OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it? On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO <n0pco@darnsimple.net> wrote:
As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things.
-----------------
Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from.
Look for SECURITY[numbercode] there should be some ip addresses on the same line.
You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address.
Do you know how to set up the iptable rules?
------------------
It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run.
Mars
On 06/27/2014 11:59 AM, Robert Newberry wrote:
Can anyone tell me what this means in my CLI?
[Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI>
So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server?
Thank you
I also googled the IP and I'm coming up with India...slightly confused on that. On Fri, Jun 27, 2014 at 2:57 PM, Robert Newberry <N1XBM@amsat.org> wrote:
OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it?
On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO <n0pco@darnsimple.net
wrote:
As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things.
-----------------
Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from.
Look for SECURITY[numbercode] there should be some ip addresses on the same line.
You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address.
Do you know how to set up the iptable rules?
------------------
It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run.
Mars
On 06/27/2014 11:59 AM, Robert Newberry wrote:
Can anyone tell me what this means in my CLI?
[Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI>
So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server?
Thank you
I would block the IP address using iptables On Fri, Jun 27, 2014 at 2:02 PM, Robert Newberry <N1XBM@amsat.org> wrote:
I also googled the IP and I'm coming up with India...slightly confused on that.
On Fri, Jun 27, 2014 at 2:57 PM, Robert Newberry <N1XBM@amsat.org> wrote:
OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it?
On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO < n0pco@darnsimple.net> wrote:
As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things.
-----------------
Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from.
Look for SECURITY[numbercode] there should be some ip addresses on the same line.
You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address.
Do you know how to set up the iptable rules?
------------------
It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run.
Mars
On 06/27/2014 11:59 AM, Robert Newberry wrote:
Can anyone tell me what this means in my CLI?
[Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI>
So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server?
Thank you
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
OK thru some googling and reading help files I've blocked the IP address. I then used iptables -L to verify I did it. I will monitor the CLI and see if the see if the attempts keep coming. Thank you On Fri, Jun 27, 2014 at 3:02 PM, Robert Newberry <N1XBM@amsat.org> wrote:
I also googled the IP and I'm coming up with India...slightly confused on that.
On Fri, Jun 27, 2014 at 2:57 PM, Robert Newberry <N1XBM@amsat.org> wrote:
OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it?
On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO < n0pco@darnsimple.net> wrote:
As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things.
-----------------
Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from.
Look for SECURITY[numbercode] there should be some ip addresses on the same line.
You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address.
Do you know how to set up the iptable rules?
------------------
It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run.
Mars
On 06/27/2014 11:59 AM, Robert Newberry wrote:
Can anyone tell me what this means in my CLI?
[Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI>
So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server?
Thank you
Also add alwaysauthreject=yes allowguest=no in your sip.conf file under [general] Fail2ban updates your iptables based on the ipaddresses of stuff trying to access your sip port without success. Scott From: app_rpt-users-bounces@ohnosec.org [mailto:app_rpt-users-bounces@ohnosec.org] On Behalf Of Robert Newberry Sent: Friday, June 27, 2014 3:10 PM To: n0pco@darnsimple.net; app_rpt-users@ohnosec.org Subject: Re: [App_rpt-users] CLI help OK thru some googling and reading help files I've blocked the IP address. I then used iptables -L to verify I did it. I will monitor the CLI and see if the see if the attempts keep coming. Thank you On Fri, Jun 27, 2014 at 3:02 PM, Robert Newberry <N1XBM@amsat.org <mailto:N1XBM@amsat.org> > wrote: I also googled the IP and I'm coming up with India...slightly confused on that. On Fri, Jun 27, 2014 at 2:57 PM, Robert Newberry <N1XBM@amsat.org <mailto:N1XBM@amsat.org> > wrote: OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it? On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO <n0pco@darnsimple.net <mailto:n0pco@darnsimple.net> > wrote: As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things. ----------------- Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from. Look for SECURITY[numbercode] there should be some ip addresses on the same line. You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address. Do you know how to set up the iptable rules? ------------------ It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run. Mars On 06/27/2014 11:59 AM, Robert Newberry wrote: Can anyone tell me what this means in my CLI? [Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI> So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server? Thank you
On 6/27/14 3:02 PM, Robert Newberry wrote:
I also googled the IP and I'm coming up with India...slightly confused on that.
IP spoofing...you can't trust crafted packets trying to pwn your system. Seems like someone is trying, as KB2EAR said, to use your SIP connection to the PSTN to make free phone calls. If you don't need sip exposed to the outside, turn it off at the router. Rule of thumb: anything you expose to the network will be abused someday. -- Bryan In this world, you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant. You may quote me. Sent from my MacBook Pro.
participants (4)
-
Bryan D. Boyle -
Michael Hebert -
Robert Newberry -
Scott Weis