<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'>*nods* being UDP, it could be easy to spoof someone else to get them blocked. When I automated honeypot -> ACL, I shut myself out of Google's authoritative DNS servers, assuming because of spoofing. There could have been more than I didn't even realize.<div><br></div><div>Gotta protect against that kind of stuff.<br><div><br><div><span name="x"></span><br><br>-----<br>Mike Hammett<br>Intelligent Computing Solutions<br>http://www.ics-il.com<br><br><br><br>Midwest Internet Exchange<br>http://www.midwest-ix.com<br><br><span name="x"></span><br></div><br><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Fred Posner" <fred@palner.com><br><b>To: </b>voiceops@voiceops.org<br><b>Sent: </b>Monday, January 3, 2022 9:14:13 AM<br><b>Subject: </b>Re: [VoiceOps] SentryPeer: A distributed peer to peer list of bad IP addresses and phone numbers collected via a SIP Honeypot<br><br>Hi All,<br><br>Re APIBAN...<br><br>APIBAN has two main ways that it's used... with a simple block of IP<br>addresses through firewall or iptables being the most used aspect.<br><br>Briefly, through honeypots (global) IP addresses sending SIP or non-SIP<br>(like dns, fuzz, or malformed SIP) are identified. We capture the<br>commonly used SIP listener ports with UDP, TCP, and TLS.<br><br>Most users utilize the apiban client to automatically block these IPs in<br>iptables. There is also methods to check individual ip's by API as well<br>as grabbing all active IPs, etc.<br><br>We looked into a community submission, but decided against it as it was<br>too easily poisoned. The main goal here is quality of the data and<br>making sure that we're not distributing any valid IP as something that<br>should be blocked.<br><br>I like the idea of community submission, but the poisoning was<br>determined to be too big of a risk for us.<br><br>I also like the idea of sharing some data of numbers being called,<br>etc... but like that for analysis and approaching hardening in a<br>non-realtime scenario.<br><br>With best regards,<br><br>Fred Posner | palner.com<br>Matrix: @fred:matrix.lod.com<br>o: +1 (212) 937-7844<br><br>On 1/3/22 4:34 AM, Gavin Henry wrote:<br>> On Mon, 3 Jan 2022, 03:22 Jim O'Brien, <jimdoesvoip@gmail.com<br>> <mailto:jimdoesvoip@gmail.com>> wrote:<br>> <br>> Hi Gavin,<br>> Thanks for sharing. In many ways your project reminds me of Fred<br>> Posner’s APIBAN. I like your approach here with SentryPeer allowing<br>> an operator to run their own systems and choose to share with and<br>> receive IPs from others! These piecs are fantastic! Once the crush<br>> of coming back from holidays is over I cannot wait to give this a try.<br>> <br>> Best,<br>> <br>> Jim<br>> <br>> <br>> Thanks Jim. APIBAN, for now, doesn't publish B numbers. I just added<br>> responsive mode (replying to probes so they then try proper INVITEs),<br>> but haven't committed it yet and the numbers API so you can check<br>> customer calling attempts. <br>> <br>> I'm also adding a SIP agent mode too for SIP redirects. The plan is you<br>> just run in agent mode with replication on (replication coming soon) as<br>> a mini SIP proxy etc.<br>> <br>> https://www.linkedin.com/posts/surevoip_sip-sip-fraudprevention-activity-6882708550662070272-9HDL<br>> <https://www.linkedin.com/posts/surevoip_sip-sip-fraudprevention-activity-6882708550662070272-9HDL><br>> <br>> I've also done an RPM and Dockerfile / Dockerhub container and my first<br>> ever proper debian package! That was a long time dream of mine as I<br>> thought debs were so hard compared to an RPM spec. <br>> <br>> https://github.com/SentryPeer/SentryPeer/releases/tag/v0.0.4<br>> <https://github.com/SentryPeer/SentryPeer/releases/tag/v0.0.4><br>> <br>> Just got Debian salsa git repo access this morning too so I can start to<br>> get it into Debian proper, hopefully. <br>> <br>> Gavin. <br>> <br>> _______________________________________________<br>> VoiceOps mailing list<br>> VoiceOps@voiceops.org<br>> https://puck.nether.net/mailman/listinfo/voiceops<br>> <br>_______________________________________________<br>VoiceOps mailing list<br>VoiceOps@voiceops.org<br>https://puck.nether.net/mailman/listinfo/voiceops<br></div><br></div></div></div></body></html>