We haven't published any SRV records. I assume that they found us by a port scan. Our servers are open to the internet.It turns out that the attackers did not gain entry to our system at all. At first, I was a little freaked because there was nothing in the FreeSWITCH logs to indicate what all the traffic was for. When I cranked up the log level in the FreeSWITCH console, I could see that it was an endless series of attempts to make a SIP connection, to which FreeSWITCH was responding with a 401. We've since blocked that IP at our layer 3 switch.The only reason we noticed was because these boxes should have had zero traffic. Once these go into production, it would be much more difficult to spot the attack.This is probably not the forum for it, but anyone reading this might want to check their traffic for this IP: 61.164.41.144Mike van LammerenOn Thu, Jul 29, 2010 at 5:38 PM, Tony Graziano <tgraziano@myitdepartment.net> wrote:
Does it have published SRV records? If so did you look to see if it was sipvicous? What is the UA?On Thu, Jul 29, 2010 at 5:21 PM, Mike van Lammeren <mike@van.lammeren.net> wrote:
_______________________________________________I'm running FreeSWITCH version 1.0.6 on a box that is live on the internet, but is not yet in use by us. Over the last 48 hours, someone from an IP in China has been connected to our server. We observed about 36 Kbps of UDP traffic. According to the cdr-csv logs, it looks like they were sequentially dialing extension numbers. They were not able to get any calls through to termination, due to the nature of our system.I'm reasonably certain that I removed all the default accounts.What should I be looking for?Mike van Lammeren
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
--
======================
Tony Graziano, Manager
Telephone: 434.984.8430
sip: tgraziano@voice.myitdepartment.net
Fax: 434.984.8431
Email: tgraziano@myitdepartment.net
LAN/Telephony/Security and Control Systems Helpdesk:
Telephone: 434.984.8426
sip: helpdesk@voice.myitdepartment.net
Fax: 434.984.8427
Helpdesk Contract Customers:
http://www.myitdepartment.net/gethelp/
Why do mathematicians always confuse Halloween and Christmas?
Because 31 Oct = 25 Dec.
_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org