- VoiceOps - lists.voiceops.org

VoIP Botnet Dirty Analysis & Speculation
by sil＠infiltrated.net March 15, 2011

March 15, 2011

Apologies for the cross-posting to lists (VoIPSA + VoiceOPS) but I thought readers would find the information interesting. While not that big of a deal, figured I'd ramble on a bit and make some noise on-list to keep everyone awake/on_yer_toes via way of security/compromises. So one of my Asterisk machines (public facing of course) gets owned yesterday. Its alright with me, its configured with the phorensix honeypot so I'm not concerned it was owned, but a few peculiarities hit me: 1) I had no account named asterisk on the machine 2) Seven unique addresses dialing the same number - all addresses are hosting providers: (cleaned up CDR for clarity) asterisk 00442070661000 default asterisk <asterisk> 50.28.8.166 Playback your-account 2011-03-14 23:57:12 2011-03-14 23:57:13 2011-03-14 23:57:13 1,0 ANSWERED DOCUMENTATION asterisk 00442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 00:34:29 2011-03-15 00:34:30 2011-03-15 00:34:30 1,0 ANSWERED DOCUMENTATION asterisk 011442070661000 default asterisk <asterisk> 69.57.170.30 Playback your-account 2011-03-15 01:51:24 2011-03-15 01:51:25 2011-03-15 01:51:25 1,0 ANSWERED DOCUMENTATION asterisk 900442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 02:30:24 2011-03-15 02:30:25 2011-03-15 02:30:25 1,0 ANSWERED DOCUMENTATION asterisk 9442070661000 default asterisk <asterisk> 174.132.230.26 Playback your-account 2011-03-15 03:47:51 2011-03-15 03:47:52 2011-03-15 03:47:52 1,0 ANSWERED DOCUMENTATION asterisk 000011442070661000 default asterisk <asterisk> 216.14.117.32 Playback your-account 2011-03-15 05:09:12 2011-03-15 05:09:13 2011-03-15 05:09:13 1,0 ANSWERED DOCUMENTATION asterisk 0011442070661000 default asterisk <asterisk> 69.16.243.1 Playback your-account 2011-03-15 05:50:45 2011-03-15 05:50:46 2011-03-15 05:50:46 1,0 ANSWERED DOCUMENTATION asterisk 8011442070661000 default asterisk <asterisk> 67.225.225.68 Playback your-account 2011-03-15 06:33:56 2011-03-15 06:33:57 2011-03-15 06:33:57 1,0 ANSWERED DOCUMENTATION asterisk 0442070661000 default asterisk <asterisk> 205.234.252.143 Playback your-account 2011-03-15 07:17:32 2011-03-15 07:17:33 2011-03-15 07:17:33 1,0 ANSWERED DOCUMENTATION 3) I'm betting this is not automated: First call, fail, second call is made 37 minutes later, fail. Third call comes in 1:17 after the second (fail) with the next call 39 minutes and so on. I thought of the possibility of automation (if, then, else) but the timing between calls make little sense. Wish I had a data munching/crunching application similar to Maltego with telecom capabilities to make sense of some of the endpoints (numbers dialed.) I'm willing to bet a cup of coffee that this is one individual (group) with likely some form of botnet or (pseudo) complex controlling mechanism that initially needs intervention and once set, would spit out thousands of calls. I'm curious to know how many others are seeing "asterisk" in active/passive attacks. I've had clients with ATAs complain "someone is calling me @ 4am with a weird caller ID (asterisk)." Anyone care to shed some light on this potential attack vector. (asterisk) Things to keep in mind on this: I have NO USER named asterisk on that box (not even in my honeypot application) but *somehow*, someone placed a call with that username. Remote exploit maybe, compromised ATA, who knows. Anyhow, They've all become entries for the blacklist for those using the list (vabl). Just wanted to get the info out as I'm leaning towards someone/somegroup with some form of meshed/interlinked C&C of sorts aimed at Asterisk deployments. 50.28.8.166 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 50.28.0.0/17 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.57.170.30 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 25653 | 69.57.160.0/19 | FORTRESSITX | US | EMLBASE.ORG | CIRTEX-CORP | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 174.132.230.26 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 21844 | 174.132.0.0/15 | THEPLANET-AS | US | THEPLANET.COM | THEPLANET.COM INTERNET SERVICES INC | 011442070661000 216.14.117.32 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 46433 | 216.14.117.0/24 | ADF01 | US | EBOUNDHOST.COM | EBOUNDHOST.COM | 011442070661000 69.16.243.1 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 69.16.224.0/19 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 67.225.225.68 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 32244 | 67.225.192.0/18 | LIQUID-WEB-INC | US | LIQUIDWEB.COM | LIQUID WEB INC | 011442070661000 205.234.252.143 | ADN | VABL | 201100314 | 83fdfc21afed8786fcf4c09fd06672f7 | 40913 | 205.234.0.0/16 | QTS-SJC-1 | US | HOSTFORWEB.COM | HOSTFORWEB INC | 011442070661000 -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF

