Ones I had problems with were coming from a small island in Japan. Every time they would get close to finding my SIP phone number I would move it. I was playing with them for a while. Once I got tired I just moved the SIP port and haven't had a problem since. I wanted to watch their search method for a while before I killed them off. Both of them used a different approach to discovery. Bill Hurlock From: Jim Duuuude [mailto:telesistant@hotmail.com] Sent: Friday, July 12, 2013 1:21 PM To: Dwaine Garden VE3GIF; Bill Hurlock Cc: app_rpt mailing list Subject: RE: [App_rpt-users] App_rpt-users Digest, Vol 52, Issue 31 Before you start accusing people of "hacking from China", remember that most of these SIP 'probing' attacks (where they go through a 'list' of extensions to see if they 'get a call through') are 'done' from systems that, themselves, were compromised. Certainly, a good number of them seem to come from a Chinese-type location, but I have seen others "infected" with this problem in a number of places other then China, including, in one case, here in the US, and it was "attacking" a system on the same ISP (gee, that was "easy" to "find and fix"). Another one I had to "deal with" (also here in the US) ironically was itself a SIP server/gateway (*not* on port 5060), that got "compromised" to run "attack scripts" to other servers on port 5060. As you can see, irony can be very ironic sometimes :-). Perhaps China is a good place for these "hackers" to find systems that are run by people that are unaware of "what's happening" with them. In any case, since these "scripts" seem to only be "interested" in SIP servers running on port 5060, changing the port seems to be a REALLY good way to "not have the problem anymore". Jim
Date: Fri, 12 Jul 2013 13:07:06 -0400 From: DwaineGarden@rogers.com<mailto:DwaineGarden@rogers.com> To: bill.hurlock@cpcomms.com<mailto:bill.hurlock@cpcomms.com> CC: app_rpt-users@ohnosec.org<mailto:app_rpt-users@ohnosec.org> Subject: Re: [App_rpt-users] App_rpt-users Digest, Vol 52, Issue 31
I'm going to try that... The hackers from China keep pounding the server non stop.
Bill Hurlock <bill.hurlock@cpcomms.com<mailto:bill.hurlock@cpcomms.com>> wrote:
I had the same problem and the solution I used, because I use SIP, was to change the default SIP port to a non standard port which stopped all the bogus junk from happening.
Bill Hurlock
-----Original Message----- From: app_rpt-users-bounces@ohnosec.org<mailto:app_rpt-users-bounces@ohnosec.org> [mailto:app_rpt-users-bounces@ohnosec.org] On Behalf Of app_rpt-users-request@ohnosec.org<mailto:app_rpt-users-request@ohnosec.org> Sent: Sunday, June 23, 2013 6:43 PM To: app_rpt-users@ohnosec.org<mailto:app_rpt-users@ohnosec.org> Subject: App_rpt-users Digest, Vol 52, Issue 31
Send App_rpt-users mailing list submissions to app_rpt-users@ohnosec.org<mailto:app_rpt-users@ohnosec.org>
To subscribe or unsubscribe via the World Wide Web, visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users or, via email, send a message with subject or body 'help' to app_rpt-users-request@ohnosec.org<mailto:app_rpt-users-request@ohnosec.org>
You can reach the person managing the list at app_rpt-users-owner@ohnosec.org<mailto:app_rpt-users-owner@ohnosec.org>
When replying, please edit your Subject line so it is more specific than "Re: Contents of App_rpt-users digest..." _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org<mailto:App_rpt-users@ohnosec.org> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
App_rpt-users mailing list App_rpt-users@ohnosec.org<mailto:App_rpt-users@ohnosec.org> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users