[Freeswitch-users] Hacker Attack?

[Joao Leme]

Thanks Cliff, but I haven't had this problem for almost 2 weeks now (since I
updated FS (again) to the latest GIT, even though FS version seems to have
nothing to do with it). I wanted to remove DMZ but I can't get around the NO
SOUND problem when connecting from outside the local network (I opened
another thread for that but no solution so far from my end).
Thanks,
John

On Mon, Feb 14, 2011 at 10:27 AM, Cliff Wells <cliff at develix.com> wrote:

> On Sat, 2011-01-29 at 15:39 -0800, Joao Leme wrote:
> > I just downloaded and compiled the latest Git and a little after
> > starting freeswitch I'm getting non stop the following:
> >
> >
> > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia
> > profile ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
>
> > it's non-stop and doesn't let me do nothing else. After the first time
> > I went on to vars and changed the 1234 password....restarted and same
> > thing happened, I also try denying the ip on acl.conf (not sure if has
> > something to do with it but gave it a try):
>
> It seems obvious, but since no one else mentioned it, I will: have you
> tried contacting the owner of attacking machine?   Chances are it's a
> compromised machine and the owner is unaware of the situation.   I
> experienced the same thing about a week ago, did a WHOIS lookup on the
> IP, contacted the owner who was quite grateful to be alerted of the
> issue, and had it resolved pretty quickly.
>
> As an aside, if the script that's attacking you is the same one that was
> attacking me, it won't stop once you setup the iptables rule.  In my
> case it continued to send over 1Mbit/s of registration attempts even
> when it could no longer connect (as measured by pfSense).
>
> Regards,
> Cliff
>
>
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20110214/eea23944/attachment.html