<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=us-ascii" http-equiv="Content-Type">
</head>
<body bgcolor="#ccffff" text="#000000">
I confess. They hit me too - yesterday. I had a security hole they
could drive a truck through, and they apparently used port 5060 to fish
for a local extension they could masquerade as. Then they started
calling out with one of my caller IDs. Within minutes I was deluged
with calls from puzzled people.<br>
<br>
After blocking them, I redirected incoming calls to this DID to a
recorded explanation and apology. Then I sent a broadcast to the 281
logged out-dial numbers with a similar message.<br>
<br>
So, heads up.<br>
<br>
FWIW, I was hit by these IPs:<br>
<br>
84.126.205.1<br>
78.157.193.103<br>
<br>
It would seem that we all might gain from cooperative work here. Also,
can we share the FBI contact? I was going to call the FBI, but
figured it would be a waste of time just getting through the
bureaucracy to the right person.<br>
<br>
I didn't capture the audio. Did the verbiage contain a spoken return
call #? I was getting responses based on caller ID, and I'm wondering
if the perpetrator expected to take return calls via the bogus SIP
registration or via another channel.<br>
<br>
<br>
Matt Gibson wrote:
<blockquote cite="mid:49a85f3a.0baa660a.6a82.7742@mx.google.com"
type="cite">
<pre wrap="">Same here, but about 3 months ago. Luckily I was able to stop it after about
30 minutes, but they still got about 100 calls out, I got a lot of calls
back from little old ladies wanting to give me their credit card info, scary
stuff.
</pre>
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:asterisk-biz-bounces@lists.digium.com">asterisk-biz-bounces@lists.digium.com</a> [<a class="moz-txt-link-freetext" href="mailto:asterisk-biz">mailto:asterisk-biz</a>-
<a class="moz-txt-link-abbreviated" href="mailto:bounces@lists.digium.com">bounces@lists.digium.com</a>] On Behalf Of C. Savinovich
Sent: Friday, February 27, 2009 4:18 PM
To: 'Commercial and Business-Oriented Asterisk Discussion'
Subject: Re: [asterisk-biz] Fraud alert
It seems to be the same pattern of people who attacked 3 of my
servers in
a 3 week period a couple of weeks ago. The calls were made mostly to
area
codes 252 and 818 and indeed they showed the caller-id of the phones.
My
customer claims he received a call from the FBI saying that the calls
were
credit card solicitations. The point is, whoever is doing this, is
doing
this massively.
CS
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:asterisk-biz-bounces@lists.digium.com">asterisk-biz-bounces@lists.digium.com</a>
[<a class="moz-txt-link-freetext" href="mailto:asterisk-biz-bounces@lists.digium.com">mailto:asterisk-biz-bounces@lists.digium.com</a>] On Behalf Of
<a class="moz-txt-link-abbreviated" href="mailto:voip-asterisk@maximumcrm.com">voip-asterisk@maximumcrm.com</a>
Sent: Friday, February 27, 2009 4:04 PM
To: Commercial and Business-Oriented Asterisk Discussion
Subject: Re: [asterisk-biz] Fraud alert
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">I'd suggest to everyone to ban that IP, it's been scanning our
</pre>
</blockquote>
</blockquote>
<pre wrap="">networks
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">from time to time, in a sequential manner by IP.
</pre>
</blockquote>
<pre wrap="">I've had really good luck with this:
<a class="moz-txt-link-freetext" href="http://www.voip">http://www.voip</a>-
</pre>
</blockquote>
<pre wrap="">info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
</pre>
<blockquote type="cite">
<pre wrap="">Basically, it automatically blackhols via IPtables any host that
</pre>
</blockquote>
<pre wrap="">fails a
</pre>
<blockquote type="cite">
<pre wrap="">certain number of registration attempts in a given period.
</pre>
</blockquote>
<pre wrap="">Yeah we're actually rolling it out on all of our production servers,
it's
a great application to run.
I'm working on some scripts to propagate the bans to the firewall so
that
all of the servers get protected as soon as possible.
</pre>
<blockquote type="cite">
<pre wrap="">[default]
; Send any unauthenticated calls to the local FBI office
context=local-fbi-office
I've got a honeypot server that pretty much accepts any calls that
</pre>
</blockquote>
<pre wrap="">come
</pre>
<blockquote type="cite">
<pre wrap="">through, and plays a "Thank you for calling the Telecommunications
</pre>
</blockquote>
<pre wrap="">Fraud
</pre>
<blockquote type="cite">
<pre wrap="">hotline. Please stay online for the next available representative."
</pre>
</blockquote>
<pre wrap="">If
they
</pre>
<blockquote type="cite">
<pre wrap="">stay online for more than 20 seconds, it connects them to an agent at
</pre>
</blockquote>
<pre wrap="">the
</pre>
<blockquote type="cite">
<pre wrap="">FBI that we have been working with.
I've been meaning to add some code in that pulls out the originating
</pre>
</blockquote>
<pre wrap="">IP
</pre>
<blockquote type="cite">
<pre wrap="">address of the call and tells it to the agent when we call. :)
</pre>
</blockquote>
<pre wrap="">That would be great to have!
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
<pre wrap=""><!---->
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
<br>
</body>
</html>