Send FreeSWITCH-users mailing list submissions to
freeswitch-users@lists.freeswitch.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
or, via email, send a message with subject or body 'help' to
freeswitch-users-request@lists.freeswitch.org
You can reach the person managing the list at
freeswitch-users-owner@lists.freeswitch.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of FreeSWITCH-users digest..."
Limit resets as soon as the call leaves the context - could that be the reason?
On Oct 21, 2014 8:44 PM, "Kamil Nigmatullin" <kamil.nigmatullin@gmail.com> wrote:_________________________________________________________________________Dear all,Today we had an attack. One of our clients lost password to his SIP account. So with this password attackers made calls on our client's behalf to very expensive destinations.
We have Opensips as a border controller and Freeswitch as a Softswitch. This phone was confugured for 1 concurrent line using module limit of FS. Howerver they somehow managed to make several concurrent calls per one account. On CDR's we found that there was Attended transfer. Does anybody knows what kind of attack was that and how I can protect us against this? Is it sip refer attack when attacker set REFERED BY HEADER?When I check if limit works whith a sipphone, I see that it worked 100%.Thanks in advance
--Kamil Nigmatullin
Tel: 77272323748
mob: 7 (707) 2517003
Skype: kamil.nigmatullin
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
Also, why don't you implement daily and monthly minute limits and block the user as soon as these limits are reached?(now on a normal keyboard)Kamil,
when you use the "limit" application and increase the user's counter, it keeps its value only within the context where it was originally called. If you, for example, used pieces of the original (Vanilla) FreeSWITCH configuration, there are bind_meta_app bindings which send the call into another context ("features"). Once it's done, the user's limit counter is lost, and you need to increment it again in the new context.
On Tue, Oct 21, 2014 at 9:21 PM, Stanislav Sinyagin <ssinyagin@gmail.com> wrote:Limit resets as soon as the call leaves the context - could that be the reason?
On Oct 21, 2014 8:44 PM, "Kamil Nigmatullin" <kamil.nigmatullin@gmail.com> wrote:_________________________________________________________________________Dear all,Today we had an attack. One of our clients lost password to his SIP account. So with this password attackers made calls on our client's behalf to very expensive destinations.
We have Opensips as a border controller and Freeswitch as a Softswitch. This phone was confugured for 1 concurrent line using module limit of FS. Howerver they somehow managed to make several concurrent calls per one account. On CDR's we found that there was Attended transfer. Does anybody knows what kind of attack was that and how I can protect us against this? Is it sip refer attack when attacker set REFERED BY HEADER?When I check if limit works whith a sipphone, I see that it worked 100%.Thanks in advance
--Kamil Nigmatullin
Tel: 77272323748
mob: 7 (707) 2517003
Skype: kamil.nigmatullin
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
Also do you know how the password was gained? If it was brute-forced look at implementing a secure password policy and using fail2ban to detect and block brute forcing attacks
On Wednesday, October 22, 2014, Stanislav Sinyagin <ssinyagin@gmail.com> wrote:Also, why don't you implement daily and monthly minute limits and block the user as soon as these limits are reached?(now on a normal keyboard)Kamil,
when you use the "limit" application and increase the user's counter, it keeps its value only within the context where it was originally called. If you, for example, used pieces of the original (Vanilla) FreeSWITCH configuration, there are bind_meta_app bindings which send the call into another context ("features"). Once it's done, the user's limit counter is lost, and you need to increment it again in the new context.
On Tue, Oct 21, 2014 at 9:21 PM, Stanislav Sinyagin <ssinyagin@gmail.com> wrote:Limit resets as soon as the call leaves the context - could that be the reason?
On Oct 21, 2014 8:44 PM, "Kamil Nigmatullin" <kamil.nigmatullin@gmail.com> wrote:_________________________________________________________________________Dear all,Today we had an attack. One of our clients lost password to his SIP account. So with this password attackers made calls on our client's behalf to very expensive destinations.
We have Opensips as a border controller and Freeswitch as a Softswitch. This phone was confugured for 1 concurrent line using module limit of FS. Howerver they somehow managed to make several concurrent calls per one account. On CDR's we found that there was Attended transfer. Does anybody knows what kind of attack was that and how I can protect us against this? Is it sip refer attack when attacker set REFERED BY HEADER?When I check if limit works whith a sipphone, I see that it worked 100%.Thanks in advance
--
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org