[Security Issue][Need urgent comment]
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please. Regards Abbasi
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/> On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption) On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
"default" is the ONLY user that gets register with any password(i tried from my own softphone), if i try any valid user like 1000,1001 i am not able to register. On Sat, Jan 27, 2018 at 12:08 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption)
On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Read directory/default/default.xml This will actually cause nothing to happen, If you realize the context on the profile is public, they will not be able to actually do anything as they'll be assigned to context on the profile since that user doesn't have a user_context variable. It states exactly this: ATTENTION PLEASE READ THIS... (I know you won't but you've been warned) Let it be known that this user can register without a password but since we do not assign this user a user_context and we don't authenticate this user they will be put in context 'public'. This isn't a security issue as the endpoint would be put into the same context 'public' as the sofia profile that starts on 5080 by default. If you're paranoid just remove this file and remove the external profile also. On Fri, Jan 26, 2018 at 1:14 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
"default" is the ONLY user that gets register with any password(i tried from my own softphone), if i try any valid user like 1000,1001 i am not able to register.
On Sat, Jan 27, 2018 at 12:08 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption)
On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Brian West | Co-founder and Developer Need Commercial support? email sales@freeswitch.com FreeSWITCH Solutions | 17345 Civic Drive #2531 Brookfield, WI 53045 <https://maps.google.com/?q=17345+Civic+Drive+%232531+Brookfield,+WI+53045&entry=gmail&source=g> Email: brian@freeswitch.com Mobile: 918-424-9378 Website: https://www.FreeSWITCH.com <https://www.freeswitch.com/> [image: color-facebook-96.png] <https://www.facebook.com/freeswitch/>[image: color-twitter-96.png] <https://twitter.com/freeswitch?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor>
Are you by chance using xml_curl or some other dynamic method to generate the users? On Fri, Jan 26, 2018 at 2:14 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
"default" is the ONLY user that gets register with any password(i tried from my own softphone), if i try any valid user like 1000,1001 i am not able to register.
On Sat, Jan 27, 2018 at 12:08 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption)
On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Brain, Thanks alot, it was exactly as you said, i was infact even more wondering that why call on internal sip profile goes on public context, anyway its clear now. thank you everyone for such quick responses, highly appretiated. Regards Abbasi On Sat, 27 Jan 2018 at 12:20 AM, Abaci B <abaci64@gmail.com> wrote:
Are you by chance using xml_curl or some other dynamic method to generate the users?
On Fri, Jan 26, 2018 at 2:14 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
"default" is the ONLY user that gets register with any password(i tried from my own softphone), if i try any valid user like 1000,1001 i am not able to register.
On Sat, Jan 27, 2018 at 12:08 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption)
On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I actually did that on purpose, so if you disable auth on internal you don't accidentally open ourself up for fraud. /b On Fri, Jan 26, 2018 at 1:35 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Brain, Thanks alot, it was exactly as you said, i was infact even more wondering that why call on internal sip profile goes on public context, anyway its clear now. thank you everyone for such quick responses, highly appretiated.
Regards Abbasi
On Sat, 27 Jan 2018 at 12:20 AM, Abaci B <abaci64@gmail.com> wrote:
Are you by chance using xml_curl or some other dynamic method to generate the users?
On Fri, Jan 26, 2018 at 2:14 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
"default" is the ONLY user that gets register with any password(i tried from my own softphone), if i try any valid user like 1000,1001 i am not able to register.
On Sat, Jan 27, 2018 at 12:08 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Here is the sngrep screen shot, i guess if i did the blind accept, it should not reply back with 401(just assumption)
On Sat, Jan 27, 2018 at 12:03 AM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Yes it's challenging auth, and after auth whatever password is configured on softphone it sends 200OK. and i have <param name="accept-blind-reg" value="false"/>
On Sat, Jan 27, 2018 at 12:00 AM, Michael Jerris <mike@jerris.com> wrote:
is it challenging for auth or no? maybe you have blind reg turned on?
On Jan 26, 2018, at 1:41 PM, Bilal Abbasi <bilaln018@gmail.com> wrote:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/ options/freeswitch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Brian West | Co-founder and Developer Need Commercial support? email sales@freeswitch.com FreeSWITCH Solutions | 17345 Civic Drive #2531 Brookfield, WI 53045 <https://maps.google.com/?q=17345+Civic+Drive+%232531+Brookfield,+WI+53045&entry=gmail&source=g> Email: brian@freeswitch.com Mobile: 918-424-9378 Website: https://www.FreeSWITCH.com <https://www.freeswitch.com/> [image: color-facebook-96.png] <https://www.facebook.com/freeswitch/>[image: color-twitter-96.png] <https://twitter.com/freeswitch?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor>
Bilal, The first thing that comes to my mind is you may have "accept-blind-reg" directive in your sip profile. It would help to see sip traffic to check against authorisation process. 2018-01-26 21:41 GMT+03:00 Bilal Abbasi <bilaln018@gmail.com>:
Hi Users, I am using FreeSWITCH Version 1.6.19 git c540248 . today i noticed very weird issue, that i am getting an attack on one of my dev servers, that somebody is trying to make calls out of the box. And he is able to register the phone via "default" username(check via sngrep), i am using complex password and there is NO USER with name "DEFAULT" on my switch. I tried to register the default user with any random password and it allowed me to register on my softphone. I am really worried, and i can't believe that it's something at FS end. I am sure its some mistake, can somebody help me out please.
Regards Abbasi
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Volkan Oransoy
participants (5)
-
Abaci B
-
Bilal Abbasi
-
Brian West
-
Michael Jerris
-
Volkan Oransoy