January 2011 - VoiceOps - lists.voiceops.org

VoIP Abuse Take Two (or three, maybe even 4-5)
by sil＠infiltrated.net March 17, 2011

March 17, 2011

For those looking for a different type of blacklist or at least one that makes sense, please be sure to browse the VoIP Abuse Black List as things are a slightly different now. VABL looks up an attacker's information via Shadowserver's lookup and appends three new fields: type of attacker, address and the letters VABL (so one can know where and how it ended up on being blacklisted) and a number dialed (when appropriate.) The type of attacker field may make the biggest difference to those who decide to use this list. There are two specific entries that will appear: BRU, ADN and COM. BRU means that the host attempted to bruteforce a PBX while COM signifies that the attacker managed to compromise either a honeypot or a live machine. ADN is when an attacker places a call and is short for Attacker Dialing Numbers. Whenever you see an entry with ADN, there will be an additional field at the end with the number dialed by the attacker appended to it. Here are three entries, a COM (someone who accessed a honeypot with a valid account), a bruteforcer and an ADN (an attacker who accessed a compromised account and tried to place a call the number dialed is pre-pended) 85.214.23.191 | COM | VABL | 6724 | 85.214.0.0/16 | STRATO | DE | STRATOSERVER.NET | STRATO RECHENZENTRUM BERLIN 41.232.96.220 | ADN | VABL | 8452 | 41.232.96.0/22 | TE | EG | TEDATA.NET | AFRINIC | 011251912121891 93.126.35.12 | BRU | VABL | 44375 | 93.126.0.0/18 | AISDP | IR | - | ASMANFARAZ SEPAHAN ISDP Anyhow, the list is maintained as a text file and is updated accordingly (once per day depending on my schedule). VABL explained: http://www.infiltrated.net/index.php?option=com_content&view=article&id=17&… VABL list http://www.infiltrated.net/vabl.txt Potential scripting... wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this whole netblock "$9}' wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this one host "$9}' Depending on one's POV, COM and ADNs are the ones to keep an eye one. These are actually making connections as opposed to checking if a door is opened. I know I've stated it before, typically I see this: bruteforce --> fire off sipvicious looking for an account attacker --> logs into an account (this IP is RARELY if ever in any bruteforce logs) What I find sort of funny is that today I see an attacker I guess doing research: (attacker trying to make a call to 0112522200044) 41.34.68.219 | ADN | VABL | 8452 | 41.32.0.0/12 | TE | EG | - | TE DATA | 0112522200044 Attacker researching I guess asterisk + voip + security or so $ awk '/host-41.34.68.219.tedata.net/{print $1,$4,$5,$6,$7,$8,$9,$11}' access_log | head -n 1 host-41.34.68.219.tedata.net [17/Jan/2011:13:50:46 -0600] "GET /asterisk-ips.html HTTP/1.1" 200 "http://voipsecurityblog.typepad.com/marks_voip_security_blog/2009/07/a-scri…" -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

3 2

h.323 breech and toll fraud case
by carlos＠televolve.com Feb. 9, 2011

Feb. 9, 2011

A company we work closely with, but is not our customer, had their Cisco Call Manager hacked due to some h.323 vulnerability that I don't have full details on yet. There were a number of calls placed to: 881835211540 881835211556 881835211547 My findings indicate these are Globalstar satellite numbers that cost somewhere between $4 and $7/minute to call, depending on carrier. The victim's carrier is billing them at $6.50. The total bill for the event is around $13k. This is a small company that can't really afford this. I am not an interested party in the sense that it wasn't on our network, but it's a company we work with a lot and want to help. I also want to learn from this to potentially protect our own network. Some questions... 1. What is the scam here? The recipient of those calls doesn't gain anything, and placing a few calls to three specific satellite phones seems to have little purpose. Many of the calls were concurrent. It all happened in the span of just a few hours. 2. Anyone experienced the same thing with those numbers or similar numbers? 3. About a year ago I attended an FBI presentation on VoIP fraud and there was a VoIP specialist who gave his contact info, but I can't find it. What is the best way for this company to report this crime? -- Carlos Alvarez TelEvolve 602-889-3003

