<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ones I had problems with were coming from a small island in Japan. Every time they would get close to finding my SIP phone number I would move it. I was playing
with them for a while. Once I got tired I just moved the SIP port and haven’t had a problem since. I wanted to watch their search method for a while before I killed them off. Both of them used a different approach to discovery.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#17365D">Bill Hurlock<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Jim Duuuude [mailto:telesistant@hotmail.com]
<br>
<b>Sent:</b> Friday, July 12, 2013 1:21 PM<br>
<b>To:</b> Dwaine Garden VE3GIF; Bill Hurlock<br>
<b>Cc:</b> app_rpt mailing list<br>
<b>Subject:</b> RE: [App_rpt-users] App_rpt-users Digest, Vol 52, Issue 31<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Calibri","sans-serif"">Before you start accusing people of "hacking from China", remember that most of these SIP<br>
'probing' attacks (where they go through a 'list' of extensions to see if they 'get a call through')<br>
are 'done' from systems that, themselves, were compromised. <br>
<br>
Certainly, a good number of them seem to come from a Chinese-type location, but I have seen
<br>
others "infected" with this problem in a number of places other then China, including, in one case,<br>
here in the US, and it was "attacking" a system on the same ISP (gee, that was "easy" to
<br>
"find and fix").<br>
<br>
Another one I had to "deal with" (also here in the US) ironically was itself a SIP server/gateway<br>
(*not* on port 5060), that got "compromised" to run "attack scripts" to other servers on port 5060.<br>
As you can see, irony can be very ironic sometimes :-).<br>
<br>
Perhaps China is a good place for these "hackers" to find systems that are run by people<br>
that are unaware of "what's happening" with them.<br>
<br>
In any case, since these "scripts" seem to only be "interested" in SIP servers running on port 5060,<br>
changing the port seems to be a REALLY good way to "not have the problem anymore".<br>
<br>
Jim<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri","sans-serif"">> Date: Fri, 12 Jul 2013 13:07:06 -0400<br>
> From: <a href="mailto:DwaineGarden@rogers.com">DwaineGarden@rogers.com</a><br>
> To: <a href="mailto:bill.hurlock@cpcomms.com">bill.hurlock@cpcomms.com</a><br>
> CC: <a href="mailto:app_rpt-users@ohnosec.org">app_rpt-users@ohnosec.org</a><br>
> Subject: Re: [App_rpt-users] App_rpt-users Digest, Vol 52, Issue 31<br>
> <br>
> I'm going to try that... The hackers from China keep pounding the server non stop.
<br>
> <br>
> Bill Hurlock <<a href="mailto:bill.hurlock@cpcomms.com">bill.hurlock@cpcomms.com</a>> wrote:<br>
> <br>
> >I had the same problem and the solution I used, because I use SIP, was to change the default SIP port to a non standard port which stopped all the bogus junk from happening.<br>
> ><br>
> >Bill Hurlock<br>
> ><br>
> >-----Original Message-----<br>
> >From: <a href="mailto:app_rpt-users-bounces@ohnosec.org">app_rpt-users-bounces@ohnosec.org</a> [<a href="mailto:app_rpt-users-bounces@ohnosec.org">mailto:app_rpt-users-bounces@ohnosec.org</a>] On Behalf Of
<a href="mailto:app_rpt-users-request@ohnosec.org">app_rpt-users-request@ohnosec.org</a><br>
> >Sent: Sunday, June 23, 2013 6:43 PM<br>
> >To: <a href="mailto:app_rpt-users@ohnosec.org">app_rpt-users@ohnosec.org</a><br>
> >Subject: App_rpt-users Digest, Vol 52, Issue 31<br>
> ><br>
> >Send App_rpt-users mailing list submissions to<br>
> > <a href="mailto:app_rpt-users@ohnosec.org">app_rpt-users@ohnosec.org</a><br>
> ><br>
> >To subscribe or unsubscribe via the World Wide Web, visit<br>
> > <a href="http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users">http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users</a><br>
> >or, via email, send a message with subject or body 'help' to<br>
> > <a href="mailto:app_rpt-users-request@ohnosec.org">app_rpt-users-request@ohnosec.org</a><br>
> ><br>
> >You can reach the person managing the list at<br>
> > <a href="mailto:app_rpt-users-owner@ohnosec.org">app_rpt-users-owner@ohnosec.org</a><br>
> ><br>
> >When replying, please edit your Subject line so it is more specific than "Re: Contents of App_rpt-users digest..."<br>
> >_______________________________________________<br>
> >App_rpt-users mailing list<br>
> ><a href="mailto:App_rpt-users@ohnosec.org">App_rpt-users@ohnosec.org</a><br>
> ><a href="http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users">http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users</a><br>
> _______________________________________________<br>
> App_rpt-users mailing list<br>
> <a href="mailto:App_rpt-users@ohnosec.org">App_rpt-users@ohnosec.org</a><br>
> <a href="http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users">http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users</a><o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>