FS account got hacked **urgent**
Hi Team my account got hacked and attacked using my DID number as caller id and making calls via my FS server. in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed. Thanks, Siju Nair
Hi team , Please help on below query Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday! Here is what I had in my logs and what the packet has in it: 2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’=' x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY] INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254 ;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: < sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254
;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246 ;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel. /b On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Wish to schedule a meeting? http://app.timebridge.com/#/meet/freeswitch Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest
I've been seeing for approximately a week. On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@ 190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1--- 321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210. 245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470- 9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246
;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues. /b On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven <rtreleaven@bunnykick.ca> wrote:
I've been seeing for approximately a week.
On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@1 90.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9h G4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.24 5.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43 -bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102. 98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Wish to schedule a meeting? http://app.timebridge.com/#/meet/freeswitch Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest
I can try this tomorrow On Wed, Mar 1, 2017 at 1:06 AM Brian West <brian@freeswitch.org> wrote:
I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues.
/b
On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I've been seeing for approximately a week.
On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’=' x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254 ;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: < sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254
;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246 ;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
i don't think it will... we have pretty robust sql injection protection in the sip module. If anyone finds a hole in that please file a bug but in doubtful there will be one. On Tue, Feb 28, 2017 at 9:41 PM David Villasmil < david.villasmil.work@gmail.com> wrote:
I can try this tomorrow On Wed, Mar 1, 2017 at 1:06 AM Brian West <brian@freeswitch.org> wrote:
I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues.
/b
On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I've been seeing for approximately a week.
On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’=' x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254 ;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: < sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254
;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246 ;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It's possible it's an attack against the CDR database rather than the SIP one http://www.securityfocus.com/bid/8599/discuss On 1 March 2017 at 06:36, Michael Jerris <mike@jerris.com> wrote:
i don't think it will... we have pretty robust sql injection protection in the sip module. If anyone finds a hole in that please file a bug but in doubtful there will be one.
On Tue, Feb 28, 2017 at 9:41 PM David Villasmil < david.villasmil.work@gmail.com> wrote:
I can try this tomorrow On Wed, Mar 1, 2017 at 1:06 AM Brian West <brian@freeswitch.org> wrote:
I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues.
/b
On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I've been seeing for approximately a week.
On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@ 190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1--- 321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210. 245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470- 9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190. 102.98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Or given the content of the string... bypass a CLI whitelist? On 2 March 2017 at 20:34, Steven Ayre <steveayre@gmail.com> wrote:
It's possible it's an attack against the CDR database rather than the SIP one http://www.securityfocus.com/bid/8599/discuss
On 1 March 2017 at 06:36, Michael Jerris <mike@jerris.com> wrote:
i don't think it will... we have pretty robust sql injection protection in the sip module. If anyone finds a hole in that please file a bug but in doubtful there will be one.
On Tue, Feb 28, 2017 at 9:41 PM David Villasmil < david.villasmil.work@gmail.com> wrote:
I can try this tomorrow On Wed, Mar 1, 2017 at 1:06 AM Brian West <brian@freeswitch.org> wrote:
I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues.
/b
On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven < rtreleaven@bunnykick.ca> wrote:
I've been seeing for approximately a week.
On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@1 90.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9h G4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.24 5.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43 -bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102. 98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hello. Today I see a brute force from 212.83.154.177 and 212.83.148.20 So I just drop 212.83.0.0/16 Do you report the abuser's IP to someone? -- Mimiko desu.
I've gotten so many brute forces from that ISP I've started dropping their netblocks... 62.210.0.0/16 is another of their blocks. They do not respond to abuse reports it seems or they just don't care -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Mimiko Sent: Friday, March 3, 2017 1:24 AM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] FS account got hacked **urgent** Hello. Today I see a brute force from 212.83.154.177 and 212.83.148.20 So I just drop 212.83.0.0/16 Do you report the abuser's IP to someone? -- Mimiko desu. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Almost need to block the entire announcements from AS12876. I hate to do that, but I have reported abuse from multiple networks I manage to them and they have ignored all of the complaints -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Mimiko Sent: Friday, March 3, 2017 10:19 AM To: freeswitch-users@lists.freeswitch.org Subject: Re: [Freeswitch-users] FS account got hacked **urgent** On 03.03.2017 16:01, Ken Rice wrote:
62.210.0.0/16 is another of their blocks
This is not enough. Seems that it needs to be blocked 62.0.0.0/8 as the second part of IP.also change. -- Mimiko desu. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 2 March 2017 at 23:23, Mimiko <vbvbrj@gmail.com> wrote:
Today I see a brute force from 212.83.154.177 and 212.83.148.20 So I just drop 212.83.0.0/16 Do you report the abuser's IP to someone?
