October 2013 - VoiceOps - lists.voiceops.org

Maintenance for Performance Technologies SEGway
by scott＠socket.net May 17, 2017

May 17, 2017

We have been using a set of PTI SEGway x201s with point code emulation for a number of years now. We also have an unlicensed spare in stock. The maintenance contract renewals are due and the two quotes I've received are quite high. I know of at least one other company that has chosen to drop the vendor maintenance and take care of that in-house. I would like to hear from anyone that is currently using SEGways and find out what they chose to do for maintenance. I would also be very interested to hear of any bad experiences from chosing the in-house option. Thanks. Scott Stratman Network Facilities Manager SOCKET 573-999-4376 scott at socket.net 1-800-SOCKET-3 www.socket.net

3 2

Strange inbound Calls
by nick＠flhsi.com Jan. 14, 2014

Jan. 14, 2014

If the call is answered by a human, They hear nothing on the other side. I will ask our receptionist to allow the call to continue for a minute or so and see if it hangs up at the 60 second mark. Timing our own IVR. It takes exactly 60 seconds, If you press nothing to get all the way 1 second in to voicemail. As these calls always appear leaving 1 second voicemails. Nick Olsen Network Operations (855) FLSPEED x106 ---------------------------------------- From: "Jay Hennigan" <jay at west.net> Sent: Wednesday, October 02, 2013 2:25 PM To: voiceops at voiceops.org Subject: Re: [VoiceOps] Strange inbound Calls On 10/2/13 10:13 AM, Nick Olsen wrote: > Hello Everyone, > > We've been seeing a lot of strange inbound calls to our toll free > numbers recently. The only thing they have in common is the caller ID > text is always a city and a state. And the the call duration is 60 > seconds on the dot..Every time. Are the calls answered by a human? If so, what do they hear? If not and it's an IVR, if you call and say nothing does the call drop in 60 seconds? City and state are not uncommon for CNAM. Many CNAM providers will put the city and state of the rate center for the NPA-NXX if caller name isn't available. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

8 7

Post-dial delay impacting Southern CA?
by jay＠west.net Oct. 29, 2013

Oct. 29, 2013

We're seeing 15-30 seconds post-dial delay on multiple SIP carriers, anyone else? -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

4 3

Web Attacker Blacklist
by sil＠infiltrated.net Oct. 23, 2013

Oct. 23, 2013

Going to cross post this to the list (I know some of us criss-cross lists). Reasoning, a lot of IP PBXs have web based interfaces, and some need to be on the public Internet. --- Cobbled together a script to scrape my logs, parse out web based attackers (SQLi, XSS, CSRF, etc) and compile said list for blacklisting. Script is pulling from 6 different web servers for now. I may add more later depending on whether or not I see a lot of usage. http://www.infiltrated.net/webattackers.txt -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

3 3

Blacklist script
by sil＠infiltrated.net Oct. 23, 2013

Oct. 23, 2013

Isn't much more than a bloated one line. Just parses through apache logs to check for the following (so far): JCE - Joomla shell uploader) Ahrefsbot - (spammer bot) POST - (because no one should be posting stuff to my site, I have no user logins, forms, etc. and after analyzing what was being posted close to 100% were things with malicious intent. Catches most things) administrator - no one should be trying to log in as administrator. They get nowhere trying, but they still do. 55000 is the set amount of lines I chose to look through, since I fluctuate between 25-40k visitors at peak times. (This was written for my personal site which sees about 2-3k ranDumb attacks per day (must be the domain name)) Sorting uniquely ensures I don't get dupes. I may reconstruct it to aggregate data from others once I get proper permission to do so. In which event I'd be able to correlate data from a couple hundred/thousandish webservers (unsure when this will happen). ----------- printf " # # The following addresses are web based attackers # compiled on an hourly basis. Most are attempting # XSS, SQLi, CSRF and other attacks. Compiled list # to be used for blacklisting. # #" > /tmp/xssers/XSSATTACKERS echo `date`|sed 's:^: :g' >> /tmp/xssers/XSSATTACKERS printf "\n\n" >> /tmp/xssers/XSSATTACKERS tail -n 55000 /var/logs/httpd/access_log|\ awk '/AhrefsBot|POST|administrator|JCE/{print $1}'|sort -u >> /tmp/xssers/bad.xxxers cat /tmp/xssers/bad.xxxers >> /tmp/xssers/XSSATTACKERS mv /tmp/xssers/XSSATTACKERS /var/www/html/infiltrated.net/webattackers.txt -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

[VOIPSEC] Web Attacker Blacklist
by sil＠infiltrated.net Oct. 22, 2013

Oct. 22, 2013

On Tue, 22 Oct 2013, Sergey Kolesnichenko wrote: > If I ever want to do something bad I would check if my IP is the public > lists. If I ever want to protect my scripts I will never rely on 3rd party > blacklists. And I think modsecurity.org saves the day for web > applications... > You're missing the purpose of the list. Not everyone can, will, or has the capability of running modsecurity. I do so I am fully aware of how to blacklist/filter attacks. Filtering - while it helps me, helps me solely because I have taken the time to implement strong (overly aggressive) rules. What about the others who can't/don't run filters such as modsecurity. So for starters, it helps others see who is doing what on other networks under the premise that "if it hits me, it can hit you too." Secondly, accountability. Having maintained my blacklists for some time now, I get a lot of requests to have IP addresses taken off the blacklists. Many are companies that didn't even know they were compromised. Because of the list and people blocking the IP, they quickly fix their networks to where before, they'd of never known. Thirdly, research. I can't count the number of times that articles were written with no attributable addresses. By posting addresses publicly, anyone doing research into cybercrime related themese (botnets, etc.) can see addresses firsthand and if necessary, I would supply them for the exact attack vector used by an address. Finally, its no secret that most attackers do this (check against blacklists). At some point in time the theory is, they're gonna run out of addresses, and compromisable hosts once companies and individuals running websites get their acts in order. NO COMPANY wants to have entire netblocks blacklisted. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

VoiceOps Digest, Vol 52, Issue 11
by dbauman＠wanetics.com Oct. 22, 2013

Oct. 22, 2013

An HTML attachment was scrubbed... URL: <https://puck.nether.net/pipermail/voiceops/attachments/20131022/cdb7e8ba/at…>

1 0

VoiceOps Digest, Vol 52, Issue 10
by dbauman＠wanetics.com Oct. 21, 2013

Oct. 21, 2013

An HTML attachment was scrubbed... URL: <https://puck.nether.net/pipermail/voiceops/attachments/20131021/66393bea/at…>

1 0

VoiceOps Digest, Vol 52, Issue 9
by dbauman＠wanetics.com Oct. 20, 2013

Oct. 20, 2013

An HTML attachment was scrubbed... URL: <https://puck.nether.net/pipermail/voiceops/attachments/20131020/fb24b88e/at…>

1 0

New SPA2100/2102/1001 exploit in the wild?
by ryandelgrosso＠gmail.com Oct. 19, 2013

Oct. 19, 2013

Hey all, I am seeing my fraud-o-meter tick up as of yesterday and it all seems to be driven by accounts attached to these devices. We have taken measures to start locking this down but I am wondering if anyone out there is seeing similar. It looks like somehow legacy devices that have been deployed for 5+ years are having accounts lifted out of them. Does anyone have info on this exploit, or if you are seeing this as well and want to compare notes feel free to ping me. Thanks, -Ryan

5 7