<div dir="ltr"><div class="gmail_default" style="color:#660000">But does the brute force speed limit enforced as a limitation of the protocol, or the implementation of iax2-brute waiting for the failure of one request before starting another?</div>
<div class="gmail_default" style="color:#660000"><br></div><div class="gmail_default" style="color:#660000">Inotherwords, is it possible to have multiple simultaneous authorization requests pending (i.e. performed in parallel) without breaking the ability to receive a positive response for a valid password, even if that requires rewriting iax-brute to achieve it? Or even breaking the protocol spec, so long as a positive response to a valid password is still received.</div>
<div class="gmail_default" style="color:#660000"> <br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Nov 12, 2013 at 12:40 AM, Eugene Varnavsky <span dir="ltr"><<a href="mailto:varnavruz@gmail.com" target="_blank">varnavruz@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>A very simple test.<br><br>nmap -sU -p 4569 --script iax2-brute 192.168.1.19<br><br></div>With delayreject=no:<br>
<div><br>| iax2-brute: <br>| Accounts<br>| No valid accounts found<br>| Statistics<br>
| Performed 1964 guesses in 7 seconds, average tps: 280<br>| <br>|_ ERROR: Too many retries, aborted ...<br><br></div><div>With delayreject=yes:<br><br>| iax2-brute: <br>| Accounts<br>| No valid accounts found<br>
| Statistics<br>| Performed 10 guesses in 1 seconds, average tps: 10<br>| <br>|_ ERROR: Too many retries, aborted ...<br></div><div><div><div class="gmail_extra"><br></div><div class="gmail_extra">So, in short, delayreject=yes DOES help to protect against brute force attacks.<br>
</div><div class="im"><div class="gmail_extra"><br><div class="gmail_quote">2013/11/12 Scott Griepentrog <span dir="ltr"><<a href="mailto:sgriepentrog@digium.com" target="_blank">sgriepentrog@digium.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div style="color:rgb(102,0,0)">Does the delayed reply also delay the next auth request from being processed? I'm not familiar enough with the protocol to know if overlapping requests are prevented. If not, then an attacker simply ignores all negative responses regardless of delay and looks for a positive response, negating any benefit by using delayreject.</div>
</div><div class="gmail_extra"><div><div><br><br></div></div></div></blockquote></div></div></div></div></div></div>
<br>--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
<br>
asterisk-dev mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-dev" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-dev</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">
<img alt="Digium logo" src="https://my.digium.com/images/graphics/digium_RGB_signature.gif" width="288" height="50" style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<strong style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Scott Griepentrog</strong><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"><span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Digium, Inc · Software Developer</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">445 Jan Davis Drive NW · Huntsville, AL 35806 · US</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">direct/fax: +1 256 428 6239 · mobile: +1 317 507 4029</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Check us out at: </span><a href="http://www.digium.com" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" target="_blank">http://digium.com</a><span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"> · </span><a href="http://www.asterisk.org" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" target="_blank">http://asterisk.org</a><br>
</div>
</div>