[VoiceOps] Large VoIP Attacks?

[J. Oquendo]

Been a very fun/interesting morning. Since so much has gone
on, I figured I'd share. We have seen a larger than normal,
if not, one of the largest attacks against some of our VoIP
and video conferencing systems today. Initially, we fielded
a report of a "system gone bad" followed by another, then
another, and another. This has now carried on into some of
our videoconference units (LifeSize).

Because our goal is to get telephony up and running, there
was not much we could do via incident response, so I have
little to add on attack vectors however, I will state that
PBXNSIP has been the primary target, with about a dozen of
these being hit pretty hard to the point I've had to block
all, stop the software and re-start it.

My dealings with vulnerability disclosures has been that,
vendors don't care, so if there is something specific with
PBXNSIP, no one knows, and due to their political bickerings
in house, no one is going to fix it. So for anyone using
this software, long weekend dictates: "lock your **** down."
Same goes for LifeSize.


-- 
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of
real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB  3943 2BF7 D83F 210A 95AF
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF