Hi Vijay,<br><br>It is very common to see hackers coming from IP addresses belonging to reputable companies. But this doesn't mean that those companies themselves are involved in these hack attempts. They can't control who misuses their IP addresses, but usually they do try their best to block such attempts. The problem is that many times these IP addresses belong to compromised servers, and the server owners themselves don't even know that their servers are being misused by hackers.<br>
<br>The only way to fight such hack attempts is to implement security measures on your own end. I have learned it the hard way, because my Asterisk servers have been hacked a few times in last few years, and I have worked with clients who faced the same issue. I usually send email to the owners of these IP addresses, which you can find from whois database, but never ever got any reply back from anyone. I know they can't do much either as I have worked in NOCs of some serious ISPs. Hackers change the IP addresses very easily, as they know that they can't do their dirty job from one single IP address.<br>
<br>If you want to implement some security on your server, I would suggest to start wit fail2ban. Download it from <a href="http://fail2ban.org">fail2ban.org</a>, spend some time on their wiki, and also set it up for asterisk as described in <a href="http://www.voip-info.org/wiki/view/Fail2Ban+%28with+iptables%29+And+Asterisk">http://www.voip-info.org/wiki/view/Fail2Ban+%28with+iptables%29+And+Asterisk</a>. It is a really good utility. Another good idea is to change default ports of the most commonly used software, and also block ports which you don't use.<br>
<br>Regards,<br><br>-- <br>Zeeshan A Zakaria<br><br><div class="gmail_quote">On Sun, Oct 4, 2009 at 5:15 PM, Vijay Gandhi <span dir="ltr"><<a href="mailto:vijay@gandhiinfotech.com">vijay@gandhiinfotech.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">My first attempt is to get the response from Voxalot only and few of my<br>
emails were sent around a month back to them, when my switch was hacked at<br>
first, but since then, I have not received any reply back from them.<br>
<br>
<br>
Regards<br>
<font color="#888888"><br>
Vijay Gandhi<br>
</font><div class="im"><br>
<br>
-----Original Message-----<br>
From: <a href="mailto:asterisk-biz-bounces@lists.digium.com">asterisk-biz-bounces@lists.digium.com</a><br>
</div><div class="im">[mailto:<a href="mailto:asterisk-biz-bounces@lists.digium.com">asterisk-biz-bounces@lists.digium.com</a>] On Behalf Of SIP<br>
Sent: Monday, October 05, 2009 2:04 AM<br>
To: Commercial and Business-Oriented Asterisk Discussion<br>
Subject: Re: [asterisk-biz] Hacking the network<br>
<br>
</div><div><div></div><div class="h5">We've had some issues with users coming in from Voxalot IPs as well. Was<br>
suspicious calling patterns and traffic, but Voxalot was very responsive<br>
in helping us track things down. I seriously doubt they're ignoring<br>
response emails. It's Sunday in the US, and many smaller companies run<br>
limited support staff.<br>
<br>
N.<br>
<br>
Nir Simionovich wrote:<br>
> Vijay,<br>
><br>
> Voxalot is one of the more respected and veteran companies in this<br>
> sector, I doubt it<br>
> if they had personally been in charge of the hack attach you are<br>
> describing. If you are<br>
> going to publicly claim that a certain company hacked your systems, I<br>
> suggest that you<br>
> be able to back it up by some proper proof - or Voxalot may want to<br>
> sue you for slander.<br>
><br>
> Nir S<br>
><br>
> On Sun, Oct 4, 2009 at 5:53 PM, Nitzan Kon <<a href="mailto:nk3569@yahoo.com">nk3569@yahoo.com</a><br>
> <mailto:<a href="mailto:nk3569@yahoo.com">nk3569@yahoo.com</a>>> wrote:<br>
><br>
> Just LOL!<br>
><br>
> --- On Sun, 10/4/09, Vijay Gandhi <<a href="mailto:vijay@gandhiinfotech.com">vijay@gandhiinfotech.com</a><br>
> <mailto:<a href="mailto:vijay@gandhiinfotech.com">vijay@gandhiinfotech.com</a>>> wrote:<br>
><br>
> > Wanted to update everyone, that IP 64.34.173.199<br>
> > belong to a company Voxalot, they have hacked our system<br>
> > twice and they don't<br>
> > even care to reply to any emails sent to them, and they<br>
> > don't even<br>
> > respond over the phone, beware of them.<br>
><br>
><br>
> _______________________________________________<br>
> --Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
><br>
> AstriCon 2009 - October 13 - 15 Phoenix, Arizona<br>
> Register Now: <a href="http://www.astricon.net" target="_blank">http://www.astricon.net</a><br>
><br>
> asterisk-biz mailing list<br>
> To UNSUBSCRIBE or update options visit:<br>
> <a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br>
><br>
><br>
> ------------------------------------------------------------------------<br>
><br>
> _______________________________________________<br>
> --Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
><br>
> AstriCon 2009 - October 13 - 15 Phoenix, Arizona<br>
> Register Now: <a href="http://www.astricon.net" target="_blank">http://www.astricon.net</a><br>
><br>
> asterisk-biz mailing list<br>
> To UNSUBSCRIBE or update options visit:<br>
> <a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br>
<br>
<br>
_______________________________________________<br>
--Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
<br>
AstriCon 2009 - October 13 - 15 Phoenix, Arizona<br>
Register Now: <a href="http://www.astricon.net" target="_blank">http://www.astricon.net</a><br>
<br>
asterisk-biz mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br>
<br>
_______________________________________________<br>
--Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
<br>
AstriCon 2009 - October 13 - 15 Phoenix, Arizona<br>
Register Now: <a href="http://www.astricon.net" target="_blank">http://www.astricon.net</a><br>
<br>
asterisk-biz mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br>
</div></div></blockquote></div><br><br clear="all"><br>