- VoiceOps - lists.voiceops.org

PRI Gateway Supporting 1 - 3 PRI's
by kleclaire＠mywdt.com Dec. 11, 2013

Dec. 11, 2013

Hey VoiceOps, I was looking for some recommendations for a SIP-PRI Gateway that supports at least 1 PRI connecting back to the clients PBX. I've seen Adtrans are popular, but we don't have any experience with them yet. Thanks, Keith

11 16

Google Voice and 844 #s
by paul＠timmins.net Dec. 9, 2013

Dec. 9, 2013

Anyone have an ear at Google Voice? They're trying to bill 8 cents per minute to call 844 tollfrees.

2 1

Conference server options
by nelsonh＠socket.net Dec. 5, 2013

Dec. 5, 2013

Hello, I've checked and it looks like it's been a couple years since this question came up. We are running Broadworks, have a third-party conference server that we use to offer teleconference to our customers, and are considering replacing it. I have pricing for the Broadworks conferencing licenses, but wanted to see what other options anyone could suggest looking at. Thanks, -- Nelson Hicks Network Operations SOCKET (573) 817-0000 ext. 210 nelsonh at socket.net

5 6

Conference server options
by ryandelgrosso＠gmail.com Dec. 4, 2013

Dec. 4, 2013

What has your experience been with Freeswitch in EC2 from a media handling perspective? Can you share any density numbers you might have achieved? I have generally shied away from virtualizing anything media handling for clocking reasons. On 12/04/2013 03:43 PM, James Jones wrote: > My choices are in this order: > > 1. Freeswitch > 2. Asterisk > > I have built several custom solutions using both and have even be able to pretty successfully host some of them in EC2 and Rackspace. > > Sent from my iPhone > >> On Dec 4, 2013, at 6:37 PM, Ryan Delgrosso <ryandelgrosso at gmail.com> wrote: >> >> I've been looking at this as well since we run multiple softswitches and I am honestly not in love with any of the commercial conferencing solutions. >> >> In all likelihood we will be rolling up a solution on our own using Freeswitch but I am curious to hear what other people are using and what scale they are seeing. >> >> >>> On 12/04/2013 01:38 PM, Nelson Hicks wrote: >>> Hello, >>> >>> I've checked and it looks like it's been a couple years since this question came up. We are running Broadworks, have a third-party conference server that we use to offer teleconference to our customers, and are considering replacing it. I have pricing for the Broadworks conferencing licenses, but wanted to see what other options anyone could suggest looking at. >>> >>> Thanks, >> _______________________________________________ >> VoiceOps mailing list >> VoiceOps at voiceops.org >> https://puck.nether.net/mailman/listinfo/voiceops

1 0

Large VoIP Attacks?
by sil＠infiltrated.net Nov. 27, 2013

Nov. 27, 2013

On Wed, 27 Nov 2013, Abdul Hakeem wrote: > Hello, > Are you able to share a copy of the anti-toll script ? > Best regards, > Abdul Hakeem > > www.infiltrated.net/antitoll Self explanatory. I also have added as many hosting cos to the rules after all, who the heck needs to connect to any of my PBXs from SoftLayer, ThePlanet or Rackspace which are some flooded with filth. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Large VoIP Attacks?
by sil＠infiltrated.net Nov. 27, 2013

Nov. 27, 2013

On Tue, 26 Nov 2013, Sandro Gauci wrote: > Hey J, > > can you describe what you're seeing please? E.g. Is it a system compromise, > toll fraud or DoS (or none of these?:) ) > > Feel free to post the response to the lists or privately to me. > > cheers, > > Yo what's going on Sandro... Will post to list so that others may be able to chime in if they've seen similar. Unsure what was happening since we had to get systems up and running "right now" since they were live systems with a mess of users on them (give or take 1000,1500 users). This is all I can say... Yesterday morning, client who uses a PBXNSIP based system calls: "Can't make calls, receive calls." Not a big deal, reload software, sometimes it acts up. Ten minutes later, another client using PBXNSIP calls with the same issue, followed by 2-5 systems within a half an hour of one another. lsof | grep -i snom showed there were a lot of connections via http and SIP to various addresses in Europe (.it, .de and a few others). No one was connected out there. I could not do packet captures because clients were complaining so my ultimate reflex was an antitoll script I wrote which blocks ALL but ARIN based (North American) networks. This solved the problem on PBXNSIP. Minutes later, some of my LifeSize videoconferencing units started making phantom calls to extensions. The username was Test() via the LifeSize, but I could not perform a packet capture on that either. We didn't see any bursts of traffic, e.g., N_amount of excess bandwidth coming in, so DDoS was out of the question and I am always abusing (vulnscanning, webscanning, hitting up) my PBXs, but I have yet to ever make one unresponsive. So I am lost as to what occurred. Had I to guess what happened to PBXNSIP... Maybe some bad packetjuju forced it to crash (because it was down for the count). Mind you, this ONLY affected PBXs running PBXNSIP. Wish I knew anything more than "that was some bad packetry" but I'm stumped. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 1

1. Large VoIP Attacks?
by ajp26＠buffalo.edu Nov. 26, 2013

Nov. 26, 2013

I don't normally post to this list, as it is more for the SP side of things. A few weeks back we had a publically exposed LifeSize video conference unit compromised. It was not installed particularly well, given the limitations to the administrative PIN code, but it has shell access enabled, and a flash portal which purportedly has rights execution issues. The vendor has a firewall device that would place these behind it on private space - was that in play where your units were attacked? We've since removed these until we can provide a full video call control infrastructure, to keep from exposing these appliances, but I figured it was the poor PIN code that was hit, not the device itself. Adam Pawlowski SUNYAB

