- VoiceOps - lists.voiceops.org

VoIP Abuse Take Two (or three, maybe even 4-5)
by sil＠infiltrated.net March 17, 2011

March 17, 2011

For those looking for a different type of blacklist or at least one that makes sense, please be sure to browse the VoIP Abuse Black List as things are a slightly different now. VABL looks up an attacker's information via Shadowserver's lookup and appends three new fields: type of attacker, address and the letters VABL (so one can know where and how it ended up on being blacklisted) and a number dialed (when appropriate.) The type of attacker field may make the biggest difference to those who decide to use this list. There are two specific entries that will appear: BRU, ADN and COM. BRU means that the host attempted to bruteforce a PBX while COM signifies that the attacker managed to compromise either a honeypot or a live machine. ADN is when an attacker places a call and is short for Attacker Dialing Numbers. Whenever you see an entry with ADN, there will be an additional field at the end with the number dialed by the attacker appended to it. Here are three entries, a COM (someone who accessed a honeypot with a valid account), a bruteforcer and an ADN (an attacker who accessed a compromised account and tried to place a call the number dialed is pre-pended) 85.214.23.191 | COM | VABL | 6724 | 85.214.0.0/16 | STRATO | DE | STRATOSERVER.NET | STRATO RECHENZENTRUM BERLIN 41.232.96.220 | ADN | VABL | 8452 | 41.232.96.0/22 | TE | EG | TEDATA.NET | AFRINIC | 011251912121891 93.126.35.12 | BRU | VABL | 44375 | 93.126.0.0/18 | AISDP | IR | - | ASMANFARAZ SEPAHAN ISDP Anyhow, the list is maintained as a text file and is updated accordingly (once per day depending on my schedule). VABL explained: http://www.infiltrated.net/index.php?option=com_content&view=article&id=17&… VABL list http://www.infiltrated.net/vabl.txt Potential scripting... wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this whole netblock "$9}' wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this one host "$9}' Depending on one's POV, COM and ADNs are the ones to keep an eye one. These are actually making connections as opposed to checking if a door is opened. I know I've stated it before, typically I see this: bruteforce --> fire off sipvicious looking for an account attacker --> logs into an account (this IP is RARELY if ever in any bruteforce logs) What I find sort of funny is that today I see an attacker I guess doing research: (attacker trying to make a call to 0112522200044) 41.34.68.219 | ADN | VABL | 8452 | 41.32.0.0/12 | TE | EG | - | TE DATA | 0112522200044 Attacker researching I guess asterisk + voip + security or so $ awk '/host-41.34.68.219.tedata.net/{print $1,$4,$5,$6,$7,$8,$9,$11}' access_log | head -n 1 host-41.34.68.219.tedata.net [17/Jan/2011:13:50:46 -0600] "GET /asterisk-ips.html HTTP/1.1" 200 "http://voipsecurityblog.typepad.com/marks_voip_security_blog/2009/07/a-scri…" -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

3 2

Verizon and E.164
by CCurry＠telovations.com March 17, 2011

March 17, 2011

Thanks Paul and Scott. I am not a SS7 guru by no means and the NOA may help. I need to do a trace to see what I am sending to verizon to insure I am sending NOA of national. ________________________________________ From: voiceops-bounces at voiceops.org [voiceops-bounces at voiceops.org] On Behalf Of voiceops-request at voiceops.org [voiceops-request at voiceops.org] Sent: Wednesday, March 16, 2011 4:50 PM To: voiceops at voiceops.org Subject: VoiceOps Digest, Vol 21, Issue 11 Send VoiceOps mailing list submissions to voiceops at voiceops.org To subscribe or unsubscribe via the World Wide Web, visit https://puck.nether.net/mailman/listinfo/voiceops or, via email, send a message with subject or body 'help' to voiceops-request at voiceops.org You can reach the person managing the list at voiceops-owner at voiceops.org When replying, please edit your Subject line so it is more specific than "Re: Contents of VoiceOps digest..." Today's Topics: 1. (no subject) (Mark Wiles) 2. Re: Verizon and E.164 (Paul Timmins) ---------------------------------------------------------------------- Message: 1 Date: Wed, 16 Mar 2011 16:38:50 -0400 From: "Mark Wiles" <mwiles at akabis.com> To: <voiceops at voiceops.org> Subject: [VoiceOps] (no subject) Message-ID: <033201cbe41a$29064330$7b12c990$@com> Content-Type: text/plain; charset="us-ascii" Does anyone have experience with VoIP Innovations (www.voipinnovations.com)? Thanks! Mark

