- VoiceOps - lists.voiceops.org

Ghost calls - Sipvicious?
by jay＠west.net Nov. 13, 2013

Nov. 13, 2013

We operate a hosted VoIP platform using Broadworks and over 90% Polycom phones. We have a number of customers at diverse locations recently reporting dead-air calls. These typically come from a source ANI of 100 or 7070 and have no audio. Most of the phones are behind Adtran TA900 series IADs with NAT and a SIP access list allowing only our own SBCs. The calls don't show up in our SBC logs, nor do they show in the MOS graphs on the Adtran voice quality monitoring. Any ideas or suggestions on what is causing this or how to stop it? -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

5 6

Adtran TA900 timing problems
by mylists＠battleop.com Nov. 5, 2013

Nov. 5, 2013

Has anyone ever seen this problem? I have a good number of TA900s and TA900Es on the other side of a 7206VXR with PA-MC-T3 cards. Once every few months SIP accounts in the TA900s that are attached to FXS ports have trouble passing audio. It sounds like the audio stream is On/Off about every 3 seconds. The only "fix" is to change the timing from the T1 to internal or reboot the router which effectively does the same thing. It never has an effect on PRI/T1 voice, Hosted PBX behind that router, or data traffic behind the router. We never see a problem with other Cisco routers connected to the same DS3(s) including voice on Cisco 2431-8FXS and 16FXS rotuers. When the problem happens it will happen to every TA900 or TA900E at the same time on the same DS3. It's always a single random DS3 in the same box. I've had countless tickets open with our DS3/T1 Provider over the years and they always say they see nothing. Adtran's only solution so far is to change the timing when it happens. One tech suggested we just run internal timing all the time but that seems to only work for 31 days. I've completely swapped out the 7200 and the PA-MC-T3 cards. I've had a JDSU test set on random DS3s for weeks at a time and never seen a problem. We set up the routers so that the T1 is the Primary and the Internal is secondary. I suspect that something happens to the primary clock and it fails to the internal clock. When the primary clock becomes available again the TA900 does not revert back to the T1 clock. So when we get to around 31 days the internal timing fails and then the problem with the audio happens. -Richey

5 9

Invitation to connect on LinkedIn
by nick.crocker＠gmail.com Nov. 4, 2013

Nov. 4, 2013

LinkedIn ------------ I'd like to add you to my professional network on LinkedIn. - Nick Nick Crocker Senior VoIP Infrastructure Engineer at One Source Networks Austin, Texas Area Confirm that you know Nick Crocker: https://www.linkedin.com/e/-1jciiy-hnmewphu-72/isd/17802609040/-xV1IjFA/?hs… -- You are receiving Invitation to Connect emails. Click to unsubscribe: http://www.linkedin.com/e/-1jciiy-hnmewphu-72/qsHV3tWxE1OhUzjlpOHtd2YOB0FiV… (c) 2012 LinkedIn Corporation. 2029 Stierlin Ct, Mountain View, CA 94043, USA.

1 0

looking for advice on international fraud that took place via an Edgemarc 200EW with FXO line installed
by myaklin＠g4.net Nov. 1, 2013

Nov. 1, 2013

Hi all, I had some toll fraud to Grenada last night which we stopped as soon as we became aware of it. Example numbers being dialed were: 1-473-405-0085 1-473-405-0084 1-473-405-0088 Normally I can track down how it happened to figure out who was at fault. But this time I am having a hard time. The customer has two types of service from us. Yealink phones connected to our Broadsoft system with an Edgemarc 200EW installed at the customer premise. They also have some POTS line with us for faxing. One of those POTS lines is connected to the Edgemarc 200EW via the built in FXO port for "Survivability". Meaning if the WAN ethernet port on the Edgemarc has a failure they can at least have one line to dial out on in case of an emergency. That is about the only time it would ever be used except for faxing. The toll fraud CPN just happens to be that POTS line connected to the Edgemarc. That POTS line is also connected to a very basic fax machine. In the Edgemarc for that FXO port two stage dialing is disabled in both directions. We had incoming calls on the FXO line being forward to a Yealink phone but that would never function properly due to the customer having a fax line picking up first. Just leftover config during the install where we made an assumption the customer might want it. The Yealink phones are behind the Edgemarc (NAT) and not reachable via the internet. The Edgemarc is using radius for user auth and has strong passwords set. I cannot find any config in Broadsoft where a user had call forwarding setup or whatever that would cause this. I cannot find any settings in the Edgemarc that would allow this to take place. As in a config mistake. The Edgemarc is running code Version 11.6.19. The Yealink phones are also up2date with the newest code from the vendor's website. I do not think this fraud was done on site via physical means. It is a school and I just cannot picture a student or faculty having a need to call Grenada. The Edgemarc does have port 5060 open to the world but it is just a ?proxy? I was under the impression that one cannot brute force an account on a proxy device that has no config as such like an asterisk box would. You would be basically brute forcing against Broadsoft in that case? Either way I am still digging into things but I thought by sending this email someone might have some advice to clue me into something I am missing when it comes to Edgemarc and FXO security. Thanks, matt at g4.net