1 0

Humbug labs
by sil＠infiltrated.net March 9, 2011

March 9, 2011

Sorry for the xposting to lists... Can someone put someone @ Humbug (in the know) in touch with me... They have a security issue (client disclosure). Sort of to busy to dig out a point of contact. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

2 1

SIP options "ping"
by steti＠monmouth.com March 4, 2011

March 4, 2011

On 3/3/2011 10:51 AM, ed guy wrote: > Steve, > try sipsak. > /ed Thanks, that looks like just what I needed! This is going to integrate into an existing monitoring solution (not nagios), so the nagios plugins that others recommended is overkill for me.

6 8

SIP options "ping"
by jjackson＠aninetworks.net March 3, 2011

March 3, 2011

We use smokeping to measure loss and latency and have a wrapper for sipsak to do the sip ping. Smomepkng is great stuff. Sent via DROID on Verizon Wireless -----Original message----- From: Steve Teti <steti at monmouth.com> To: "VoiceOps at voiceops.org" <VoiceOps at voiceops.org> Sent: Thu, Mar 3, 2011 15:51:28 GMT+00:00 Subject: [VoiceOps] SIP options "ping" I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops

1 0

SIP options "ping"
by steti＠monmouth.com March 3, 2011

March 3, 2011

I'm trying to find a way to monitor the status of the SIP service on some Asterisk servers. I had a situation the other day where the daemon was running, but hung, and would not respond to requests. ICMP pings to the machine worked, as did monitoring of the process list, but the machine would not respond to SIP requests. I found this draft during my research: http://tools.ietf.org/html/draft-jones-sip-options-ping-02 Anyone know of a unix utility that can easily send a SIP OPTIONS request to a remote server and return the results in a useful format? I could probably construct one using Net::SIP in perl, but I like to take the easy way out when possible :). Thanks, Steve

5 4

Bandwidth.com one-way audio?
by bbridges＠ifbyphone.com March 1, 2011

March 1, 2011

Anyone else seeing a rash of one-way audio across the board with bandwidth.com this morning? We're getting it on orig and term in random areas all over the place... -- Brooks R. Bridges Telecommunications Manager Ifbyphone, Inc. Phone: (847) 983-3000 Fax: (847) 676-6553 bbridges at ifbyphone.com http://www.ifbyphone.com

1 0

IAM Signals
by clec＠cygnustel.com Feb. 28, 2011

Feb. 28, 2011

I am trying to figure out where the excess of IAM messages is coming from. We get billed for every signal and my bills recently have been saying: SIGNAL SWITCHING...IAM...TERMINATING SIGNALS = 345 SIGNAL FORMULATION...IAM...TERMINATING SIGNALS = 254,181 SIGNAL TNDM SWITCHING...IAM...TERMINATING SIGNALS = 254,181 Is this the count of IAM messages that I am sending to the tandem then? IE. I would have to make 254,181 calls outbound to generate these? Or are these IAM messages inbound and outbound? Is the ratio 1:1 as far as IAM to Calls? Sorry for all the questions, I am just unsure on the IAM details. Thanks! -Eric

3 2

Toll Free Origination Issues Level 3
by robert.dawson＠mindshift.com Feb. 28, 2011

Feb. 28, 2011

Anyone having problems with numbers ringing to an out of service notice?