1 0

Verizon and E.164
by l_mysterioso＠yahoo.com March 16, 2011

March 16, 2011

What type of product are you using for SS7 to/from SIP translation? There is a good chance that your SS7 to SIP translation device may have the ability to manipulate ANI and DNIS as required. In the application we use on our net the M3UA server manages E.164 vs 10 Digit National decisions quite well. Also, do you plan to use this SS7 route for any international termination? If not, it might be as simple as limiting all calls over that trunk group to 10 digit ANI/DNIS outbound then prefix a (+)1 on the inbound. Thanks, Spencer *From:* voiceops-bounces at voiceops.org > [mailto:voiceops-bounces at voiceops.org] *On Behalf Of *Chet Curry > *Sent:* Wednesday, March 16, 2011 12:58 PM > *To:* voiceops at voiceops.org > *Subject:* [VoiceOps] Verizon and E.164 > > Many carriers request that you send sip messaging using E.164 > compliant #'s. We have a TDM/SS7 peering to Verizon and we tried > sending calls to them with the "Calling" # in E.164 format. > > Unfortunately they see the call as International because there is a 1 > prepending the 10 digit #. This makes no sense to me as international > starts as 011. Has anyone had this issue with Verizon or any other > carrier?

1 0

Verizon and E.164
by CCurry＠telovations.com March 16, 2011

March 16, 2011

Many carriers request that you send sip messaging using E.164 compliant #'s. We have a TDM/SS7 peering to Verizon and we tried sending calls to them with the "Calling" # in E.164 format. Unfortunately they see the call as International because there is a 1 prepending the 10 digit #. This makes no sense to me as international starts as 011. Has anyone had this issue with Verizon or any other carrier? [cid:image001.png at 01CBE3D9.54AE5270]

3 2

Verizon and E.164
by CCurry＠telovations.com March 16, 2011

March 16, 2011

This is SS7 so there is no SBC in the mix. We have a path to fix it yet my concern is they are not accepting E.164 properly and was curious how many other SS7 peers have this same issue From: Alihan Arica [mailto:alihanarica at yahoo.com] Sent: Wednesday, March 16, 2011 3:34 PM To: Chet Curry Subject: Re: [VoiceOps] Verizon and E.164 Hi Chet, I believe that you can ask them to strip off the preceeding 1 and/or +1 from the incoming INVITE request on their Session Border Controller; I am pretty sure that your signal first hits their Session Border Controller and these boxes have such ability. Sorry, I can not provide further more information since I don't like to commend any architecture that I did not work on before. Hope this helps! ________________________________ Alihan Arica Overland Park, KC, USA --- On Wed, 3/16/11, Chet Curry <CCurry at telovations.com<mailto:CCurry at telovations.com>> wrote: From: Chet Curry <CCurry at telovations.com<mailto:CCurry at telovations.com>> Subject: [VoiceOps] Verizon and E.164 To: "voiceops at voiceops.org<mailto:voiceops at voiceops.org>" <voiceops at voiceops.org<mailto:voiceops at voiceops.org>> Date: Wednesday, March 16, 2011, 11:57 AM Many carriers request that you send sip messaging using E.164 compliant #?s. We have a TDM/SS7 peering to Verizon and we tried sending calls to them with the ?Calling? # in E.164 format. Unfortunately they see the call as International because there is a 1 prepending the 10 digit #. This makes no sense to me as international starts as 011. Has anyone had this issue with Verizon or any other carrier? [cid:image001.png at 01CBE3F5.53C652B0] -----Inline Attachment Follows----- _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org<http://us.mc393.mail.yahoo.com/mc/compose?to=VoiceOps at voiceops.org> https://puck.nether.net/mailman/listinfo/voiceops

