Been hacked - what's the best way to prevent sip scanner?
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
Depends on your config. If the attack is vicious enough, the best defense it to block it upstream, if possible. I always put my servers behind firewalls, but that's me. My firewall is helpful in that is limits the connections per second from any ip address. This is not something that can be helpful if the attack is distributed though. There are some good scripts out there to help identify a potential attack and help alert your firewall, etc. On Tue, Oct 5, 2010 at 2:55 PM, Mario <mario_fs@mgtech.com> wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ====================== Tony Graziano, Manager Telephone: 434.984.8430 sip: tgraziano@voice.myitdepartment.net Fax: 434.984.8431 Email: tgraziano@myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 sip: helpdesk@voice.myitdepartment.net Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec.
fail2ban is 1 option. http://wiki.freeswitch.org/wiki/Fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban>after X # of failed attempts it will be auto added to the firewall. Restricting the external ports to only trusted hosts can be an option as well if you don't have any incoming sip calls from unknown sources.
see also scripts/perl/blacklist.pl along with scripts/perl/honeypot.pl NEXT!!! /b On Oct 5, 2010, at 2:04 PM, William Suffill wrote:
fail2ban is 1 option. http://wiki.freeswitch.org/wiki/Fail2ban
after X # of failed attempts it will be auto added to the firewall.
Restricting the external ports to only trusted hosts can be an option as well if you don't have any incoming sip calls from unknown sources. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I agree with @William Suffill mentioned. very good advise. Because putting third party router in front of your FS switch will put your back to NAT issues. So, putting iptables as suggested can protect + keep the voice quality stable. Thanks & Regards On Tue, Oct 5, 2010 at 8:55 PM, Mario <mario_fs@mgtech.com> wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I have a Linksys firewall and use NAT. The thing that's puzzling is even with the natting how someone could get through to the natted address of FS. It worries me that the phone system could be killed this way. Anyway, this was a GoDaddy address and I reported it, they finally killed it a little while ago. BTW, never could get Asterisk to work with NAT but FS worked first time which is why I went with it. On 10/05/2010 12:14 PM, Shamun toha md wrote:
I agree with @William Suffill mentioned. very good advise. Because putting third party router in front of your FS switch will put your back to NAT issues.
So, putting iptables as suggested can protect + keep the voice quality stable.
Thanks & Regards
On Tue, Oct 5, 2010 at 8:55 PM, Mario <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com>> wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Mario*
Well, if they couldn't reach FS, it couldn't be used at all, so it's not that strange :) /Peter ________________________________________ Från: freeswitch-users-bounces@lists.freeswitch.org [freeswitch-users-bounces@lists.freeswitch.org] för Mario [mario_fs@mgtech.com] Skickat: den 5 oktober 2010 21:41 Till: FreeSWITCH Users Help Ämne: Re: [Freeswitch-users] Been hacked - what's the best way to prevent sip scanner? I have a Linksys firewall and use NAT. The thing that's puzzling is even with the natting how someone could get through to the natted address of FS. It worries me that the phone system could be killed this way. Anyway, this was a GoDaddy address and I reported it, they finally killed it a little while ago. BTW, never could get Asterisk to work with NAT but FS worked first time which is why I went with it. On 10/05/2010 12:14 PM, Shamun toha md wrote:
I agree with @William Suffill mentioned. very good advise. Because putting third party router in front of your FS switch will put your back to NAT issues.
So, putting iptables as suggested can protect + keep the voice quality stable.
Thanks & Regards
On Tue, Oct 5, 2010 at 8:55 PM, Mario <mario_fs@mgtech.com <mailto:mario_fs@mgtech.com>> wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Mario* _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org !DSPAM:4cab810e32931924414817!
Mario wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I just hope you don't have ports forwarding set on your router to your FS.
----- don't and stop are the ONLY two 4-letter words considered offensive to men, but not when used together. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Been-hacked-what-s-the-best-wa... Sent from the freeswitch-users mailing list archive at Nabble.com.
No I don't, thanks. On 10/05/2010 01:13 PM, mazilo wrote:
Mario wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I just hope you don't have ports forwarding set on your router to your FS.
