[Freeswitch-users] SIP attack SPA2102
jleung at v10networks.ca
Mon Jul 15 11:01:40 MSD 2013
More than likely somebody used the UA string from a SPA2102 instead of their
default SIPVicious UA string which btw gets blocked anyways at the firewall
> -----Original Message-----
> From: freeswitch-users-bounces at lists.freeswitch.org [mailto:freeswitch-
> users-bounces at lists.freeswitch.org] On Behalf Of Miha
> Sent: Sunday, July 14, 2013 11:38 PM
> To: FreeSWITCH Users Help
> Subject: [Freeswitch-users] SIP attack SPA2102
> last night we noticed SIP attack from one of our costumar. Interesting
> that the call come from Linksys SPA2012 which was behind NAT.
> The port forward was made for web access(xxx.xxx.xxx.xxx:8099).
> How it is possible do call from SPA2012 (relay calls)? I am looking at SPA
> do not see any of that options. How SIP traffic could be send to SPA from
> which calls was send as there was no SIP port fwd on router?
> The device from which calls was send is SPA2012.
> THank you very much for all explenation!!!
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> Official FreeSWITCH Sites
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
Join us at ClueCon 2011 Aug 9-11, 2011
More information about the FreeSWITCH-users