- VoiceOps - lists.voiceops.org

Verizon and E.164
by CCurry＠telovations.com March 16, 2011

March 16, 2011

This is SS7 so there is no SBC in the mix. We have a path to fix it yet my concern is they are not accepting E.164 properly and was curious how many other SS7 peers have this same issue From: Alihan Arica [mailto:alihanarica at yahoo.com] Sent: Wednesday, March 16, 2011 3:34 PM To: Chet Curry Subject: Re: [VoiceOps] Verizon and E.164 Hi Chet, I believe that you can ask them to strip off the preceeding 1 and/or +1 from the incoming INVITE request on their Session Border Controller; I am pretty sure that your signal first hits their Session Border Controller and these boxes have such ability. Sorry, I can not provide further more information since I don't like to commend any architecture that I did not work on before. Hope this helps! ________________________________ Alihan Arica Overland Park, KC, USA --- On Wed, 3/16/11, Chet Curry <CCurry at telovations.com<mailto:CCurry at telovations.com>> wrote: From: Chet Curry <CCurry at telovations.com<mailto:CCurry at telovations.com>> Subject: [VoiceOps] Verizon and E.164 To: "voiceops at voiceops.org<mailto:voiceops at voiceops.org>" <voiceops at voiceops.org<mailto:voiceops at voiceops.org>> Date: Wednesday, March 16, 2011, 11:57 AM Many carriers request that you send sip messaging using E.164 compliant #?s. We have a TDM/SS7 peering to Verizon and we tried sending calls to them with the ?Calling? # in E.164 format. Unfortunately they see the call as International because there is a 1 prepending the 10 digit #. This makes no sense to me as international starts as 011. Has anyone had this issue with Verizon or any other carrier? [cid:image001.png at 01CBE3F5.53C652B0] -----Inline Attachment Follows----- _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org<http://us.mc393.mail.yahoo.com/mc/compose?to=VoiceOps at voiceops.org> https://puck.nether.net/mailman/listinfo/voiceops

1 0

VoIP Botnet Dirty Analysis & Speculation
by sil＠infiltrated.net March 15, 2011

March 15, 2011

Apologies for the cross-posting to lists (VoIPSA + VoiceOPS) but I thought readers would find the information interesting. While not that big of a deal, figured I'd ramble on a bit and make some noise on-list to keep everyone awake/on_yer_toes via way of security/compromises. So one of my Asterisk machines (public facing of course) gets owned yesterday. Its alright with me, its configured with the phorensix honeypot so I'm not concerned it was owned, but a few peculiarities hit me: 1) I had no account named asterisk on the machine 2) Seven unique addresses dialing the same number - all addresses are hosting providers: (cleaned up CDR for clarity) asterisk 00442070661000 default asterisk <asterisk> 50.28.8.166 Playback your-account 2011-03-14 23:57:12 2011-03-14 23:57:13 2011-03-14 23:57:13 1,0 ANSWERED DOCUMENTATION asterisk 00442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 00:34:29 2011-03-15 00:34:30 2011-03-15 00:34:30 1,0 ANSWERED DOCUMENTATION asterisk 011442070661000 default asterisk <asterisk> 69.57.170.30 Playback your-account 2011-03-15 01:51:24 2011-03-15 01:51:25 2011-03-15 01:51:25 1,0 ANSWERED DOCUMENTATION asterisk 900442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 02:30:24 2011-03-15 02:30:25 2011-03-15 02:30:25 1,0 ANSWERED DOCUMENTATION asterisk 9442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 03:47:51 2011-03-15 03:47:52 2011-03-15 03:47:52 1,0 ANSWERED DOCUMENTATION asterisk 000011442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 05:09:12 2011-03-15 05:09:13 2011-03-15 05:09:13 1,0 ANSWERED DOCUMENTATION asterisk 0011442070661000 default asterisk <asterisk> 69.16.243.1 Playback your-account 2011-03-15 05:50:45 2011-03-15 05:50:46 2011-03-15 05:50:46 1,0 ANSWERED DOCUMENTATION asterisk 8011442070661000 default asterisk <asterisk> 67.225.225.68 Playback your-account 2011-03-15 06:33:56 2011-03-15 06:33:57 2011-03-15 06:33:57 1,0 ANSWERED DOCUMENTATION asterisk 0442070661000 default asterisk <asterisk> 205.234.252.143 Playback your-account 2011-03-15 07:17:32 2011-03-15 07:17:33 2011-03-15 07:17:33 1,0 ANSWERED DOCUMENTATION 3) I'm betting this is not automated: First call, fail, second call is made 37 minutes later, fail. Third call comes in 1:17 after the second (fail) with the next call 39 minutes and so on. I thought of the possibility of automation (if, then, else) but the timing between calls make little sense. Wish I had a data munching/crunching application similar to Maltego with telecom capabilities to make sense of some of the endpoints (numbers dialed.) I'm willing to bet a cup of coffee that this is one individual (group) with likely some form of botnet or (pseudo) complex controlling mechanism that initially needs intervention and once set, would spit out thousands of calls. I'm curious to know how many others are seeing "asterisk" in active/passive attacks. I've had clients with ATAs complain "someone is calling me @ 4am with a weird caller ID (asterisk)." Anyone care to shed some light on this potential attack vector. (asterisk) Things to keep in mind on this: I have NO USER named asterisk on that box (not even in my honeypot application) but *somehow*, someone placed a call with that username. Remote exploit maybe, compromised ATA, who knows. Anyhow, They've all become entries for the blacklist for those using the list (vabl). Just wanted to get the info out as I'm leaning towards someone/somegroup with some form of meshed/interlinked C&C of sorts aimed at Asterisk deployments. 50.28.8.166 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 50.28.0.0/17 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.57.170.30 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 25653 | 69.57.160.0/19 | FORTRESSITX | US | EMLBASE.ORG | CIRTEX-CORP | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.16.243.1 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 69.16.224.0/19 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 67.225.225.68 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 67.225.192.0/18 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 205.234.252.143 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 40913 | 205.234.0.0/16 | QTS-SJC-1 | US | HOSTFORWEB.COM | HOSTFORWEB INC | 011442070661000 -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Humbug labs
by sil＠infiltrated.net March 9, 2011