6 9

CommPartners call failures
by carlos＠televolve.com Feb. 2, 2011

Feb. 2, 2011

We're seeing upwards of 70% call failures with them. Anyone else? Sent from my iPhone

3 5

SIP Network Operators Conference (SIPNOC)
by victor.pascual.avila＠gmail.com Jan. 31, 2011

Jan. 31, 2011

FYI ---------- Forwarded message ---------- From: Paul Kyzivat <pkyzivat at cisco.com> Date: Fri, Jan 28, 2011 at 11:50 PM Subject: [sipcore] SIP Network Operators Conference (SIPNOC) To: SIPCORE <sipcore at ietf.org> Cc: Eric Burger <eburger at standardstrack.com> I received a request from Eric Burger to post this. It seems appropriately relevant. -------- Original Message -------- The SIP Forum is holding its first SIP Network Operators Conference (SIPNOC) on April 25th to the 27th, 2011, at the Hyatt Dulles Hotel in Herndon, Virginia ? a few minutes from Dulles International Airport. SIPNOC is a technical conference developed for service providers and carriers to gather and discuss the challenges of deploying and implementing SIP-based communications technology, and to share the best-practices and strategies that enable the successful and profitable operation of SIP-based services and applications in fixed and mobile IP network environments. Unlike other events, this conference is for SIP network operations personnel, such as NOC engineers, rather than a high-level conference for executives. For more information about SIPNOC, including the preliminary schedule of events and other important details about the conference, please visit http://www.sipnoc.org. The SIPNOC Program Committee is seeking proposals for presentations, panels, or BOFs (Birds-Of-a-Feather sessions) for the SIPNOC 2011 program. ?We invite presentations highlighting issues relating to SIP network deployments. Operators are encouraged to present on successes, issues, and concerns found in their deployments. Vendors are encouraged to work with operators to present real-world deployment experiences. The deadline for submission of presentation/paper abstracts and draft slides is February 21, 2011. Full details of the submission process and policies, as well as other SIPNOC 2011 dates of interest, can be found at: http://www.sipforum.org/content/view/374/275/ I look forward to seeing you at the event! Best Wishes, Eric Burger SIPNOC Chair _______________________________________________ sipcore mailing list sipcore at ietf.org https://www.ietf.org/mailman/listinfo/sipcore -- Victor Pascual ?vila

1 0

Inexpensive API-based E911 provider
by d＠d-man.org Jan. 31, 2011

Jan. 31, 2011

Hi folks, We need an E911 provider, and fast. The requirements are simple ? ability to update addresses quickly via simple APIs, ability to call a test number of some sort, and reasonably priced without huge volume commits. Any suggestions and/or things I should look out for? - Darren

