr"><<a href="mailto:shahzad.bhatti@g-r-v.com" target="_blank">shahzad.bhatti@g-r-v.com</a>></span><br>Date: Fri, Feb 28, 2014 at 11:51 PM<br>
Subject: Call Without Authorization<br>To: <a href="mailto:freeswitch-users@lists.freeswitch.org" target="_blank">freeswitch-users@lists.freeswitch.org</a><br><br><br><div dir="ltr">Hi everybody,<div><br></div><div>i create my xml_curl script as that don't allow unregistered calls with the following condition</div>
<div><b><condition field=\"\${sofia_contact */{$sipuser}@$domain}\" expression=\"^[^@]+@(.+)\"></b><br>
</div><div>and its working but yesterday a call is originated from having </div><div><br></div><div><b>fs_cli log as </b></div><div><a href="http://pastebin.freeswitch.org/22050" target="_blank">http://pastebin.freeswitch.org/22050</a><br>
</div><div><br></div><div><b>xml_cdr is</b> </div><div><a href="http://pastebin.freeswitch.org/22052" target="_blank">http://pastebin.freeswitch.org/22052</a><br></div><div><br></div><div><div><b>dialplan xml is </b></div>
<div><a href="http://pastebin.freeswitch.org/22054" target="_blank">http://pastebin.freeswitch.org/22054</a><br>
</div></div><div><br></div><div>this is only example that how the hacker breached</div><div><br></div><div>i want to know that </div><div><b>1. how it is possible that this call is originated as i check condition that allow to call only registered sip accounts.</b></div>
<div><b>2. how to prevent that this would not happened in future. </b></div><div><b>3. if there any better way to do that do inform me;</b></div><div><br></div><div>i check about 500 calls placed under the given scenario and many of them also answered</div>
<div><br></div><div>Regards</div><span><font color="#888888"><span><font color="#888888"><div><br></div><div>Shahzad Bhatti </div><div><br></div></font></span></font></span></div>
</div></div></div></div></div></blockquote></div></div></blockquote></div><br></div></div>