- VoiceOps - lists.voiceops.org

Twitter Blacklist feed
by sil＠infiltrated.net Jan. 10, 2013

Jan. 10, 2013

So I rebuilt/redesigned/re-deployed a script to add bad hosts to a blacklist. Script is monitoring my SBCs, hosted PBXs, etc., aggregated, sorted, then reported. Tried to remove duplicate addresses. Also, because I deal with forensics and malware, I did a similar script for bad sites that are serving out malware. For VoIP attacks, one can make a script to check for VoIP based attackers and block them on the fly. E.g,: links -dump twitter.com/efensive|awk '/VoIP/' To make say an automated ipfilter rule: links -dump twitter.com/efensive |\ awk '{print "iptables -A INPUT -s "$1" -j DROP"}' |sort -u|\ sh Same goes for any other style rule (ASA, PIX, ScreenOS on the command line) You get the point. Enjoy. (Cross posted to Voice Ops) -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

4 3

4
by naushit＠yahoo.com Jan. 10, 2013

Jan. 10, 2013

http://whaouh.com/market/inMaking%20money%20from%20home%20has%20never%20bee…!

1 0

Twitter blacklist feed
by joquendo＠e-fensive.net Jan. 9, 2013

Jan. 9, 2013

So I rebuilt/redesigned/re-deployed a script to add bad hosts to a blacklist. Script is monitoring my SBCs, hosted PBXs, etc., aggregated, sorted, then reported. Tried to remove duplicate addresses. Also, because I deal with forensics and malware, I did a similar script for bad sites that are serving out malware. For VoIP attacks, one can make a script to check for VoIP based attackers and block them on the fly. E.g,: links -dump twitter.com/efensive|awk '/VoIP/' To make say an automated ipfilter rule: links -dump twitter.com/efensive |\ awk '{print "iptables -A INPUT -s "$1" -j DROP"}' |sort -u|\ sh You get the point. Enjoy. (Cross posted to Voice Ops) -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

CTI Group call recording
by David.Hiers＠adp.com Jan. 8, 2013

Jan. 8, 2013

Anyone out there using CTI for call recording? Thanks, David This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

Issue with Adtran TA9xx/Broadworks/Session Audit Timers
by RDawson＠alliedtelecom.net Jan. 7, 2013

Jan. 7, 2013

Having an issue where occasionally a TA9xx doesn?t see an ack for a session audit timer invite event and will then reply with a 500 "re-invite inside a re-invite" error on the next invite. I am investigating the possibility of a network side issue now but wondering if anyone else has dealt with this? Thanks, Rob

1 0

VoIP on 10mb Cat 3 switched network
by carlos＠televolve.com Jan. 6, 2013

Jan. 6, 2013

Has anyone had experience successfully running VoIP over 10mb Cat 3 cabling? A new customer has asked, because that's what they have in place. I'm not interested in an unreliable solution just to save a few bucks, but in theory it should work reliably to have a dedicated 10mb to each phone and then gigabit out of the main switches. -- Carlos Alvarez TelEvolve 602-889-3003

12 14

IAD and SIP PBX Hardening Guidelines
by lindsey＠e-c-group.com Jan. 4, 2013

Jan. 4, 2013

Are there any published hardening guidelines or howtos on IADs, SIP PBXs, or and any other SIP devices on the public Internet? If not, we should put some together. For IADs, the list might start with some of the same rules you'd use on any other router. But for IADs or SIP PBXs, it seems like these two are pretty important: Restricting remote login; Restricting SIP. (1) Restrict telnet, ssh, snmp to only Administrator locations, by IP. Many of the recent attacks happening at service providers are IAD or SIP PBX compromises. These devices are often on the public Internet, and they have poor passwords. BadGuy just scans for telnet-accessible devices, logs in, and then sets up the IAD to route calls. Or he may just simply steal the SIP credentials. I can't think of good reasons that these IADs should allow telnet, ssh, or snmp from the public Internet at large. Of course, the administrators of the device (often the voice SP itself) needs to be able to login. As an alternative, you might just ensure that strong passwords are used. Lots of folks are moving to RADIUS authentication for IADs, on the hopes that they'll use better usernames and passwords. (2) Restrict SIP & RTP to only the Service Provider's SBCs, by IP. On some IADs, you can send SIP to the device's SIP stack just by sending it SIP to port UDP/5060. A lot of IADs are CPU-poor anyway, so giving them extra SIP parsing isn't going to help. In fact, just sending in bogus SIP can be enough to DoS the device. But in our world of (a) buffer overflows and code injection and (b) complex parsing of SIP, it seems intrinsically risky to allow BadGuy to send SIP in to a CPE. It seems very likely that a determined attacker could use specially-crafted SIP messages to cause a SIP IAD or phone to do anything they want: -- Make fraudulent calls -- Play advertisements -- Send a copy of the RTP to a mysterious destination on the Internet Some of the same risks are present with RTP. But fortunately, RTP is simple enough that hardening the implementation may be easier. And often RTP is handed directly to a DSP, where (I would guess) the opportunities for code injection are less interesting. But there's a real downside here: What if you need to manage SIP traffic, and allow IADs to register to some other location? If you're doing it RFC3263 style, then you might just be using DNS to route IADs and PBXs to the appropriate SBC. If you need to add additional SBCs, then you have to be sure the IAD will have ACLs that allow traffic from those other SBCs in advance. Finally: What about the poor souls who put SIP phones directly on the Public Internet? Maybe you can change the administrator password, and make it harder to login and extract the SIP authentication credentials. But beyond that, SIP phones don't typically have firewall-type features. I think the better bet here is to put them behind a stateful firewall/NAT device. Any other opinions? >>> mark at ecg.co +12293160013 http://ecg.co/lindsey

2 1

Real-time single stream RTP monitoring
by rkusler＠intermedia.net Dec. 18, 2012

Dec. 18, 2012

Hey all, I am wondering if anyone knows about a simple UAC-like tool that can establish a single concurrent long-running call to another SIP endpoint and monitor the incoming RTP. If, in real-time, it detects a significant drop in RTP (or other audio degradation), it could run a command line tool. I'm not looking for software that captures lots of calls or does advanced analytics.. I'm really just hoping for something that alerts us to an issue in real-time while a call is still active. Does anyone know of anything like this? Or will I have to roll it myself? I appreciate any suggestions that you can offer! =) Ross Kusler VoIP Systems Engineer Intermedia

4 3

MSX / Genband S3
by EWieling＠nyigc.com Dec. 12, 2012

Dec. 12, 2012

We are in the process of moving our MSX aka Genband S3 out of service over the following months and are wondering if there is anyone out there which does per-incident support for this platform. We are very unhappy with Genband and Voiplogic support and they only provide support via a yearly contract.

3 2

CSR Request?
by david＠ringfree.biz Dec. 11, 2012

Dec. 11, 2012

Hi All, A question for you that I've never been able to get an answer too. We are a small hosted VOIP shop. And we port numbers through various aggregators (example vitelity) When we are porting phone numbers I am occasionally asked for a CSR by the gaining carrier (Or the aggregator that we are using). Sometimes they are able to get the CSR and sometimes they are not. However, when I call the losing carrier they always state that they don't give out CSR's. And that the winning carrier needs to request the CSR. One of the two parties is giving bad information , and I can't ever tell which one. Are there rules that govern the CSR requests? If there a way that we can ever do a CSR request without going through the consumer channels? Thanks David

4 10