1 0

VoIP Botnet Dirty Analysis & Speculation
by sil＠infiltrated.net March 15, 2011

March 15, 2011

Apologies for the cross-posting to lists (VoIPSA + VoiceOPS) but I thought readers would find the information interesting. While not that big of a deal, figured I'd ramble on a bit and make some noise on-list to keep everyone awake/on_yer_toes via way of security/compromises. So one of my Asterisk machines (public facing of course) gets owned yesterday. Its alright with me, its configured with the phorensix honeypot so I'm not concerned it was owned, but a few peculiarities hit me: 1) I had no account named asterisk on the machine 2) Seven unique addresses dialing the same number - all addresses are hosting providers: (cleaned up CDR for clarity) asterisk 00442070661000 default asterisk <asterisk> 50.28.8.166 Playback your-account 2011-03-14 23:57:12 2011-03-14 23:57:13 2011-03-14 23:57:13 1,0 ANSWERED DOCUMENTATION asterisk 00442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 00:34:29 2011-03-15 00:34:30 2011-03-15 00:34:30 1,0 ANSWERED DOCUMENTATION asterisk 011442070661000 default asterisk <asterisk> 69.57.170.30 Playback your-account 2011-03-15 01:51:24 2011-03-15 01:51:25 2011-03-15 01:51:25 1,0 ANSWERED DOCUMENTATION asterisk 900442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 02:30:24 2011-03-15 02:30:25 2011-03-15 02:30:25 1,0 ANSWERED DOCUMENTATION asterisk 9442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 03:47:51 2011-03-15 03:47:52 2011-03-15 03:47:52 1,0 ANSWERED DOCUMENTATION asterisk 000011442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 05:09:12 2011-03-15 05:09:13 2011-03-15 05:09:13 1,0 ANSWERED DOCUMENTATION asterisk 0011442070661000 default asterisk <asterisk> 69.16.243.1 Playback your-account 2011-03-15 05:50:45 2011-03-15 05:50:46 2011-03-15 05:50:46 1,0 ANSWERED DOCUMENTATION asterisk 8011442070661000 default asterisk <asterisk> 67.225.225.68 Playback your-account 2011-03-15 06:33:56 2011-03-15 06:33:57 2011-03-15 06:33:57 1,0 ANSWERED DOCUMENTATION asterisk 0442070661000 default asterisk <asterisk> 205.234.252.143 Playback your-account 2011-03-15 07:17:32 2011-03-15 07:17:33 2011-03-15 07:17:33 1,0 ANSWERED DOCUMENTATION 3) I'm betting this is not automated: First call, fail, second call is made 37 minutes later, fail. Third call comes in 1:17 after the second (fail) with the next call 39 minutes and so on. I thought of the possibility of automation (if, then, else) but the timing between calls make little sense. Wish I had a data munching/crunching application similar to Maltego with telecom capabilities to make sense of some of the endpoints (numbers dialed.) I'm willing to bet a cup of coffee that this is one individual (group) with likely some form of botnet or (pseudo) complex controlling mechanism that initially needs intervention and once set, would spit out thousands of calls. I'm curious to know how many others are seeing "asterisk" in active/passive attacks. I've had clients with ATAs complain "someone is calling me @ 4am with a weird caller ID (asterisk)." Anyone care to shed some light on this potential attack vector. (asterisk) Things to keep in mind on this: I have NO USER named asterisk on that box (not even in my honeypot application) but *somehow*, someone placed a call with that username. Remote exploit maybe, compromised ATA, who knows. Anyhow, They've all become entries for the blacklist for those using the list (vabl). Just wanted to get the info out as I'm leaning towards someone/somegroup with some form of meshed/interlinked C&C of sorts aimed at Asterisk deployments. 50.28.8.166 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 50.28.0.0/17 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.57.170.30 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 25653 | 69.57.160.0/19 | FORTRESSITX | US | EMLBASE.ORG | CIRTEX-CORP | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.16.243.1 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 69.16.224.0/19 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 67.225.225.68 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 67.225.192.0/18 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 205.234.252.143 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 40913 | 205.234.0.0/16 | QTS-SJC-1 | US | HOSTFORWEB.COM | HOSTFORWEB INC | 011442070661000 -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Humbug labs
by sil＠infiltrated.net March 9, 2011

March 9, 2011

Sorry for the xposting to lists... Can someone put someone @ Humbug (in the know) in touch with me... They have a security issue (client disclosure). Sort of to busy to dig out a point of contact. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

2 1

SIP options "ping"
by steti＠monmouth.com March 4, 2011

March 4, 2011

On 3/3/2011 10:51 AM, ed guy wrote: > Steve, > try sipsak. > /ed Thanks, that looks like just what I needed! This is going to integrate into an existing monitoring solution (not nagios), so the nagios plugins that others recommended is overkill for me.

6 8

SIP options "ping"
by jjackson＠aninetworks.net March 3, 2011

March 3, 2011

We use smokeping to measure loss and latency and have a wrapper for sipsak to do the sip ping. Smomepkng is great stuff. Sent via DROID on Verizon Wireless -----Original message----- From: Steve Teti <steti at monmouth.com> To: "VoiceOps at voiceops.org" <VoiceOps at voiceops.org> Sent: Thu, Mar 3, 2011 15:51:28 GMT+00:00 Subject: [VoiceOps] SIP options "ping" I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

1 0

SIP options "ping"
by steti＠monmouth.com March 3, 2011

March 3, 2011

I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve

5 4