On linux, the following is quite effective at mitigating most SIPVicious activity iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm On 3/21/13 9:09 AM, "PhilQ" <philq@qsystemsengineering.com> wrote:
What I did was very similar to the separate flood rule, I just grouped the regex in with the auth failure rule.
FYI - the attack is still ongoing this morning. I have fail2ban set to ban IPs for 10 hours at a time and noticed in the log that the offending IP was re-banned after 2 seconds, (maxretry is set to a somewhat liberal 150 attempts).
For what it's worth, the attack is coming from 70.38.71.75, which is within an IP block owned by iWeb Technologies. I personally called and spoke with one of their support staff yesterday morning after having sent a message detailing the issue to their abuse contact email address the night before, since I thought they would be very interested in stopping someone from using their service to launch an attack. I was mistaken. The support guy on the phone was passing it along to his team who would "get right on it".
Based on their apparent lack of ability to solve this problem after a day and a half, I'd give them a pass unless you're a script-kiddie looking to leverage a provider who's not minding the store to launch attacks against other computing resources. If that's the case, then that's the place. Adding their IP netblock to your firewall's blacklist might be a good idea.
iWeb Technologies Inc. IWEB-BLK-05 (NET-70-38-0-0-1) 70.38.0.0 - 70.38.127.255 iWeb Dedicated CL2 IWEB-CL-T160-01SH (NET-70-38-71-64-1) 70.38.71.64 - 70.38.71.95
- Phil
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... g-SIPVicious-attack-tp7588841p7588912.html Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch