My network was attacked

mea2214
Posts: 9
Member Since:
2010-04-01

I'm posting this here because I can't find where the freeswitch forums are but even though this is kind of interesting, it's also pretty scary and my subnet that hosts my little VOIP telephone network is currently out of service. I'm running a Linux server with a lot of memory that runs VMWare Workstation. All my trixboxes and other PBXs run in their own virtual machine making it easy for me to network lots of them in all kinds of configurations. I'm still learning this. I started with trixbox and that's my main PBX and one of my trixboxes is even trunked into an ITSP so I can call into the outside world and the outside world can call into me. Over the past months I've gotten very familiar with asterisk and how trixbox does things. I have also tried out other PBXes like Digium and Sip foundry just to see how they work.

Freeswitch has been on my radar for quite awhile and I had it compiled in a couple of VMs and on the Linux host that runs the VMWare which supports all the VMs. Since I had the Freeswitch already compiled on the host I decided to fire it up into the default configuration. The default config worked and I even trunked it into a local trixbox serving as a VOIP provider and that worked. The XML config is kind of complicated so I'm far from figuring it out yet.

I then installed FreePBX to see how that works with the FreeSwitch compared to how it works with trixbox and AteriskNOW. The install went OK -- there were some issues with FreePBX that I really didn't like but I digress. After getting FreePBX almost working I went to take the dog for a walk and came back and saw the lights on my router were blinking furiously which is never a good sign. :I usually have wireshark running all the time. I went to check wireshark and there were so many messages so fast it crashed and my Linux server was sluggish.

I was getting SIP Register requests to the FreeSwitch from the same IP address in the 58.20.0.0 network which is from Beijing China. I have absolutely no idea how they found out about this installation. I run my own DNS server for all the PBXs and I constantly make sure no errant DNS requests ever make it to a public DNS server. The FreeSwitch was in its default config but after I loaded FreePBX it changed the configuration (which I really didn't like) and I'm not sure what it did. Something had to have sent out a notification to the Chinese in order for them to know my stupid unconfigured freeswitch even existed. Ironically, they were probably looking for free phone calls and they should have hit the trixbox that was actually configured to the outside world.

I have two IPs on my DSL line and the IP that's hooked to the subnet with the VOIP network is currently down but my other IP is working which is why I can post this. Apparently my ISP saw that traffic and cut it off and put that IP out of service. I'm going to work with them today to get back up and running but I'm a little worried about this. Had I been a consultant on a real VOIP install and this happened it would have been a disaster. Not only did a goofball in China take down my phone network, they could have taken down my entire network and Internet. access.

I'm posting this story here in the hopes that someone has some insights into what I might have done wrong and how I can avoid something like this happening again.



antidelldude
Posts: 287
Member Since:
2009-05-18
This happens all the time.

This happens all the time. You are lucky you didn't have any trunks on the server for the bot to take advantage of. There are bot nets CONSTANTLY scanning the internet looking for servers to take advantage of. Nothing you installed "notified the Chinese" in a direct way. You need to have a hardened server before you place it on the internet. There are plenty of guides floating around the internet that show how to harden linux and trixbox/any freepbx distro. You need to change all the management passwords, change port ranges, don't open ANYTHING to the internet if you don't have to (no web interfaces!), install fail2ban, install bfd, etc....

--

Regards,
Jon
Please respond if your problem was ever solved, and how you solved it. It'll help the next guy.



mea2214
Posts: 9
Member Since:
2010-04-01
Re: This happens all the time

I should add that everything sits behind an el cheapo consumer grade Linksys router so the server is assigned to a private IP on the 192.168.1.0 subnet. How would a bot scan this server? The SIP port 5060 was actually forwarded to the trixbox that supports the external trunks which is on its own static private IP. Somehow the hackers changed the port forwarding to send all the Register requests on port 5060 to the FreeSwitch instead of the trixbox. I find it curious that this happened right after installing FreePBX. I think the coincidence behind this is rather curious. I've been running my own mail and web servers since I got DSL in 2001 and have seen some attacks but nothing to this scale. I regularly check the router bounce logs and see the bots but nothing ever gets through the D-Link router. Ever since I started this VOIP project I've been continuously monitoring this network and I've never seen a bot get through to scan anything in the network (although I only look at samples of traffic).

Granted I have UPnP turned on the Linksys router (the router on the other subnet that has the mail and web server has UPnP off) but I would assume that something inside my network changed the port forwarding. Since I was working on the FreePBX installation, and then this happened, when nothing like this has happened in the last 3 months working with trixboxes and other pbxs, and nothing like this bad in the last 9 years of running my own network, I can only assume that FreePBX actively did something but I don't know what since wireshark crashed losing all the traffic data.