4 3

Troubles calling those free conference services
by RGarcia＠360.net Jan. 29, 2011

Jan. 29, 2011

Yep - .0007, sorry about that. ----- Original Message ----- From: Frank Bulk <frnkblk at iname.com> To: Rick Garcia; paul at timmins.net <paul at timmins.net>; dane at corp.sonic.net <dane at corp.sonic.net> Cc: voiceops at voiceops.org <voiceops at voiceops.org> Sent: Sat Jan 29 15:27:29 2011 Subject: RE: [VoiceOps] Troubles calling those free conference services I think it?s triple-O 7 that they are proposing?. Frank From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of Rick Garcia Sent: Saturday, January 29, 2011 9:35 AM To: paul at timmins.net; dane at corp.sonic.net Cc: voiceops at voiceops.org Subject: Re: [VoiceOps] Troubles calling those free conference services I believe the FCC is addressing inter-carrier compensation in Feb. So potentially the problem could be solved soon. Revenue sharing at .007 doesn't seem so attractive to the ILEC or the conference provider. ----- Original Message ----- From: voiceops-bounces at voiceops.org <voiceops-bounces at voiceops.org> To: Dane Jasper <dane at corp.sonic.net> Cc: voiceops at voiceops.org <voiceops at voiceops.org> Sent: Sat Jan 29 08:19:27 2011 Subject: Re: [VoiceOps] Troubles calling those free conference services If so, we would have to band together on an ILEC network, as charging the typical CLEC termination rates could get us accused of "traffic pumping" ourselves. Dane Jasper wrote: > I wonder if there is an opportunity for carriers to cooperate to > eliminate the market for these traffic pumping services. In other > words, if carriers were to band together and cooperate to launch a > free conferencing service, chat services, etc, we might limit in some > way the impact of the business model. > > -DJ > > >>> Frank Bulk wrote: >>>> Since when did our industry stop providing carriage and completing >>>> calls? >>> >>> Since when did this industry aid and abet thieves? It's not very >>> different from a doctor who gives you cholesterol drugs and vitamins >>> instead of telling you to stop eating at McDonald's twice a day. Is it >>> better to help someone keep doing the wrong thing? We have an >>> opportunity to affect positive change in telecommunications. >>> >>> >>> -- >>> Carlos Alvarez >>> TelEvolve >>> 602-889-3003 > _______________________________________________ > VoiceOps mailing list > VoiceOps at voiceops.org > https://puck.nether.net/mailman/listinfo/voiceops > _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

1 0

Troubles calling those free conference services
by RGarcia＠360.net Jan. 29, 2011

Jan. 29, 2011

I believe the FCC is addressing inter-carrier compensation in Feb. So potentially the problem could be solved soon. Revenue sharing at .007 doesn't seem so attractive to the ILEC or the conference provider. ----- Original Message ----- From: voiceops-bounces at voiceops.org <voiceops-bounces at voiceops.org> To: Dane Jasper <dane at corp.sonic.net> Cc: voiceops at voiceops.org <voiceops at voiceops.org> Sent: Sat Jan 29 08:19:27 2011 Subject: Re: [VoiceOps] Troubles calling those free conference services If so, we would have to band together on an ILEC network, as charging the typical CLEC termination rates could get us accused of "traffic pumping" ourselves. Dane Jasper wrote: > I wonder if there is an opportunity for carriers to cooperate to > eliminate the market for these traffic pumping services. In other > words, if carriers were to band together and cooperate to launch a > free conferencing service, chat services, etc, we might limit in some > way the impact of the business model. > > -DJ > > >>> Frank Bulk wrote: >>>> Since when did our industry stop providing carriage and completing >>>> calls? >>> >>> Since when did this industry aid and abet thieves? It's not very >>> different from a doctor who gives you cholesterol drugs and vitamins >>> instead of telling you to stop eating at McDonald's twice a day. Is it >>> better to help someone keep doing the wrong thing? We have an >>> opportunity to affect positive change in telecommunications. >>> >>> >>> -- >>> Carlos Alvarez >>> TelEvolve >>> 602-889-3003 > _______________________________________________ > VoiceOps mailing list > VoiceOps at voiceops.org > https://puck.nether.net/mailman/listinfo/voiceops > _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

2 1

Predictive dialer traffic and ACME packet SBC
by ujjval＠simplesignal.com Jan. 29, 2011

Jan. 29, 2011

Has anyone had customers use predictive dialers that can misfire (user error or whatever the cayse may be)and spew out ~50 calls per sec ... How does Acmepacket handle such a burst if you have rate limit on the session agent / peer? Anyone with experience this would appreciate if could share. Ujjval Karihaloo

2 2

Troubles calling those free conference services
by carlos＠televolve.com Jan. 29, 2011

Jan. 29, 2011

I'm sure everyone is aware of the problems with those "free" service that profit from arbitrage. We get occasional complaints about not being able to dial those, and so far we've explained the scam to them and told them we're not going to fix it. However, it happens often enough that I'd like to know what others are doing about it. -- Carlos Alvarez TelEvolve 602-889-3003

8 16

Ingate questions
by sil＠infiltrated.net Jan. 28, 2011

Jan. 28, 2011

How many if any are using it as an "SBC" -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

1 0