I had one from: 212.83.147.23 If 212.83.154.177 is associated with online.net, fill this out: http://abuse.online.net/ The operators of 212.83.147.23 stopped the abuse to my network in ~12 hours. -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
The problem with online.net isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records... I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS) I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:30 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent** On 2 March 2017 at 23:23, Mimiko <vbvbrj@gmail.com> wrote:
Today I see a brute force from 212.83.154.177 and 212.83.148.20 So I just drop 212.83.0.0/16 Do you report the abuser's IP to someone?
I had one from: 212.83.147.23 If 212.83.154.177 is associated with online.net, fill this out: http://abuse.online.net/ The operators of 212.83.147.23 stopped the abuse to my network in ~12 hours. -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org> wrote:
The problem with online.net isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders.
Yes that AS is online.net's AS Number... I'm seriously considering blackholing them across multiple networks... -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent** On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org> wrote:
The problem with online.net isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
List of of AS12876 networks $ whois -h whois.radb.net -- '-i origin AS12876' | grep 'route:' route: 212.155.196.0/23 route: 195.154.0.0/16 route: 62.4.0.0/19 route: 212.83.128.0/19 route: 212.129.0.0/18 route: 212.83.160.0/19 route: 62.210.0.0/16 route: 212.47.224.0/19 route: 163.172.0.0/16 Sergey пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice@freeswitch.org>:
Yes that AS is online.net's AS Number... I'm seriously considering blackholing them across multiple networks...
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent**
On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org> wrote:
The problem with online.net isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You could maybe ping them on Twitter, they're quite active on @online_fr <https://twitter.com/online_fr> . I got in a previous life a BGP peering established that way with them. On 03/03/2017 11:47 AM, Sergey Safarov wrote:
List of of AS12876 networks
$ whois -h whois.radb.net <http://whois.radb.net> -- '-i origin AS12876' | grep 'route:' route: 212.155.196.0/23 <http://212.155.196.0/23> route: 195.154.0.0/16 <http://195.154.0.0/16> route: 62.4.0.0/19 <http://62.4.0.0/19> route: 212.83.128.0/19 <http://212.83.128.0/19> route: 212.129.0.0/18 <http://212.129.0.0/18> route: 212.83.160.0/19 <http://212.83.160.0/19> route: 62.210.0.0/16 <http://62.210.0.0/16> route: 212.47.224.0/19 <http://212.47.224.0/19> route: 163.172.0.0/16 <http://163.172.0.0/16>
Sergey
пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org>>:
Yes that AS is online.net <http://online.net>'s AS Number... I'm seriously considering blackholing them across multiple networks...
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org>] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org>> Subject: Re: [Freeswitch-users] FS account got hacked **urgent**
On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org>> wrote: > The problem with online.net <http://online.net> isn't necessarily one of their clients, > they tend to no respond to the reports they get via the link you > posted nor do they respond to emails to their abuse@ email address as > per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
> > I have received multiple attacks from various IPs on their network > (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net <http://online.net>?