4 3

Level3 & TATA issues
by owen＠impulse.net Feb. 24, 2011

Feb. 24, 2011

Seeing multiple outages with both Level3 and much of TATA is also affected. Anyone have details? -Owen -- _________ Senior Network Engineer Impulse Advanced Communications 805-884-6332 owen at impulse.net

2 1

RE 3. ACMEs SIP Dynamic HNT (Ujjval Karihaloo)
by CCurry＠telovations.com Feb. 23, 2011

Feb. 23, 2011

We use Dynamic HNT. Feature works good and I have not seen an issue regarding this specific feature. Other firewall issues can cause this feature to be null because the firewall manipulates the sip messaging. All of our sip clients honor our sip expires timer hence we have no issues. -----Original Message----- From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of voiceops-request at voiceops.org Sent: Wednesday, February 23, 2011 6:12 PM To: voiceops at voiceops.org Subject: VoiceOps Digest, Vol 20, Issue 21 Send VoiceOps mailing list submissions to voiceops at voiceops.org To subscribe or unsubscribe via the World Wide Web, visit https://puck.nether.net/mailman/listinfo/voiceops or, via email, send a message with subject or body 'help' to voiceops-request at voiceops.org You can reach the person managing the list at voiceops-owner at voiceops.org When replying, please edit your Subject line so it is more specific than "Re: Contents of VoiceOps digest..." Today's Topics: 1. Re: Screwy DSL modem NAT troubles (Scott Berkman) 2. Question for VoiceOps: Platform Monitoring (Reid Stidolph) 3. ACMEs SIP Dynamic HNT (Ujjval Karihaloo) ---------------------------------------------------------------------- Message: 1 Date: Wed, 23 Feb 2011 13:13:43 -0500 From: "Scott Berkman" <scott at sberkman.net> To: "'anorexicpoodle'" <anorexicpoodle at gmail.com>, "'Carlos Alcantar'" <carlos at race.com> Cc: VoiceOps at voiceops.org Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles Message-ID: <00a501cbd385$67f26100$37d72300$(a)sberkman.net> Content-Type: text/plain; charset="utf-8" My favorite was the Netopia modems ATT/BS was deploying for some time with all their Business DSL circuits (anything with a static IP) that had an ?undocumented? ALG that could be disabled via the CLI but not the GUI, but it defaulted to on. It was of course horribly broken. -Scott From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of anorexicpoodle Sent: Tuesday, February 22, 2011 2:28 AM To: Carlos Alcantar Cc: VoiceOps at voiceops.org Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles Ill second Alex's sentiment on abandoning port 5060 and make the traffic look like something other than SIP so the ALG doesn't get triggered. We've been doing this for years, works like a charm. Speaking of, if anyone from Linksys, D-Link or any other residential grade router manufacturer is out there listening, you have obviously devoted time and effort to coding these ALG's, why not make them work? I would love to hear why it seems there is a concentrated effort to absolutely break voip with atrociously coded ALG's. On Mon, 2011-02-21 at 22:19 -0800, Carlos Alcantar wrote: Linksys ALG seems to break everything sip on the firewall side sonicwall seems to be the death of sip. Carlos Alcantar Race Communications / Race Team Member 101 Haskins Way, So. San Francisco, CA. 94080 Phone: +1 415 376 3314 Fax: +1 650 246 8901 / carlos *at* race.com / www.race.com -----Original Message----- From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of Carlos Alvarez Sent: Monday, February 21, 2011 3:08 PM Cc: voiceops Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles We go through this all the time with Qwest DSL customers. Unfortunately I don't have model numbers for you, we stopped documenting things when we noticed that they have all new modems every few months. However we've had success with having the customer call Qwest and tell them they want to run VoIP phones, the Qwest reps seem to know that as a trigger and send a compatible modem. I do recall that the best ones are Netopia, and we've had good support when we engage them directly via chat. We also find that modems start going bad slowly after a couple years, and VoIP is the first to get impacted, of course. Matthew S. Crocker wrote: > Has anyone else noticed that the latest batch of DSL modems have broken NAT when it comes to VoIP? I'm seeing stable VoIP customer get broken when the DSL modem is swapped out. The modem NATs the phones to modem IP port 5060. So, 10 phones behind the router become one phone to the SBC. A race condition occurs and phones go in and out of service at random. It looks like the router is trying to do a SIP ALG but very very broken. > > Do anyone have a DSL modem/router they use that works well with VoIP? >

1 0