<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} .ms-cui-menu {background-color:#ffffff;border:1px rgb(171, 171, 171) solid;font-family:'Segoe UI WPC', 'Segoe UI', Tahoma, 'Microsoft Sans Serif', Verdana, sans-serif;font-size:11pt;color:rgb(51, 51, 51);} .ms-cui-menusection-title {display:none;} .ms-cui-ctl {vertical-align:text-top;text-decoration:none;color:rgb(51, 51, 51);} .ms-cui-ctl-on {background-color:rgb(223, 237, 250);opacity: 0.8;} .ms-cui-img-cont-float {display:inline-block;margin-top:2px} .ms-cui-smenu-inner {padding-top:0px;} .ms-owa-paste-option-icon {margin: 2px 4px 0px 4px;vertical-align:sub;padding-bottom: 2px;display:inline-block;} .ms-rtePasteFlyout-option:hover {background-color:rgb(223, 237, 250) !important;opacity:1 !important;} .ms-rtePasteFlyout-option {padding:8px 4px 8px 4px;outline:none;} .ms-cui-menusection {float:left; width:85px;height:24px;overflow:hidden}--></style>
</head>
<body>
<div style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>If you have a small Asterisk installation install the free version of SecAst:<br>
</p>
<p><a href="http://www.voip-info.org/wiki/view/SecAst+(Asterisk+Intrusion+Detection+and+Prevention)">http://www.voip-info.org/wiki/view/SecAst+(Asterisk+Intrusion+Detection+and+Prevention)</a><br>
</p>
<p><br>
</p>
<p style="font-family: calibri, arial, helvetica, sans-serif; font-size: 16.363636016845703px;">
For general Asterisk security info check this out:<br>
</p>
<p style="font-family: calibri, arial, helvetica, sans-serif; font-size: 16.363636016845703px;">
<a href="http://www.voip-info.org/wiki/view/Asterisk+security">http://www.voip-info.org/wiki/view/Asterisk+security</a><br>
</p>
<div><br>
</div>
<p>-=Michelle=-<br>
</p>
<p><br style="font-size: 10pt;">
</p>
<p><span style="font-size: 10pt;">All opinions posted are my own, and do not necessarily reflect those of my employer. As an employee of GenerationD my opions are serious biased :)</span><br>
</p>
<p><br>
</p>
<div style="color: #282828;">
<hr tabindex="-1" style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;"><b>From:</b> asterisk-users-bounces@lists.digium.com <asterisk-users-bounces@lists.digium.com> on behalf of Anurag Rana <anuragrana31189@gmail.com><br>
<b>Sent:</b> Friday, June 27, 2014 10:49 AM<br>
<b>To:</b> Prakash N<br>
<b>Cc:</b> Asterisk Users List<br>
<b>Subject:</b> Re: [asterisk-users] Attack on Sip server.</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
I added bot rules TCP as well as UDP. Still not working.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
How changing SIP listen port will prevent it. Please explain.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
I will try fail2band.</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Jun 27, 2014 at 8:16 PM, Prakash N <span dir="ltr">
<<a href="mailto:prakash.n@tevatel.com" target="_blank">prakash.n@tevatel.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: #cccccc; border-left-style: solid; padding-left: 1ex;">
<div>
<div>
<div style="font-size: 11pt; font-family: calibri, sans-serif;">Hi,<br>
<br>
Install fail2band and change sip listen port to avoid attack<br>
<br>
With regards <br>
<span class="HOEnZb"><font color="#888888"><br>
N.Prakash</font></span></div>
</div>
<span class="HOEnZb"><font color="#888888">
<div dir="ltr">
<hr>
<span style="font-size: 11pt; font-family: calibri, sans-serif; font-weight: bold;">From:
</span><span style="font-size: 11pt; font-family: calibri, sans-serif;"><a href="mailto:anuragrana31189@gmail.com" target="_blank">Anurag Rana</a></span><br>
<span style="font-size: 11pt; font-family: calibri, sans-serif; font-weight: bold;">Sent:
</span><span style="font-size: 11pt; font-family: calibri, sans-serif;">27-06-2014 08:07 PM</span><br>
<span style="font-size: 11pt; font-family: calibri, sans-serif; font-weight: bold;">To:
</span><span style="font-size: 11pt; font-family: calibri, sans-serif;"><a href="mailto:asterisk-users@lists.digium.com" target="_blank">Asterisk Users Mailing List - Non-Commercial Discussion</a></span><br>
<span style="font-size: 11pt; font-family: calibri, sans-serif; font-weight: bold;">Subject:
</span><span style="font-size: 11pt; font-family: calibri, sans-serif;">[asterisk-users] Attack on Sip server.</span><br>
<br>
</div>
</font></span></div>
<div class="HOEnZb">
<div class="h5">
<div dir="ltr">
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br clear="all">
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
Hi All.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
Someone is attacking on my SIP server.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
There are lot of requests coming in and I am not able to stop it because I am unable to detect the IP address. </div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
I used wireshark to capture the packets.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
Although I am using very strong password for my SIP users but still is there any way to drop these packets and stop this attack.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
I tried dropping packet after matching some string (most of the packets from attacker contains string 'VaxSIPUserAgent/3.1' ) but it failed. Packets are still flowing in. </div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif;">
<pre style="font-size: medium;"><font color="#0000ff">iptables -I INPUT 1 -p tcp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm -j DROP</font></pre>
</div>
<div><br>
</div>
<div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
Its something like this</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif;"><font color="#0000ff">Registration from '"30" <sp:30@my_public_ip:5060> failed for '192.168.xxx.xxx:6373' - Wrong Password</font></div>
<br>
</div>
<div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
and there are approx 10 request per minute of this type.</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
<br>
</div>
<div class="gmail_default" style="font-family: verdana, sans-serif; color: #000000;">
Please suggest some way to stop this.</div>
<br>
</div>
<div><br>
</div>
-- <br>
<div dir="ltr"><span style="background-color: #ffffff;"><font face="garamond,serif" style="font-family: georgia, serif;"><font size="4"><font size="4"><font face="verdana,sans-serif"><font>Anurag Rana
<br>
<font size="1"><span style="color: #38761d;"><a href="http://newbie42.blogspot.in/" target="_blank">http://newbie42.blogspot.in/</a></span><br>
<span style="color: #6aa84f;">On the trampoline of life's experiences, Striving towards a saintly life in the midst of these materialistic turbulences.</span></font><br>
</font><br>
</font></font></font></font></span>
<div><span style="background-color: #ffffff;"><font face="garamond,serif" style="font-family: georgia, serif;"><br>
</font></span></div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr"><span style="background-color: #ffffff;"><font face="garamond,serif" style="font-family: georgia, serif;"><font size="4"><font size="4"><font face="verdana,sans-serif"><font>Anurag Rana
<br>
<font size="1"><span style="color: #38761d;"><a href="http://newbie42.blogspot.in/" target="_blank">http://newbie42.blogspot.in/</a></span><br>
<span style="color: #6aa84f;">On the trampoline of life's experiences, Striving towards a saintly life in the midst of these materialistic turbulences.</span></font><br>
</font><br>
</font></font></font></font></span>
<div><span style="background-color: #ffffff;"><font face="garamond,serif" style="font-family: georgia, serif;"><br>
</font></span></div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>