7 14

Details on Portland, ME outages
by rrodriguez＠ifbyphone.com Nov. 1, 2013

Nov. 1, 2013

Anyone have any specific details about an origination outage in Portland, ME (LATA 120) that extended most of the day yesterday (10/31). Experienced outages from several origination carriers which have cited a ULC's protect ring not taking over during a planned maintenance. -- Robin Rodriguez

1 0

Post-dial delay impacting Southern CA?
by jay＠west.net Oct. 29, 2013

Oct. 29, 2013

We're seeing 15-30 seconds post-dial delay on multiple SIP carriers, anyone else? -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

4 3

Web Attacker Blacklist
by sil＠infiltrated.net Oct. 23, 2013

Oct. 23, 2013

Going to cross post this to the list (I know some of us criss-cross lists). Reasoning, a lot of IP PBXs have web based interfaces, and some need to be on the public Internet. --- Cobbled together a script to scrape my logs, parse out web based attackers (SQLi, XSS, CSRF, etc) and compile said list for blacklisting. Script is pulling from 6 different web servers for now. I may add more later depending on whether or not I see a lot of usage. http://www.infiltrated.net/webattackers.txt -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

3 3

Blacklist script
by sil＠infiltrated.net Oct. 23, 2013

Oct. 23, 2013

Isn't much more than a bloated one line. Just parses through apache logs to check for the following (so far): JCE - Joomla shell uploader) Ahrefsbot - (spammer bot) POST - (because no one should be posting stuff to my site, I have no user logins, forms, etc. and after analyzing what was being posted close to 100% were things with malicious intent. Catches most things) administrator - no one should be trying to log in as administrator. They get nowhere trying, but they still do. 55000 is the set amount of lines I chose to look through, since I fluctuate between 25-40k visitors at peak times. (This was written for my personal site which sees about 2-3k ranDumb attacks per day (must be the domain name)) Sorting uniquely ensures I don't get dupes. I may reconstruct it to aggregate data from others once I get proper permission to do so. In which event I'd be able to correlate data from a couple hundred/thousandish webservers (unsure when this will happen). ----------- printf " # # The following addresses are web based attackers # compiled on an hourly basis. Most are attempting # XSS, SQLi, CSRF and other attacks. Compiled list # to be used for blacklisting. # #" > /tmp/xssers/XSSATTACKERS echo `date`|sed 's:^: :g' >> /tmp/xssers/XSSATTACKERS printf "\n\n" >> /tmp/xssers/XSSATTACKERS tail -n 55000 /var/logs/httpd/access_log|\ awk '/AhrefsBot|POST|administrator|JCE/{print $1}'|sort -u >> /tmp/xssers/bad.xxxers cat /tmp/xssers/bad.xxxers >> /tmp/xssers/XSSATTACKERS mv /tmp/xssers/XSSATTACKERS /var/www/html/infiltrated.net/webattackers.txt -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

[VOIPSEC] Web Attacker Blacklist
by sil＠infiltrated.net Oct. 22, 2013

Oct. 22, 2013

On Tue, 22 Oct 2013, Sergey Kolesnichenko wrote: > If I ever want to do something bad I would check if my IP is the public > lists. If I ever want to protect my scripts I will never rely on 3rd party > blacklists. And I think modsecurity.org saves the day for web > applications... > You're missing the purpose of the list. Not everyone can, will, or has the capability of running modsecurity. I do so I am fully aware of how to blacklist/filter attacks. Filtering - while it helps me, helps me solely because I have taken the time to implement strong (overly aggressive) rules. What about the others who can't/don't run filters such as modsecurity. So for starters, it helps others see who is doing what on other networks under the premise that "if it hits me, it can hit you too." Secondly, accountability. Having maintained my blacklists for some time now, I get a lot of requests to have IP addresses taken off the blacklists. Many are companies that didn't even know they were compromised. Because of the list and people blocking the IP, they quickly fix their networks to where before, they'd of never known. Thirdly, research. I can't count the number of times that articles were written with no attributable addresses. By posting addresses publicly, anyone doing research into cybercrime related themese (botnets, etc.) can see addresses firsthand and if necessary, I would supply them for the exact attack vector used by an address. Finally, its no secret that most attackers do this (check against blacklists). At some point in time the theory is, they're gonna run out of addresses, and compromisable hosts once companies and individuals running websites get their acts in order. NO COMPANY wants to have entire netblocks blacklisted. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

VoiceOps Digest, Vol 52, Issue 11
by dbauman＠wanetics.com Oct. 22, 2013

Oct. 22, 2013

An HTML attachment was scrubbed... URL: <https://puck.nether.net/pipermail/voiceops/attachments/20131022/cdb7e8ba/at…>

1 0