Hacking Attempts: NOTICE[6719]: chan_sip.c:14418 handle_request_invite:
Hello, I am getting a different type of hacking attempt. Different in the sense that these hacking attempts do not have an IP address associated with them that can be added to iptables and blocked with the linux firewall. These appear to be coming from a sip account that is trying to connect to extensions on my system that does not exist. They range from 1 or 2 attempts each hour, to several hundred requests per hour. Below is a copy of the most recent attempts of this nature and then further below are the attempts that I am familiar with that contain an IP address that just gets added to IP tables and they go away. Can someone help me understand the best way to handle these hacking attempts and how to best secure my system from them? Also, how are these hackers finding my system from all of the millions and millions of IP Addresses on the internet. Does Asterick send out a beacon to some central repository if you will that lists all the IP's of Asterisks systems so that hackers have a list of machines they can try to exploit? Here is a list of what the new hacking attempts look like: [root@KK7XX ~]# asterisk -r Asterisk , Copyright (C) 1999 - 2008 Digium, Inc. and others. Created by Mark Spencer <markster@digium.com> Asterisk comes with ABSOLUTELY NO WARRANTY; type 'core show warranty' for details. This is free software, with components licensed under the GNU General Public License version 2 and other licenses; you are welcome to redistribute it under certain conditions. Type 'core show license' for details. ========================================================================= Connected to Asterisk currently running on KK7XX (pid = 6712) Verbosity is at least 3 KK7XX*CLI> rpt lstats 28806 NODE PEER RECONNECTS DIRECTION CONNECT TIME CONNECT STATE ---- ---- ---------- --------- ------------ ------------- [[Mar 23 22:38:55] NOTICE[6719] chan_sip.c: Call from '' to extension '0012143299739' rejected because extension not found. [Mar 23 22:39:15] WARNING[6719] chan_sip.c: Maximum retries exceeded on transmission 0a86e18b712596ba5ba160f771f680f5 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. [Mar 23 22:47:58] NOTICE[6719] chan_sip.c: Call from '' to extension '000972543480900' rejected because extension not found. [Mar 23 23:20:57] NOTICE[6719] chan_sip.c: Call from '' to extension '00972598998181' rejected because extension not found. [Mar 23 23:20:59] NOTICE[6719] chan_sip.c: Call from '' to extension '011972598998181' rejected because extension not found. [Mar 23 23:21:00] NOTICE[6719] chan_sip.c: Call from '' to extension '1011972598998181' rejected because extension not found. [Mar 23 23:21:02] NOTICE[6719] chan_sip.c: Call from '' to extension '0011972598998181' rejected because extension not found. [Mar 23 23:21:03] NOTICE[6719] chan_sip.c: Call from '' to extension '9011972598998181' rejected because extension not found. [Mar 23 23:21:05] NOTICE[6719] chan_sip.c: Call from '' to extension '+11972598998181' rejected because extension not found. [Mar 23 23:42:19] NOTICE[6719] chan_sip.c: Call from '' to extension '0011442032902187' rejected because extension not found. [Mar 23 23:42:39] WARNING[6719] chan_sip.c: Maximum retries exceeded on transmission 8893e02d7f1d65b9f9e93cb1ce75d147 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. [Mar 23 23:48:09] NOTICE[6719] chan_sip.c: Call from '' to extension '00972543480900' rejected because extension not found. [Mar 24 01:19:41] NOTICE[6719] chan_sip.c: Call from '' to extension '00972598998181' rejected because extension not found.KK7XX*CLI> The above hacking attempts are different from the (what I would call) normal hacking attempts like the following that have an IP address that gets added to iptables and the Linux firewall blocks them: [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9996"< sip:9996@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9997"< sip:9997@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9998"< sip:9998@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9999"< sip:9999@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found Any help anyone has to offer would greatly be appreciated. 73, Luke
These are two different hacks going on. The ones at the bottom, with the IP addresses, are attempts to register a SIP phone to your system, they fail because the extensions they are attempting to register do not exist on your system. The logic is that if they can get a phone registered to an extension then they can (hopefully) make free phone calls. The ones you show at the top of your listing are hackers trying to do the same thing, make free calls, but they are not trying to register a SIP phone but rather going right to trying to make free calls. All those attempts are attempts to dial a foreign country, code 97 (which doesn't exist) but there are several country codes that contain 97, so they may be trying, unsuccessfully, to reach one of them. How they find your system is quite easy; they likely run a port scanning program for standard SIP or IAX ports. Yes, there are millions of IP addresses out there, but a port scanning program