<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>We have not specifically seen this however we have played around with several of our SIP devices by setting them as public and poking holes in firewalls for direct IP dialing.<BR>With what we use I think the worst we have seen is customers making them available and having them hacked and FWD to international numbers (another thing to block by default).<br> <BR>My suggestion is always use a firewall (or private vlan/network if your an ISP, etc).<BR> <BR>Brian<BR> <BR><div>> Date: Fri, 27 Sep 2013 14:00:58 -0500<br>> From: joquendo@e-fensive.net<br>> To: peeip989@gmail.com<br>> CC: voiceops@voiceops.org<br>> Subject: Re: [VoiceOps] Phone hack<br>> <br>> On Fri, 27 Sep 2013, PE wrote:<br>> <br>> > Greetings!<br>> > <br>> > We have a customer whose users work from home over the local broadband<br>> > carrier. They have 3 users who have complained of similar circumstances,<br>> > where they are receiving multiple calls from caller ID such as "100(100)",<br>> > "101(101)", and "1001(1001)". We show no record of these calls, either<br>> > from CDR's, logs, or SIP captures, so it seems that there is an outside<br>> > party sending SIP directly to the (Polycom) handsets.<br>> > <br>> > Anyone seen this? Any idea if there is a particular security hole being<br>> > attempted? Assuming the users cannot control their broadband router, any<br>> > suggestions on how to better lock this down?<br>> > <br>> > Thanks<br>> <br>> I, and I'm sure others, have seen this before. There are<br>> ways to fix it, things to look for. However, I (and I'm sure<br>> others will agree), it helps when we can identify whom we<br>> are talking to. Its commonly known that attackers also<br>> browse, and subscribe to many lists in search of who is<br>> watching them, and who is stopping them, and how. This is<br>> not to say you're running amok with sipvicious causing<br>> havoc...<br>> <br>> So to answer your question as broadly asked:<br>> <br>> 1) Yes I have seen these scans hit handsets<br>> 2) It would never make your CDR since it is sent directly<br>> to a SIP device (phone, ATA, etc)<br>> 3) You're likely capturing on the PBX/SBC side, which it<br>> never hits so your packet capture is a moot point<br>> 4) Don't want to name possibly affected vendors.<br>> 5) Your SIP devices (Phones, ATAs, etc) should not be<br>> exposed to the world. If someone is hitting a device<br>> that is behind say NAT/FW/etc. (non-public IP addr) then<br>> you may have bigger problems.<br>> <br>> -- <br>> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+<br>> J. Oquendo<br>> SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM<br>> <br>> "Where ignorance is our master, there is no possibility of<br>> real peace" - Dalai Lama<br>> <br>> 42B0 5A53 6505 6638 44BB 3943 2BF7 D83F 210A 95AF<br>> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF<br>> _______________________________________________<br>> VoiceOps mailing list<br>> VoiceOps@voiceops.org<br>> https://puck.nether.net/mailman/listinfo/voiceops<br></div> </div></body>
</html>