March 9, 2011

Sorry for the xposting to lists... Can someone put someone @ Humbug (in the know) in touch with me... They have a security issue (client disclosure). Sort of to busy to dig out a point of contact. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

2 1

SIP options "ping"
by steti＠monmouth.com March 5, 2011

March 5, 2011

On 3/3/2011 10:51 AM, ed guy wrote: > Steve, > try sipsak. > /ed Thanks, that looks like just what I needed! This is going to integrate into an existing monitoring solution (not nagios), so the nagios plugins that others recommended is overkill for me.

6 8

SIP options "ping"
by jjackson＠aninetworks.net March 3, 2011

March 3, 2011

We use smokeping to measure loss and latency and have a wrapper for sipsak to do the sip ping. Smomepkng is great stuff. Sent via DROID on Verizon Wireless -----Original message----- From: Steve Teti <steti at monmouth.com> To: "VoiceOps at voiceops.org" <VoiceOps at voiceops.org> Sent: Thu, Mar 3, 2011 15:51:28 GMT+00:00 Subject: [VoiceOps] SIP options "ping" I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

1 0

SIP options "ping"
by steti＠monmouth.com March 3, 2011

March 3, 2011

I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve

5 4

Bandwidth.com one-way audio?
by bbridges＠ifbyphone.com March 1, 2011

March 1, 2011

Anyone else seeing a rash of one-way audio across the board with bandwidth.com this morning? We're getting it on orig and term in random areas all over the place... -- Brooks R. Bridges Telecommunications Manager Ifbyphone, Inc. Phone: (847) 983-3000 Fax: (847) 676-6553 bbridges at ifbyphone.com http://www.ifbyphone.com

1 0

IAM Signals
by clec＠cygnustel.com Feb. 28, 2011

Feb. 28, 2011

I am trying to figure out where the excess of IAM messages is coming from. We get billed for every signal and my bills recently have been saying: SIGNAL SWITCHING...IAM...TERMINATING SIGNALS = 345 SIGNAL FORMULATION...IAM...TERMINATING SIGNALS = 254,181 SIGNAL TNDM SWITCHING...IAM...TERMINATING SIGNALS = 254,181 Is this the count of IAM messages that I am sending to the tandem then? IE. I would have to make 254,181 calls outbound to generate these? Or are these IAM messages inbound and outbound? Is the ratio 1:1 as far as IAM to Calls? Sorry for all the questions, I am just unsure on the IAM details. Thanks! -Eric

3 2

Toll Free Origination Issues Level 3
by robert.dawson＠mindshift.com Feb. 28, 2011

Feb. 28, 2011

Anyone having problems with numbers ringing to an out of service notice?

4 3

Level3 & TATA issues
by owen＠impulse.net Feb. 24, 2011

Feb. 24, 2011

Seeing multiple outages with both Level3 and much of TATA is also affected. Anyone have details? -Owen -- _________ Senior Network Engineer Impulse Advanced Communications 805-884-6332 owen at impulse.net

2 1