I also realized how crappy a router Linksys is since it wouldn't even block IP ranges that would have perhaps helped out a lot. I'm going to be looking for a much better router for this subnet -- that is if I ever get it up and running again. I'm glad I didn't put the VOIP network on the same subnet with the web and mail servers.



efx456
Posts: 132
Member Since:
2009-09-01
deleted

deleted



tuaris
Posts: 12
Member Since:
2008-01-04
Same thing is happening to me at this moment

I'm getting thousands of UDP packets per second from a single IP address (75.101.244.9). They look like SIP registration requests.

The IP belongs to Amazon's EC2 cloud computing services. It's impossible to tell if this is maliciousness or a fluke. I tried calling up Amazon's abuse department, but apparently one does not exist. I got customer support instead, and they were un-helpful. My ISP can't do anything other than shut off the T1 circuit (which I don't want). At one time my PBX had about 6600+ channels open. All of them REGISTER messages.

I have my firewall dropping the packets, but this UDP flood is using up 90% of my downstream bandwidth.

--

President/CEO
Pacy World
http://www.pacyworld.com



Obzorg
Posts: 55
Member Since:
2009-06-23
Amazon EC2

I had the same problem a few weeks ago. A host in Amazon's EC2 cloud was sending 200 registration attempts per second. Nothing was successful but it was effectively a Denial of Service attack. I blocked 5060 on the firewall and tried notifying Amazon via their abuse email address but got an automated reply saying that I should fill out a form on their site to report abuse. I filled out the form with all of the details they asked for only to get an error when I tried submitting it. I tried multiple times but it looked like their abuse reporting system is broken.

I ended up installing fail2ban and opened 5060 again.



stonet
Posts: 103
Member Since:
2008-02-28
I have had attacks three

I have had attacks three times from the Amazon cloud, the latest was yesterday from IP 204.236.211.33. I have reported it to Amazon abuse:

RAbuseName: Amazon EC2 Abuse
RAbusePhone: +1-206-266-4064
RAbuseEmail: ec2-abuse@amazon.com

hopefully they will do something about it!

It really is essential to have fail2ban active, that catches these attacks and bans the ip address after the first attempts.

Installing Fail2ban is simple:

Follow the instructions at http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk exactly and once done add the following line to /etc/fail2ban/filter.d/asterisk.conf under the failregex section:

NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register

Hope this helps



mea2214
Posts: 9
Member Since:
2010-04-01
Update

It looks like I need to buy a new router that does proper firewalling and keeps timestamped logs. Since my attacker uses the same IP, once I get a proper firewall I can drop my DOS attacker into a black hole and be done with them. They're still out there pounding away at my router but port 5060 is blocked. Luckily, for me, this is just an experimental network so I can do without the external trunks for awhile. Now whenever I open 5060 up the attacker slams the trixbox relentlessly. The tech people at my ISP said to send them a snippet of my router logs (with 5060 blocked) and they'll look into it but since my current router doesn't keep proper logs, I have to wait until I get a new router. I'm not sure what they can do since my attacker is from China. Once I do get proper logging it will be fascinating to see who's doing what on the other side of that router. It appears these VOIP PBXs are magnets to hackers and naerdowells.

Thanks for the info on fail2ban. That sounds like a useful thing to have. What I can't understand is the motivation behind these DOS attacks. If someone wanted to break into a box wouldn't it be better to be a little sneaky and send register attempts say once every five seconds or so that would probably go unnoticed? By slamming the box with a DOS they expose themselves fairly quickly and for what purpose? I have ports 25 and 80 open all the time and if they want to DOS me it would be fairly simple using them as well. If they're trying to exploit a buffer overflow, is there a vulnerability to this with the trixbox or any other open sourced VOIP PBX?

Now that I have my attacker cordoned off on the other side of the router I might play with him/her for awhile by setting up a trixbox for him/her to exploit. When the DOSer tried to hit my freeswitch they didn't get anywhere because I didn't even get to the point of opening up that port in the firewall. Which still puzzles me. Why when they knew that port was blocked didn't they employ some patience and wait for it to eventually open?

