<div>I agree with Zoltan's email on this. I am not the first one to experience this , still Cisco does not warn or inform about SIP/H.323 open on CME for mis use. We were not using SIP , still some one was able to get on to the router through the WAN and make use of SIP on the router. I think Cisco should clearly state this during the installation/Configuration of CME.</div>
<div>
<div> </div>
<div> </div>
<div>Aman</div><br><br> </div>
<div><span class="gmail_quote">On 6/7/08, <b class="gmail_sendername">Jason Aarons (US)</b> <<a href="mailto:jason.aarons@us.didata.com">jason.aarons@us.didata.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I would recommend running a port/security scanner on your own subnet,<br>you mind find other unexpected results.<br>
<br>It wasn't clear if these are outside your firewall.<br><br>-----Original Message-----<br>From: <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>[mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of<br>
<a href="mailto:keli@carocomp.ro">keli@carocomp.ro</a><br>Sent: Saturday, June 07, 2008 4:20 AM<br>To: James Buchanan<br>Cc: cisco voip<br>Subject: Re: [cisco-voip] has anyone seen this !<br><br>Basically I agree with you, and I think all of us who faced the<br>
problem have learned our lesson the hard way ... :/<br><br>But the issue here is a bit different, I'd say:<br>Cisco is running SIP and H.323 services by default, once CME is<br>configured. Cisco CME is *routing* incoming SIP/H.323 calls<br>
indiscriminately, also *by default*. The key thing being that your<br>appliance (Cisco CME router in this case) makes things you're not<br>configured it specifically to do. Where we hit this thing, we didn't<br>used any SIP services, and the router was configured from blank, so I<br>
did not expect any SIP service to be running on it.<br><br>It's funny, that on local side Cisco considers their stuff so<br>"secure", that an auto-registered SCCP phone will not get tone, and<br>won't be able to call anywhere, but then again a blind incoming SIP<br>
packet can pass through the router as they wish...<br><br>If you consider, that CME systems come integrated into routers, so<br>they are very likely to be used as such in low-budget environments.<br>It's very possible that the people installing it are not some<br>
extremely experienced telephony and/or networking experts (Cisco's<br>target for CME is expected to be able to use/configure CME through the<br>web interface). So while it is certainly a bad decision to deploy it<br>that way, it's not by a mile such an unlikely one.<br>
<br>sorry for the rant. :)<br><br>regards,<br> Zoltan<br><br>Quoting James Buchanan <<a href="mailto:jbuchanan@ctiusa.com">jbuchanan@ctiusa.com</a>>:<br><br>> I find it puzzling why anyone would put their production telephone<br>
> system on the Internet with no apparent security measures, not even an<br>> access list. Cisco should restrict this I suppose, but some basic<br>> network security practices should also have been followed in this case<br>
> during implementation.<br>><br>><br>><br>> From: <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>> [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Aman Chugh<br>
> Sent: Friday, June 06, 2008 10:50 PM<br>> To: Kelemen Zoltan<br>> Cc: cisco voip<br>> Subject: Re: [cisco-voip] has anyone seen this !<br>><br>><br>><br>> Yes , exactly I was told the same thing and customer is facing a huge<br>
> bill.<br>><br>><br>><br>> On 6/6/08, Kelemen Zoltan <<a href="mailto:keli@carocomp.ro">keli@carocomp.ro</a>> wrote:<br>><br>><br>><br>> I had bitten this bullet in January (<br>> <a href="https://puck.nether.net/pipermail/cisco-voip/2008-January/029569.html">https://puck.nether.net/pipermail/cisco-voip/2008-January/029569.html</a><br>
)<br>> and I'm still perplexed how can Cisco leave this as-is with SIP and<br>> H.323 wide open for public as default settings, while being well aware<br>> of the situation and it's possible consequences.<br>
><br>> I've been discussing this issue with some other colleagues as<br>> well in the branch and I know this has happened to plenty of other<br>> people, in some case causing very serious monetary damage.<br>
><br>> regards,<br>> Zoltan<br>><br>> Aman Chugh wrote:<br>><br>> It was SIP , disabled sip on the wan port using an ACL to stop<br>> calls going out.<br>> Aman<br>
><br>> On 6/6/08, *James Edmondson* <<a href="mailto:biged7600@gmail.com">biged7600@gmail.com</a><br>> <mailto:<a href="mailto:biged7600@gmail.com">biged7600@gmail.com</a>>> wrote:<br>><br>> Do you happen to have custom scripts on the CME box? I had<br>
> this<br>> problem as whoever developed the script left the hole open to<br>> dial<br>> anynumber from the AA.<br>> On Thu, Jun 5, 2008 at 2:31 PM, Jorge L. Rodriguez Aguila<br>> <<a href="mailto:jorge.rodriguez@netxar.com">jorge.rodriguez@netxar.com</a><br>
> <mailto:<a href="mailto:jorge.rodriguez@netxar.com">jorge.rodriguez@netxar.com</a>>><br>> wrote:<br>><br>> I would recommend that you do Two things immediately.<br>> Install<br>
> COR to limit calls and second implement Access List to<br>> Kill<br>> H.323 coming from the internet.<br>><br>><br>> Jorge<br>><br>><br>> *From:* <a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>
> <mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a>><br>> [mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a><br>
> <mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</a>>] *On Behalf<br>> Of<br>> *Aman Chugh<br>> *Sent:* Thursday, June 05, 2008 2:13 PM<br>
> *To:* cisco voip<br>> *Subject:* [cisco-voip] has anyone seen this !<br>><br>><br>><br>><br>> I have a site with CME and CUE , the internet link is<br>> also<br>
> terminated on my CME router, apparently some one has<br>> hacked<br>> into the router and is using the router calling numbers<br>> in<br>> cuba and somalia. This has caused a huge bill from the<br>
> phone<br>> company.We have TAC case openned for this, When we shut<br>> the<br>> internet link this stops .<br>><br>><br>> Aman<br>><br>><br>> _______________________________________________<br>
> cisco-voip mailing list<br>> <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>> <mailto:<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>><br>
> <a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>><br>><br>><br>><br>> -- James<br>> _______________________________________________<br>
> cisco-voip mailing list<br>> <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>> <mailto:<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>><br>
> <a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>><br>><br>><br>><br>------------------------------------------------------------------------<br>
><br>> _______________________________________________<br>> cisco-voip mailing list<br>> <a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>> <a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
><br>><br>><br>><br>><br>><br>><br><br><br><br>----------------------------------------------------------------<br>This message was sent using IMP, the Internet Messaging Program.<br><br>_______________________________________________<br>
cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>-----------------------------------------<br>Disclaimer:<br><br>This e-mail communication and any attachments may contain<br>confidential and privileged information and is for use by the<br>designated addressee(s) named above only. If you are not the<br>
intended addressee, you are hereby notified that you have received<br>this communication in error and that any use or reproduction of<br>this email or its contents is strictly prohibited and may be<br>unlawful. If you have received this communication in error, please<br>
notify us immediately by replying to this message and deleting it<br>from your computer. Thank you.<br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br></blockquote></div><br>