[Freeswitch-dev] Bruteforce hack
Hi, Couple months ago I have repotred strange behaviour of FreeSWITCH: 100% CPU usage, and leak memory. Today I catch this situation, and viewed logs. found something like ping-pong with SIP-port attack: FS log: 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.938408 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.957793 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.981472 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.999635 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.028769 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.048709 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.064379 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.080898 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.099860 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.118179 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.133097 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.149791 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.172722 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.187540 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.203845 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.219207 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.233950 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.250684 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.267531 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.283970 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 TCPDUMP output. 20:19:11.863940 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.914740 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.917521 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.931544 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.934351 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.946799 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.949370 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.954355 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.957996 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.958972 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.959998 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.961019 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.961814 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 329 20:19:11.962213 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.963141 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.964106 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.965059 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.966066 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.967018 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.967965 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.968930 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 Also, I see, attack continues, when I stopped FreeSWITCH: 20:21:46.045995 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.046088 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.051280 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.051378 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.059059 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.059154 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.061089 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.061187 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.065982 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.066076 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.073622 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.073719 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.076260 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.076352 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.083160 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.083256 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.090586 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.090684 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 So, you can see, this is not wrong FS-activity, this is just attack, attempt to hack in by method "brute force and ignorance". I think, easiest way to protect FS - to dynamically ban IP, from which comes attack. Or, maybe more smooth policy - to count attempts of unsuccessful login from some IP, and after threshold - set timewait for this IP. See following sample of pseudocode for demo this idea: char bantable[1<<12]; // 4K hashtable for ban counter. int ban_index = hash(user_ip_address) & (sizeof(bantable) - 1); if(user_login_success()) bantable[ban_index] = 0; // IP is valid else { if(bantable[ban_index] < 0) sleep(1); else bantable[ban_index]++; } Idea following - if real user comes in, and will be unlucky (hash as same as attacker), he just get 1s delay. But, for hacker, it will decrease attack dataflow, and slowing him...
check out Fail2Ban and turn on the correct sofia settings to enable fail2ban compatible logging. http://wiki.freeswitch.org/wiki/Fail2ban that will help protect you. I think the plan is not to bloat freeswitch with a million features, when they can be built around freeswitch.. also its better to do the banning at iptables that way the FS process dosnt even see the traffic. in my situation we take fail2ban a step further and we add a route to our BGP blackhole setup for repeat offenders. that way it dosnt even traverse the network. its just more flexible this way, then you can apply your own logic easily. Jay On Wed, Mar 30, 2011 at 10:44 AM, Oleg Khovayko <khovayko@gmail.com> wrote:
Hi,
Couple months ago I have repotred strange behaviour of FreeSWITCH: 100% CPU usage, and leak memory.
Today I catch this situation, and viewed logs. found something like ping-pong with SIP-port attack:
FS log:
2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.754314 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.938408 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.957793 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.981472 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:42.999635 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.028769 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.048709 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.064379 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.080898 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.099860 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.118179 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.133097 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.149791 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.172722 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.187540 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.203845 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.219207 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.233950 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.250684 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.267531 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75 2011-03-29 20:12:43.283970 [WARNING] sofia_reg.c:1246 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4@173.79.240.220] from ip 118.175.22.75
TCPDUMP output.
20:19:11.863940 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.914740 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.917521 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.931544 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.934351 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.946799 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.949370 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:19:11.954355 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:19:11.957996 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.958972 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.959998 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.961019 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.961814 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 329 20:19:11.962213 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.963141 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.964106 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.965059 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.966066 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.967018 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 604 20:19:11.967965 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605 20:19:11.968930 IP deskpro.khovayko.com.sip > 118.175.22.75.5239: SIP, length: 605
Also, I see, attack continues, when I stopped FreeSWITCH:
20:21:46.045995 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.046088 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.051280 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.051378 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.059059 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.059154 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.061089 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.061187 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.065982 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.066076 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.073622 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.073719 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.076260 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.076352 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.083160 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 331 20:21:46.083256 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36 20:21:46.090586 IP 118.175.22.75.5239 > deskpro.khovayko.com.sip: SIP, length: 330 20:21:46.090684 IP deskpro.khovayko.com > 118.175.22.75: ICMP deskpro.khovayko.com udp port sip unreachable, length 36
So, you can see, this is not wrong FS-activity, this is just attack, attempt to hack in by method "brute force and ignorance".
I think, easiest way to protect FS - to dynamically ban IP, from which comes attack.
Or, maybe more smooth policy - to count attempts of unsuccessful login from some IP, and after threshold - set timewait for this IP.
See following sample of pseudocode for demo this idea:
char bantable[1<<12]; // 4K hashtable for ban counter.
int ban_index = hash(user_ip_address) & (sizeof(bantable) - 1);
if(user_login_success()) bantable[ban_index] = 0; // IP is valid else { if(bantable[ban_index] < 0) sleep(1); else bantable[ban_index]++; }
Idea following - if real user comes in, and will be unlucky (hash as same as attacker), he just get 1s delay. But, for hacker, it will decrease attack dataflow, and slowing him...
_______________________________________________ FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
-- Sincerely Jay
participants (2)
-
jay binks
-
Oleg Khovayko