2 1

Large VoIP Attacks?
by sil＠infiltrated.net Nov. 25, 2013

Nov. 25, 2013

Been a very fun/interesting morning. Since so much has gone on, I figured I'd share. We have seen a larger than normal, if not, one of the largest attacks against some of our VoIP and video conferencing systems today. Initially, we fielded a report of a "system gone bad" followed by another, then another, and another. This has now carried on into some of our videoconference units (LifeSize). Because our goal is to get telephony up and running, there was not much we could do via incident response, so I have little to add on attack vectors however, I will state that PBXNSIP has been the primary target, with about a dozen of these being hit pretty hard to the point I've had to block all, stop the software and re-start it. My dealings with vulnerability disclosures has been that, vendors don't care, so if there is something specific with PBXNSIP, no one knows, and due to their political bickerings in house, no one is going to fix it. So for anyone using this software, long weekend dictates: "lock your **** down." Same goes for LifeSize. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Pacwest is having a major outage - FYI
by jay＠west.net Nov. 23, 2013

Nov. 23, 2013

Incoming calls to our trunks are failing, as is their NOC tollfree number. -- -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

1 0

[VOIPSEC] Phone fraud doubles
by sil＠infiltrated.net Nov. 21, 2013

Nov. 21, 2013

On Thu, 21 Nov 2013, Vijay Balasubramaniyan wrote: > The report is split into 2 sections: > A) What we are seeing at call centers > B) What individual consumers are seeing. > > The 2.4 million comments are with respect to B) not A). So this is not with > respect to a call center. At FI call centers we are seeing 1 in 2500 calls > being an attempt to take over an account (ATO). So if you get 1 million > calls a month you are likely to see 400 attempts at ATO. Our last report > was purely consumer focussed and in this report we are showing what we > believe are both sides of the coin. Please let me know if this clarifies > your concerns and appreciate your feedback. Let me know if you have any > follow up questions. > > This is also a great way to finally send a mail on this group which I have > been following for all the information it provides. > So it is just as I expected. I will give you an example. We have all seen/read/experience 'ye phantom call' that Sandro Gauci clarified last week. I have a client with a couple of trunks, Audiocodes gateway thing-a-ma-bob. She calls us up telling us she is receiving hundreds of calls a day. With this data, how accurate would it be if I averaged her calls, multiplied the number ghost calls, then reported: "Man, I am seeing 10,000,000 fraud attempts per month!" The realities behind those numebrs aren't real. They're scaled sideways. I do this (scaling sideways) when I want new equipment all the time. Me: "Man, the amount of attacks has quadrupled. Take a look at my Splunk parsing. Call leg in, call leg out that's 2 calls! (when its really 1). We need the latest and gr8est in Juniperism Equipment otherwise we are doomed!" Manager: "Wow we are getting attacked aren't we!" Scans - I don't count as attacks Enumeration - I don't count that either I could an actual compromise as an attack. We have had those on PBXs we provided trunks for. This is because the clients don't learn no matter what we tell them. "Stop using 12345 as a password k thanx!" This is not a post to take away from your data, but the reality is, from my perspective, if you said 2.5 million, I'm willing to bet a years worth of lunch, the actual number is in the tens of thousands *IF* even that much. Even our upstreams (VZ, Level3, MiniLevel3 (GBLX), Tandem, etc.) have gotten a little smart on alerting for fraud. (Its after the fact, but its nice to know they saw it tenteen hours late). My colleagues and I stopped counting managed PBXs, trunks, etc because it reached too many to keep track of. We do however, run all through SBCs with using Transnexus which is great, but at the same time, we have learned the ropes and created our own Frankenstein alerting system. ATTACK wise (meaning compromise) these have dwindled into perhaps the teens, and even then, Transnexus allows us to further minimize the $ damage. Mind you, I could easily say: "Im getting scanned! (attack)" "I'm being brute forced! (attack)" and throw this number into the tens of millions easily. This doesn't even include clients softphones, Snoms, Polys, etc., that receive ghost calls. "I'm getting spammed, ghost calls." Heck I wouldn't even know where to place the figure. Tens of millions? So define ATO. Is this a scan, someone bruteforcing. What is an ATO. I define an attack as a compromise when it comes to VoIP. Lord knows there aren't enough days in the year to count scans, sipvicious, other nonsense. Not to forget about the honeypots I have lurking. 400 "attempts" is literally peanuts (.25%) sourcetype Count Last Update CDR-6 5,716,520 Thu Nov 21 16:06:42 2013 One SBC, one month. If I dug out how many failed brute force attempts, scans, etc., I could easily say.. Of the 5,716,520 calls that were put through, based on the amount of scans, brute forcers, etc., I have seen, there were 100,000,000 attacker. 1,000 people tried scanning 1,000 accounts! See the dilemma? No harm no foul. Reality? OF the 5,716,520 calls, we had 450 ATTEMPTED fraudulent attempts, of which 90 completed, of which most were blocked after N attempts (Transnexus). So bottom line? we had 90 fraudulent calls aka 0.001574% fraud. Even if I multiplied this 44x (to meet your 400 call criteria), I'd be in the 0.069% range for fraud at a little over a quarter billion calls. I won't even get into what the call center we have is saying. This is coming from engineering now. People in my call center will tell me the Internet is blown up simply because their browser isn't opened. They aren't trained to see real data. Anyhow ;) Let me stop picking on the list before someone steps on me! -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

2 1