> > I have seen these attacks across multiple networks... I wish there was > a way we could would with them to help mitigate this but it doesn't > seem they are interested in it >
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I did lolol they didn’t answer me… From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Tristan Mahé Sent: Friday, March 3, 2017 2:45 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent** You could maybe ping them on Twitter, they're quite active on <https://twitter.com/online_fr> @online_fr . I got in a previous life a BGP peering established that way with them. On 03/03/2017 11:47 AM, Sergey Safarov wrote: List of of AS12876 networks $ whois -h whois.radb.net <http://whois.radb.net> -- '-i origin AS12876' | grep 'route:' route: 212.155.196.0/23 <http://212.155.196.0/23> route: 195.154.0.0/16 <http://195.154.0.0/16> route: 62.4.0.0/19 <http://62.4.0.0/19> route: 212.83.128.0/19 <http://212.83.128.0/19> route: 212.129.0.0/18 <http://212.129.0.0/18> route: 212.83.160.0/19 <http://212.83.160.0/19> route: 62.210.0.0/16 <http://62.210.0.0/16> route: 212.47.224.0/19 <http://212.47.224.0/19> route: 163.172.0.0/16 <http://163.172.0.0/16> Sergey пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> >: Yes that AS is online.net <http://online.net> 's AS Number... I'm seriously considering blackholing them across multiple networks... -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> ] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> > Subject: Re: [Freeswitch-users] FS account got hacked **urgent** On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> > wrote:
The problem with online.net <http://online.net> isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net <http://online.net> ?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Is there any way in FS to stop such attacks ! By the way how to reject anonymous calls in FS .... ? Sent from my iPhone
On 04-Mar-2017, at 2:18 AM, Ken Rice <krice@freeswitch.org> wrote:
I did lolol they didn’t answer me…
From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Tristan Mahé Sent: Friday, March 3, 2017 2:45 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent**
You could maybe ping them on Twitter, they're quite active on @online_fr .
I got in a previous life a BGP peering established that way with them.
On 03/03/2017 11:47 AM, Sergey Safarov wrote: List of of AS12876 networks $ whois -h whois.radb.net -- '-i origin AS12876' | grep 'route:' route: 212.155.196.0/23 route: 195.154.0.0/16 route: 62.4.0.0/19 route: 212.83.128.0/19 route: 212.129.0.0/18 route: 212.83.160.0/19 route: 62.210.0.0/16 route: 212.47.224.0/19 route: 163.172.0.0/16
Sergey
пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice@freeswitch.org>: Yes that AS is online.net's AS Number... I'm seriously considering blackholing them across multiple networks...
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent**
On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org> wrote:
The problem with online.net isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You can block such attacks with acombination of iptables (and the like) and fail2ban. FreeSWITCH itself will reject calls from such things, but that whole point of an attack like that is to find someone that has some not nice SQL handling code… As far as rejecting anonymous calls that entirely up to your configuration in FreeSWITCH… see the config documentation for mod_sofia on https://freeswitch.org/confluence From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Siju Nair Sent: Sunday, March 5, 2017 12:42 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent** Is there any way in FS to stop such attacks ! By the way how to reject anonymous calls in FS .... ? Sent from my iPhone On 04-Mar-2017, at 2:18 AM, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> > wrote: I did lolol they didn’t answer me… From: freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Tristan Mahé Sent: Friday, March 3, 2017 2:45 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> > Subject: Re: [Freeswitch-users] FS account got hacked **urgent** You could maybe ping them on Twitter, they're quite active on <https://twitter.com/online_fr> @online_fr . I got in a previous life a BGP peering established that way with them. On 03/03/2017 11:47 AM, Sergey Safarov wrote: List of of AS12876 networks $ whois -h whois.radb.net <http://whois.radb.net> -- '-i origin AS12876' | grep 'route:' route: 212.155.196.0/23 <http://212.155.196.0/23> route: 195.154.0.0/16 <http://195.154.0.0/16> route: 62.4.0.0/19 <http://62.4.0.0/19> route: 212.83.128.0/19 <http://212.83.128.0/19> route: 212.129.0.0/18 <http://212.129.0.0/18> route: 212.83.160.0/19 <http://212.83.160.0/19> route: 62.210.0.0/16 <http://62.210.0.0/16> route: 212.47.224.0/19 <http://212.47.224.0/19> route: 163.172.0.0/16 <http://163.172.0.0/16> Sergey пт, 3 мар. 2017 г. в 22:24, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> >: Yes that AS is online.net <http://online.net> 's AS Number... I'm seriously considering blackholing them across multiple networks... -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> [mailto:freeswitch-users-bounces@lists.freeswitch.org <mailto:freeswitch-users-bounces@lists.freeswitch.org> ] On Behalf Of jungle Boogie Sent: Friday, March 3, 2017 12:59 PM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org <mailto:freeswitch-users@lists.freeswitch.org> > Subject: Re: [Freeswitch-users] FS account got hacked **urgent** On 3 March 2017 at 10:45, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org> > wrote:
The problem with online.net <http://online.net> isn't necessarily one of their clients, they tend to no respond to the reports they get via the link you posted nor do they respond to emails to their abuse@ email address as per their whois records...