can likely scan them all in a relatively short time; weeks or with a fast enough scanning program, maybe days. If you are on one of the larger ISPs they probably target those IP ranges first. The simple fix, at least for the SIP registration attempts, is to block port 5060 at your firewall, but of course this also blocks any valid SIP connections you might have to your system. You could change your SIP port to something other than 5060 but likely they would find it soon enough. Difficult getting around the hackers to be sure. -------------------------------------------- On Tue, 3/24/15, Luke Rohn <rohn.luke@gmail.com> wrote: Subject: [App_rpt-users] Hacking Attempts: NOTICE[6719]: chan_sip.c:14418 handle_request_invite: To: Cc: app_rpt-users@ohnosec.org Date: Tuesday, March 24, 2015, 4:52 AM Hello, I am getting a different type of hacking attempt. Different in the sense that these hacking attempts do not have an IP address associated with them that can be added to iptables and blocked with the linux firewall.These appear to be coming from a sip account that is trying to connect to extensions on my system that does not exist. They range from 1 or 2 attempts each hour, to several hundred requests per hour. Below is a copy of the most recent attempts of this nature and then further below are the attempts that I am familiar with that contain an IP address that just gets added to IP tables and they go away. Can someone help me understand the best way to handle these hacking attempts and how to best secure my system from them?Also, how are these hackers finding my system from all of the millions and millions of IP Addresses on the internet. Does Asterick send out a beacon to some central repository if you will that lists all the IP's of Asterisks systems so that hackers have a list of machines they can try to exploit? Here is a list of what the new hacking attempts look like: [root@KK7XX ~]# asterisk -r Asterisk , Copyright (C) 1999 - 2008 Digium, Inc. and others. Created by Mark Spencer <markster@digium.com> Asterisk comes with ABSOLUTELY NO WARRANTY; type 'core show warranty' for details. This is free software, with components licensed under the GNU General Public License version 2 and other licenses; you are welcome to redistribute it under certain conditions. Type 'core show license' for details. ========================================================================= Connected to Asterisk currently running on KK7XX (pid = 6712) Verbosity is at least 3 KK7XX*CLI> rpt lstats 28806 NODE PEER RECONNECTS DIRECTION CONNECT TIME CONNECT STATE ---- ---- ---------- --------- ------------ ------------- [[Mar 23 22:38:55] NOTICE[6719] chan_sip.c: Call from '' to extension '0012143299739' rejected because extension not found. [Mar 23 22:39:15] WARNING[6719] chan_sip.c: Maximum retries exceeded on transmission 0a86e18b712596ba5ba160f771f680f5 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. [Mar 23 22:47:58] NOTICE[6719] chan_sip.c: Call from '' to extension '000972543480900' rejected because extension not found. [Mar 23 23:20:57] NOTICE[6719] chan_sip.c: Call from '' to extension '00972598998181' rejected because extension not found. [Mar 23 23:20:59] NOTICE[6719] chan_sip.c: Call from '' to extension '011972598998181' rejected because extension not found. [Mar 23 23:21:00] NOTICE[6719] chan_sip.c: Call from '' to extension '1011972598998181' rejected because extension not found. [Mar 23 23:21:02] NOTICE[6719] chan_sip.c: Call from '' to extension '0011972598998181' rejected because extension not found. [Mar 23 23:21:03] NOTICE[6719] chan_sip.c: Call from '' to extension '9011972598998181' rejected because extension not found. [Mar 23 23:21:05] NOTICE[6719] chan_sip.c: Call from '' to extension '+11972598998181' rejected because extension not found. [Mar 23 23:42:19] NOTICE[6719] chan_sip.c: Call from '' to extension '0011442032902187' rejected because extension not found. [Mar 23 23:42:39] WARNING[6719] chan_sip.c: Maximum retries exceeded on transmission 8893e02d7f1d65b9f9e93cb1ce75d147 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. [Mar 23 23:48:09] NOTICE[6719] chan_sip.c: Call from '' to extension '00972543480900' rejected because extension not found. [Mar 24 01:19:41] NOTICE[6719] chan_sip.c: Call from '' to extension '00972598998181' rejected because extension not found.KK7XX*CLI> The above hacking attempts are different from the (what I would call) normal hacking attempts like the following that have an IP address that gets added to iptables and the Linux firewall blocks them: [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9996"<sip:9996@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9997"<sip:9997@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9998"<sip:9998@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found [Mar 21 16:38:31] NOTICE[2855] chan_sip.c: Registration from '"9999"<sip:9999@10.0.0.28:5060>' failed for '62.210.251.151' - No matching peer found Any help anyone has to offer would greatly be appreciated. 73, Luke -----Inline Attachment Follows----- _______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
participants (2)
-
Bill South -
Luke Rohn