----- don't and stop are the ONLY two 4-letter words considered offensive to men, but not when used together.
-- *Mario*
Mario, personnally, following a DoS REGISTER attack I had recently, I configured some rate-limiting on REGISTER attempts. Here is the result, in "iptables-save" format: -A INPUT -d YOUR_FS_IP -p udp -m udp --dport YOUR_FS_PORT -m string -- string "REGISTER" --algo kmp --from 20 --to 60 -j dos-filter-register- external -A dos-filter-register-external -m hashlimit --hashlimit 5/sec -- hashlimit-burst 8 --hashlimit-mode srcip --hashlimit-name REGISTER -- hashlimit-htable-size 24593 --hashlimit-htable-expire 90000 -j RETURN -A dos-filter-register-external -j REJECT --reject-with icmp-admin- prohibited This will ratelimit REGISTER packets coming to YOUR_FS_IP:YOUR_FS_PORT to 5 per second for each source IP. PS: thanks to the experienced people on #freeswitch for the help provided to setup this filter. David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur. Le 05/10/2010 à 20:55, Mario a écrit :
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It may have started here: http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html If other people have made improvements I'd love to hear about them and maintain the script somewhere :). On Tue, Oct 5, 2010 at 5:25 PM, David Ponzone <david.ponzone@ipeva.fr> wrote:
Mario, personnally, following a DoS REGISTER attack I had recently, I configured some rate-limiting on REGISTER attempts. Here is the result, in "iptables-save" format: -A INPUT -d YOUR_FS_IP -p udp -m udp --dport YOUR_FS_PORT -m string --string "REGISTER" --algo kmp --from 20 --to 60 -j dos-filter-register-external -A dos-filter-register-external -m hashlimit --hashlimit 5/sec --hashlimit-burst 8 --hashlimit-mode srcip --hashlimit-name REGISTER --hashlimit-htable-size 24593 --hashlimit-htable-expire 90000 -j RETURN -A dos-filter-register-external -j REJECT --reject-with icmp-admin-prohibited This will ratelimit REGISTER packets coming to YOUR_FS_IP:YOUR_FS_PORT to 5 per second for each source IP. PS: thanks to the experienced people on #freeswitch for the help provided to setup this filter. David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
-- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com
Thanks to all, I will look into and use some or all options presented here. Amazing, this happened so fast, I didn't even have the machine in full use, just in testing on/off since 9/20 and I'm only a SOHO. Still have 2 things to figure out before the switch. Thanks again! On 10/05/2010 03:09 PM, Kristian Kielhofner wrote:
It may have started here:
http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html
If other people have made improvements I'd love to hear about them and maintain the script somewhere :).
On Tue, Oct 5, 2010 at 5:25 PM, David Ponzone <david.ponzone@ipeva.fr> wrote:
Mario, personnally, following a DoS REGISTER attack I had recently, I configured some rate-limiting on REGISTER attempts. Here is the result, in "iptables-save" format: -A INPUT -d YOUR_FS_IP -p udp -m udp --dport YOUR_FS_PORT -m string --string "REGISTER" --algo kmp --from 20 --to 60 -j dos-filter-register-external -A dos-filter-register-external -m hashlimit --hashlimit 5/sec --hashlimit-burst 8 --hashlimit-mode srcip --hashlimit-name REGISTER --hashlimit-htable-size 24593 --hashlimit-htable-expire 90000 -j RETURN -A dos-filter-register-external -j REJECT --reject-with icmp-admin-prohibited This will ratelimit REGISTER packets coming to YOUR_FS_IP:YOUR_FS_PORT to 5 per second for each source IP. PS: thanks to the experienced people on #freeswitch for the help provided to setup this filter. David Ponzone Direction Technique email: david.ponzone@ipeva.fr tel: 01 74 03 18 97 gsm: 06 66 98 76 34 Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr - www.ipeva-studio.com Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.
-- *Mario*
participants (9)
-
Brian West
-
David Ponzone
-
Kristian Kielhofner
-
Mario
-
mazilo
-
Peter Olsson
-
Shamun toha md
-
Tony Graziano
-
William Suffill