I think I tried the email address once or twice until I found the form. IME, the online customers resolve the situation and I stop seeing the attacks.
I have received multiple attacks from various IPs on their network (the only thing in common with them is its originating from their AS)
hmm, that AS is with online.net <http://online.net> ?
I have seen these attacks across multiple networks... I wish there was a way we could would with them to help mitigate this but it doesn't seem they are interested in it
I wish there was something like denyhosts for sip traffic that would sync up and download known offenders. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
FYI. The IP addresses are listed on the VoIPBL IP blacklist but don't appear to be listed on any others, nor do the subnets as a whole. We use a variety of IP Blacklists, the most useful being VoIPBL. http://www.voipbl.org/ If your firewall supports it the IP blacklists could be applied to protect your entire infrastructure updating every hour, if not you can build a simple bash script for your servers to update your IP tables. Shaun [http://www.itec-support.co.uk/wp-content/uploads/2016/07/email_logo.jpg] Shaun Stokes - Infrastructure Analyst T : 01453 700713 E : shaun.stokes@itec-support.co.uk W : www.itec-support.co.uk Registered Address :- ITEC Support, Suite 2 Prospect House, Bath Road, Stroud, Gloucestershire GL5 3QF Company No. 06908001 CONFIDENTIALITY NOTICE This communication and the information it contains are intended for the person or organisation to which it is addressed. Its contents are confidential and may be protected in law. Unauthorised use, copying or disclosure of any of it may be unlawful. If you are not the intended recipient, please contact us immediately. The contents of any attachments in this e-mail may contain software viruses, which could damage your own computer system. While ITEC Support has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage which you sustain as a result of software viruses. You should carry out your own virus checking procedure before opening any attachment. ______________________________________________________________________ This message has been checked for all known viruses by MessageLabs Virus Scanning Service. ______________________________________________________________________
+++ thanks for sharing it! On 03/06/2017 09:32 AM, Shaun Stokes wrote:
FYI.
The IP addresses are listed on the VoIPBL IP blacklist but don't appear to be listed on any others, nor do the subnets as a whole.
We use a variety of IP Blacklists, the most useful being VoIPBL. http://www.voipbl.org/
If your firewall supports it the IP blacklists could be applied to protect your entire infrastructure updating every hour, if not you can build a simple bash script for your servers to update your IP tables.
Shaun
Shaun Stokes - Infrastructure Analyst
T : 01453 700713 E : shaun.stokes@itec-support.co.uk W : www.itec-support.co.uk
Registered Address :- ITEC Support, Suite 2 Prospect House, Bath Road, Stroud, Gloucestershire GL5 3QF Company No. 06908001
CONFIDENTIALITY NOTICE This communication and the information it contains are intended for the person or organisation to which it is addressed. Its contents are confidential and may be protected in law. Unauthorised use, copying or disclosure of any of it may be unlawful. If you are not the intended recipient, please contact us immediately. The contents of any attachments in this e-mail may contain software viruses, which could damage your own computer system. While ITEC Support has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage which you sustain as a result of software viruses. You should carry out your own virus checking procedure before opening any attachment.
