<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2">
</HEAD>
<BODY>
On Wed, 2011-05-18 at 16:52 -0400, J. Oquendo wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 5/18/2011 4:42 PM, anorexicpoodle wrote:
>> The biggest gripe I have with Asterisk and other open source based PBXs,
>> is the symmetry in logs. Its not fluid. One of the reasons I never built
>> an "all out" honeypot. I have to modify so much across different
>> versions. However, this is also the beauty of Asterisk and similar open
>> source type PBXs, there is so much you can do but it almost always needs
>> to be custom. I also have an insane expect to .bashrc script back to
>> expect + ssh key script which runs on an SBC, parses some of the SBC
>> logs, pushes the output to a Linux machine, gets re-parsed on the Linux
>> box, triggers alert (right now to my SIP Blackberry client & Snom) based
>> on predefined params (volume of calls, destination of calls) and has the
>> capability of doing trigger based blocking (expect). Right now though,
>> its only running on our nCite SBCs and once I become more comfortable
>> with our Acme's logging capabilities, I may do the same type of
>> scripting: From syslog based machine, parse elsewhere, sort out, pick
>> out a trigger, create a rule, send it via expect to some defense
>> mechanism. Depends on how REALLY bored I get and whether or not I
>> actually even start looking at our Acmes. (Personally, I'd rather leave
>> this to my colleague ;))
>
> Interesting you should bring this up as it is something I have been
> fiddling with now for a little while. I have all our Acmes feeding a
> syslog server in SQL, and parsing those logs to generate lists of
> particularly bad offenders, then using that process to seed a
> blacklist BGP feed that all my edge routers draw from and then null
> route those offenders at the edge of my network, or for particularly
> bad attacks using BGP communities to signal our bandwidth provider to
> null them.
>
> This has the benefit of providing a measure of intelligent protection
> network wide, even when the attack is focused on a single element and
> can guard against both SIP based attacks and more traditional DDOS
> attacks as well.
>
>
Un cc'd you guys to stop the dupes ;)
The logic you have sounds cool however, I would have to be cautious
blacklisting an entire ASNs as we do have some clients abroad with
interconnected trunks to their offices here. I like running phorensix
since it gives me an indication of "which country is hot" for fraud
right now. I called "Romania" back in Sept of 2010 and lo and behold
arrests hit that country for fraud. In Oct I called "Egypt" which is a
hotspot (ASN 8452). Soon I'll tinker around with Acme via syslog and
maybe I'll revise something for phorensix soon and make it public.
</PRE>
</BLOCKQUOTE>
<BR>
Not blacklisting entire ASN's, feeding specific /32's into a BGP feed (usually hosted on Vyatta or Quagga in VM) though it does kinda bring up some interesting ideas about correlating the black-listed /32's to specific ASN's and Countries for alert grouping and reporting. Ill have to have a play with that. <BR>
<BR>
here is where I got the original idea:<BR>
<A HREF="http://www.team-cymru.org/Services/Bogons/bgp.html">http://www.team-cymru.org/Services/Bogons/bgp.html</A><BR>
<BR>
And i just extended it to feed from other sources via scripted input and hosted the feed myself. <BR>
<BR>
</BODY>
</HTML>