Hi, last night we noticed SIP attack from one of our costumar. Interesting thing is that the call come from Linksys SPA2012 which was behind NAT. The port forward was made for web access(xxx.xxx.xxx.xxx:8099). How it is possible do call from SPA2012 (relay calls)? I am looking at SPA but do not see any of that options. How SIP traffic could be send to SPA from which calls was send as there was no SIP port fwd on router? The device from which calls was send is SPA2012. THank you very much for all explenation!!! Miha
More than likely somebody used the UA string from a SPA2102 instead of their default SIPVicious UA string which btw gets blocked anyways at the firewall level.
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch- users-bounces@lists.freeswitch.org] On Behalf Of Miha Sent: Sunday, July 14, 2013 11:38 PM To: FreeSWITCH Users Help Subject: [Freeswitch-users] SIP attack SPA2102
Hi,
last night we noticed SIP attack from one of our costumar. Interesting thing is that the call come from Linksys SPA2012 which was behind NAT. The port forward was made for web access(xxx.xxx.xxx.xxx:8099).
How it is possible do call from SPA2012 (relay calls)? I am looking at SPA but do not see any of that options. How SIP traffic could be send to SPA from which calls was send as there was no SIP port fwd on router?
The device from which calls was send is SPA2012.
THank you very much for all explenation!!! Miha
__________________________________________________________ _______________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I figure it out from logs. I guess it was pade call forward on SPA:) thx! Miha Dne 7/15/2013 9:01 AM, piše Jeff Leung:
More than likely somebody used the UA string from a SPA2102 instead of their default SIPVicious UA string which btw gets blocked anyways at the firewall level.
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch- users-bounces@lists.freeswitch.org] On Behalf Of Miha Sent: Sunday, July 14, 2013 11:38 PM To: FreeSWITCH Users Help Subject: [Freeswitch-users] SIP attack SPA2102
Hi,
last night we noticed SIP attack from one of our costumar. Interesting thing is that the call come from Linksys SPA2012 which was behind NAT. The port forward was made for web access(xxx.xxx.xxx.xxx:8099).
How it is possible do call from SPA2012 (relay calls)? I am looking at SPA but do not see any of that options. How SIP traffic could be send to SPA from which calls was send as there was no SIP port fwd on router?
The device from which calls was send is SPA2012.
THank you very much for all explenation!!! Miha
__________________________________________________________ _______________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (2)
-
Jeff Leung
-
Miha