______________________________________________________________________ This message has been checked for all known viruses by MessageLabs Virus Scanning Service. ______________________________________________________________________
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Saludos / Regards / Cumprimentos, António silva
yea man, Im seeing the exact same thing. from the same IP actually. INVITE sip:0008148825408632@180.214.68.115 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:f6d7a08c-d1d0-4bb1-9f09-01d032f62c38>" To: <sip:0008148825408632@180.214.68.115> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@180.214.68.115>;tag=LNDMJRRH Call-ID: XXINXNMLKORRQSRCIOPQFLZM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0 On 1 March 2017 at 09:59, Brian West <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@ 190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1--- 321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210. 245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470- 9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246
;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <+1%20918-420-9001> | *F:*+19184209002 <+1%20918-420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
Same as - all coming from 62.210.245.31 - reported to abuse@ but meh Not just a freeswitch thing obviously - there must be some vulnerability these wasters are trying to gain profit from.. They are actually spoofing a credible UA for once. 2017-02-28 19:38:23 +0000 : 62.210.245.31:41254 -> 8.8.28.60:5060 INVITE sip:001648825408632@8.8.28.60 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:546752fe-1c36-4770-9db8-1db98b72700f>" To: <sip:001648825408632@8.8.28.60> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@8.8.28.60>;tag=DLMPQMRN Call-ID: SWZYYRWNLTZCVZRAYLXRXNWU CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0 Brian On Wed, Mar 1, 2017 at 6:55 AM, jay binks <jaybinks@gmail.com> wrote:
yea man, Im seeing the exact same thing. from the same IP actually.
INVITE sip:0008148825408632@180.214.68.115 SIP/2.0
Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport
Max-Forwards: 70
Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:f6d7a08c-d1d0-4bb1-9f09-01d032f62c38>"
To: <sip:0008148825408632@180.214.68.115>
From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@180.214.68.115>;tag=LNDMJRRH
Call-ID: XXINXNMLKORRQSRCIOPQFLZM
CSeq: 1 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO
Content-Type: application/sdp
Supported: replaces
User-Agent: Cisco-SIPGateway/IOS-12.x
Allow-Events: hold, talk, conference
Content-Length: 0
On 1 March 2017 at 09:59, Brian West <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
https://www.gofundme.com/allison-prompts-for-freeswitch
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here! | Reddit: /r/freeswitch
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It's possible a device connected to your platform was compromised or the attacker conducted a man-in-the-middle-attacker, either way they've gained the login credentials. You should consider using IP blacklists and an IPS Firewall, we use both and the ones that sneak through the blacklist are picked up by our IPS and reported to abuse@ but the problem is never ending. The attackers typically route calls to high cost numbers used for fraud, you should report this the carriers that hold the numbers dialled as fraud. https://www.textmagic.com/free-tools/carrier-lookup Other recommendations: - Limit to 2 or 3 channels per account; https://wiki.freeswitch.org/wiki/Limit - Use a script to regularly monitor your CDR files and disable accounts which meet certain criteria (i.e. concurrent calls to the same destination, credit limit) -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian : Sent: 01 March 2017 07:39 To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] FS account got hacked **urgent** Same as - all coming from 62.210.245.31 - reported to abuse@ but meh Not just a freeswitch thing obviously - there must be some vulnerability these wasters are trying to gain profit from.. They are actually spoofing a credible UA for once. 2017-02-28 19:38:23 +0000 : 62.210.245.31:41254 -> 8.8.28.60:5060 INVITE sip:001648825408632@8.8.28.60 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:546752fe-1c36-4770-9db8-1db98b72700f>" To: <sip:001648825408632@8.8.28.60> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@8.8.28.60>;tag=DLMPQMRN Call-ID: SWZYYRWNLTZCVZRAYLXRXNWU CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0 Brian On Wed, Mar 1, 2017 at 6:55 AM, jay binks <jaybinks@gmail.com> wrote:
yea man, Im seeing the exact same thing. from the same IP actually.