BTW: Not that it matters but, after a little investigation, I think freeswitch changed my port forwarding using UPnP. I saw that it does check UPnP upon boot up so I assume that it must have made the change (something other than me did). Since I hard coded the port forwarding in the router I never thought that UPnP could change that port. In the end I guess it turned out to be a good thing but I disabled UPnP regardless.



mea2214
Posts: 9
Member Since:
2010-04-01
Update

It looks like I need to buy a new router that does proper firewalling and keeps timestamped logs. Since my attacker uses the same IP, once I get a proper firewall I can drop my DOS attacker into a black hole and be done with them. They're still out there pounding away at my router but port 5060 is blocked. Luckily, for me, this is just an experimental network so I can do without the external trunks for awhile. Now whenever I open 5060 up the attacker slams the trixbox relentlessly. The tech people at my ISP said to send them a snippet of my router logs (with 5060 blocked) and they'll look into it but since my current router doesn't keep proper logs, I have to wait until I get a new router. I'm not sure what they can do since my attacker is from China. Once I do get proper logging it will be fascinating to see who's doing what on the other side of that router. It appears these VOIP PBXs are magnets to hackers and naerdowells.

Thanks for the info on fail2ban. That sounds like a useful thing to have. What I can't understand is the motivation behind these DOS attacks. If someone wanted to break into a box wouldn't it be better to be a little sneaky and send register attempts say once every five seconds or so that would probably go unnoticed? By slamming the box with a DOS they expose themselves fairly quickly and for what purpose? I have ports 25 and 80 open all the time and if they want to DOS me it would be fairly simple using them as well. If they're trying to exploit a buffer overflow, is there a vulnerability to this with the trixbox or any other open sourced VOIP PBX?

Now that I have my attacker cordoned off on the other side of the router I might play with him/her for awhile by setting up a trixbox for him/her to exploit. When the DOSer tried to hit my freeswitch they didn't get anywhere because I didn't even get to the point of opening up that port in the firewall. Which still puzzles me. Why when they knew that port was blocked didn't they employ some patience and wait for it to eventually open?

BTW: Not that it matters but, after a little investigation, I think freeswitch changed my port forwarding using UPnP. I saw that it does check UPnP upon boot up so I assume that it must have made the change (something other than me did). Since I hard coded the port forwarding in the router I never thought that UPnP could change that port. In the end I guess it turned out to be a good thing but I disabled UPnP regardless.



gianthobbit
Posts: 39
Member Since:
2007-03-19
58.20.0.0 seems to be from

58.20.0.0 seems to be from AU. Australia?



mea2214
Posts: 9
Member Since:
2010-04-01
You're right

This is very weird. I'm getting different results depending upon which host I do the whois. The host where I originally did whois returned (and still does return) the following:

[mea@soyoserver ~]$ whois 58.20.61.56
[Querying whois.apnic.net]
[whois.apnic.net]
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 58.20.0.0 - 58.20.127.255
netname: changshacnc
country: CN
descr: CNC Group HuNan ChangSha network
descr: NO.376 , YouYi Street,
descr: ChangSha 410004
admin-c: CH444-AP
tech-c: CH444-AP
status: ASSIGNED NON-PORTABLE
changed: zoulei@chinaunicom.cn 20090104
mnt-by: MAINT-CNCGROUP-HN
source: APNIC

route: 58.20.0.0/16
descr: CNCGroup HuNan province network
country: CN
origin: AS9929
mnt-by: MAINT-CNCGROUP-RR
changed: hm-changed@apnic.net 20050427
source: APNIC

route: 58.20.0.0/16
descr: CNC Group CHINA169 Hunan Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: abuse@cnc-noc.net 20060601
source: APNIC

person: CNCGroup Hostmaster
nic-hdl: CH444-AP
e-mail: abuse@cnc-noc.net
address: No.156,Fu-Xing-Men-Nei Street,
address: Beijing,100031,P.R.China
phone: +86-10-82993155
fax-no: +86-10-82993144
country: CN
changed: abuse@cnc-noc.net 20041220
mnt-by: MAINT-CNCGROUP
source: APNIC

When I do a whois from brandylion, my web and mail server I get:

[mea@brandylion mea]$ whois 58.20.61.56
[Querying whois.arin.net]
[whois.arin.net]

OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU
ReferralServer: whois://whois.apnic.net

NetRange: 58.0.0.0 - 58.255.255.255
CIDR: 58.0.0.0/8
NetName: APNIC-58
NetHandle: NET-58-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS2.LACNIC.NET
NameServer: NS-SEC.RIPE.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://wq.apnic.net/apnic-bin/whois.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming
RegDate: 2004-05-04
Updated: 2009-10-08

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3188
OrgTechEmail: search-apnic-not-arin@apnic.net

# ARIN WHOIS database, last updated 2010-04-13 20:00
# Enter ? for additional hints on searching ARIN's WHOIS database.
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at https://www.arin.net/whois_tou.html

If it matters, the brandylion server is using a different DNS server than soyo. They have their main and backups reversed but both DNS servers are my ISP's.



Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.