<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Change your SIP port to something completely weird and non-standard<br>(from 5060). You'll likely never hear from whoever it is again.<br><br>Sometimes "security by obscurity" really *does* effectively function.<br><br>Jim<br><br><div>> Date: Sun, 23 Jun 2013 13:57:40 -0600<br>> From: kb0kzr@matthouse.com<br>> To: app_rpt-users@ohnosec.org<br>> Subject: [App_rpt-users] Bogus SIP registrations<br>> <br>> All--<br>> <br>> While diagnosing another problem (which I will post about in a little bit<br>> if I can't get it figured out, but I wanted to keep separate threads<br>> separate) -- suddenly somebody started sending me a ton of bogus SIP<br>> registrations. The source-IP is 210.73.202.76 for whatever that may be<br>> worth. I thought about firewalling it, but I don't think SIP is required<br>> at all for app_rpt to work? So I disabled chan_sip entirely in<br>> modules.conf.<br>> <br>> Just throwing it out there as something to consider for other app_rpt<br>> nodes... I don't know of any security flaws in chan_sip, but I figured<br>> since it isn't being used there's no reason to run it.<br>> <br>> -Matt-<br>> <br>> _______________________________________________<br>> App_rpt-users mailing list<br>> App_rpt-users@ohnosec.org<br>> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users<br></div> </div></body>
</html>