INVITE sip:0008148825408632@180.214.68.115 SIP/2.0
Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport
Max-Forwards: 70
Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:f6d7a08c-d1d0-4bb1-9f09-01d032f62c38>"
To: <sip:0008148825408632@180.214.68.115>
From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@180.214.68.115>;tag =LNDMJRRH
Call-ID: XXINXNMLKORRQSRCIOPQFLZM
CSeq: 1 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO
Content-Type: application/sdp
Supported: replaces
User-Agent: Cisco-SIPGateway/IOS-12.x
Allow-Events: hold, talk, conference
Content-Length: 0
On 1 March 2017 at 09:59, Brian West <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
____________________________________________________________________ _____ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-u sers http://www.freeswitch.org
--
Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
https://www.gofundme.com/allison-prompts-for-freeswitch
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here! | Reddit: /r/freeswitch
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest
_____________________________________________________________________ ____ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-us ers http://www.freeswitch.org
-- Sincerely
Jay
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ______________________________________________________________________ This message has been checked for all known viruses by MessageLabs Virus Scanning Service. ______________________________________________________________________ [http://www.itec-support.co.uk/wp-content/uploads/2016/07/email_logo.jpg] Shaun Stokes - Infrastructure Analyst T : 01453 700713 E : shaun.stokes@itec-support.co.uk W : www.itec-support.co.uk Registered Address :- ITEC Support, Suite 2 Prospect House, Bath Road, Stroud, Gloucestershire GL5 3QF Company No. 06908001 CONFIDENTIALITY NOTICE This communication and the information it contains are intended for the person or organisation to which it is addressed. Its contents are confidential and may be protected in law. Unauthorised use, copying or disclosure of any of it may be unlawful. If you are not the intended recipient, please contact us immediately. The contents of any attachments in this e-mail may contain software viruses, which could damage your own computer system. While ITEC Support has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage which you sustain as a result of software viruses. You should carry out your own virus checking procedure before opening any attachment. ______________________________________________________________________ This message has been checked for all known viruses by MessageLabs Virus Scanning Service. ______________________________________________________________________
Hi Brian, Thanks for ur reply ... Yes on pulling CDR report I could see outbound calls to few locations setting up my DID as caller I'd. Sent from my iPhone
On 01-Mar-2017, at 5:29 AM, Brian West <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246>;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote: Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
https://www.gofundme.com/allison-prompts-for-freeswitch
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here! | Reddit: /r/freeswitch
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
That has nothing to do with the original issue you reported, I suspect you have a snafu in your configuration that allowed this, This would probably make a good topic to cover during our weekly calls. /b On Thu, Mar 2, 2017 at 8:24 AM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Brian,
Thanks for ur reply ...
Yes on pulling CDR report I could see outbound calls to few locations setting up my DID as caller I'd.
Sent from my iPhone
On 01-Mar-2017, at 5:29 AM, Brian West <brian@freeswitch.org> wrote:
You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!
Here is what I had in my logs and what the packet has in it:
2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10 2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@ 190.102.98.246 [CS_NEW] [WRONG_CALL_STATE] 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended 2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]
INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0 Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1--- 321bda12cf15b137;rport Max-Forwards: 70 Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210. 245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470- 9b43-bd04fcd1634d>" To: <sip:1259360048825408632@190.102.98.246> From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246
;tag=UBAWADPX Call-ID: OIERRISLMMBKZCIIUGWESXQM CSeq: 1 INVITE Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO Content-Type: application/sdp Supported: replaces User-Agent: Cisco-SIPGateway/IOS-12.x Allow-Events: hold, talk, conference Content-Length: 0
I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.
/b
On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi team ,
Please help on below query
Sent from my iPhone
On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
Hi Team
my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
Thanks, Siju Nair
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest*
http://www.freeswitchbook.com http://www.freeswitchcookbook.com
Allison prompts for FreeSWITCH:
*https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch>
Wish to schedule a meeting?
http://app.timebridge.com/#/meet/freeswitch
Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch>
*T:*+19184209001 <(918)%20420-9001> | *F:*+19184209002 <(918)%20420-9002> | *M:*+1918424WEST (9378) *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com Allison prompts for FreeSWITCH: *https://www.gofundme.com/allison-prompts-for-freeswitch* <https://www.gofundme.com/allison-prompts-for-freeswitch> Wish to schedule a meeting? http://app.timebridge.com/#/meet/freeswitch Got Bugs? Report them here <https://freeswitch.org/jira>! | Reddit: /r/freeswitch <https://www.reddit.com/r/freeswitch> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *Skype:*briankwest
On 28.02.2017 12:29, Siju Nair wrote:
in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
I see this in logs. I just dig the IP and ban it. ngrep is the help. -- Mimiko desu.
participants (15)
-
Antonio Silva
-
Brian :
-
Brian West
-
David Villasmil
-
jay binks
-
jungle Boogie
-
Ken Rice
-
Michael Jerris
-
Mimiko
-
Russell Treleaven
-
Sergey Safarov
-
Shaun Stokes
-
Siju Nair
-
Steven Ayre
-
Tristan Mahé