FYI: DOS attacks

atcom · March 23, 2012, 4:45pm

Time to implement some IPTABLES rules! Fail2ban doesn’t prevent this.
We’re seeing a number of attempts on our PBX’s as follows:

Active Channel(s)
Peer             User/ANR         Call ID          Format           Hold     Last Message   
192.168.100.197  7071             24af163d719c501  0x0 (nothing)    No       Init: NOTIFY              
192.168.100.197  7071             638bab26553e333  0x0 (nothing)    No       Init: NOTIFY              
178.22.70.152    103              1633602371       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    102              4155411910       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    101              3818369912       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    100              86425801         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8888888          3794272525       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    888888           3932102904       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    88888            3183993047       0x0 (nothing)    No       Rx: INVITE                
159.18.161.67    (None)           [email protected]  0x0 (nothing)    No       Rx: OPTIONS               
178.22.70.152    8888             48853458         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    888              3689454630       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    88               4169547906       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8                969055011        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7777777          3591804772       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    777777           21311229         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    77777            2506345696       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7777             2729395706       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    777              860358066        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    77               3990178878       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7                990032174        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6666666          1164695209       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    666666           80485659         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    66666            3404503531       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6666             900710013        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    666              1151722731       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    66               1517209687       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6                3491797390       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5555555          1400068717       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    555555           3757588908       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    55555            1343809223       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5555             3462441099       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    555              2226311765       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    55               1428463308       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5                1342827176       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4444444          190442010        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    444444           2793082204       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    44444            1842656692       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4444             1336161308       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    444              2691006439       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    44               3060389961       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4                4104072981       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3333333          948184164        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    333333           2456658737       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    33333            1247450816       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3333             3908861250       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    333              2055357557       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    33               1924089996       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3                4003736280       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2222222          2263937868       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    222222           186063315        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    22222            4073840248       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2222             2623474650       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    222              1070025312       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    22               3607575265       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2                2932060959       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1111111          2687573637       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    111111           2647982116       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    11111            3351643048       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1111             1177597791       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    111              2395895660       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    11               406631667        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1                3239433752       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0000000          2337961349       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    000000           1964825134       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    00000            1909782719       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0000             901934426        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    000              4185187302       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    00               779660419        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    0                3795667507       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9901             2157102774       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9801             233464999        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9701             1109262080       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9601             1443487206       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9501             3284835128       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9401             3083560465       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9301             308778361        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9201             2693083468       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9101             4194132451       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9001             99733964         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8901             570836259        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8801             971643973        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8701             2954692773       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8601             979327972        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8501             917567524        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8401             2197076546       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8301             1275785796       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8201             3222629765       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8101             3189190804       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8001             3145752926       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7901             14780433         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7801             3235816577       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7701             2044295648       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7601             2154620513       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7501             4218922312       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7401             2433108381       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7301             617925933        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7201             2952530856       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7101             1810268888       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7001             1405371493       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6901             2941806813       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6801             3587210954       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6701             1765155098       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6601             2060821325       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6501             385363182        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6401             3214345851       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6301             2022250253       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6201             892371091        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6101             3107390983       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6001             802998834        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5901             1835424956       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5801             2121048709       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5701             3551573687       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5601             3119571809       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5501             519676184        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5401             1814767446       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5301             2036783812       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5201             2837550265       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5101             3643237395       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5001             1950288039       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4901             1671756733       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4801             2057800801       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4701             1880420614       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4601             696759422        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4501             1017400660       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4401             3820089120       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4301             4173861890       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4201             213040968        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4101             2195626659       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4001             1436190980       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3901             3781043434       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3801             2281360970       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3701             1730161820       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3601             3081045428       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3501             118667747        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3401             157445493        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3301             4019949280       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3201             4263603077       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3101             2156887290       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3001             1770362361       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2901             1001945327       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2801             4060634063       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2701             148231846        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2601             3210300474       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2501             3320198349       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2401             2594759420       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2301             3140621861       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2201             2488028462       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2101             3093115858       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2001             2307013284       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1901             2890345924       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1801             3342012199       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1701             3847159762       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1601             2994645512       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1501             1873269269       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1401             1887259528       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1301             3173904537       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1201             294901843        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1101             521297288        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1001             841970362        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9900             1827179561       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9800             880587215        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9700             831430313        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9600             810961242        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9500             3035287016       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9400             298486945        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9300             1685167518       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9200             3606520539       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9100             1571893362       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    9000             2050597199       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8900             4224056824       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8800             1222223201       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8700             3999292997       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8600             616878097        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8500             1502853810       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8400             220945460        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8300             2760476601       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8200             3960946953       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8100             245630936        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    8000             221459157        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7900             1337552105       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7800             517928015        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7700             4075683387       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7600             1252479414       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7500             1901819288       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7400             1787464390       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7300             4266387085       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7200             1966725547       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7100             3763296173       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    7000             2890752254       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6900             276861993        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6800             2470348109       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6700             2362728920       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6600             3602247348       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6500             1069079936       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6400             1479220764       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6300             830974475        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6200             68313353         0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6100             3090626305       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    6000             388512479        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5900             688949493        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5800             2626344923       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5700             734512867        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5600             1555596699       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5500             3383712270       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5400             3383116978       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5300             892020704        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5200             345297801        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5100             748006956        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    5000             2558862990       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4900             2315084162       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4800             2456882782       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4700             1485474761       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4600             1808123135       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4500             2541954704       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4400             3626871271       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4300             2714727879       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4200             1525151977       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4100             1864594478       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    4000             343295572        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3900             3521103931       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3800             2564591731       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3700             4202474397       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3600             563048731        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3500             4214450237       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3400             1838747331       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3300             3263717937       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3200             867241259        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3100             3865226553       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3000             2274329597       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2900             2614405006       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2800             550287230        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2700             3277962520       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2600             4159179794       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2500             4009558117       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2400             702125961        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2300             2108649761       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2200             124664981        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2100             2395081803       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    2000             1341438429       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1900             963050300        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1800             3415409267       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1700             1785787384       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1600             150409906        0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1500             4105677372       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1400             3625252067       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1300             2051847654       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1200             1612072952       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1100             1401419201       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    1000             3012167253       0x0 (nothing)    No       Rx: INVITE                
178.22.70.152    3016823799       3049164123       0x0 (nothing)    No       Rx: INVITE

miken32 · March 23, 2012, 8:12pm

I would suggest either your fail2ban config or Asterisk log config need some changes if fail2ban isn’t blocking that. Do you get failure attempts showing up in your log?

AdHominem · March 24, 2012, 1:18am

It’s easy enough…

http://wiki.centos.org/HowTos/Network/IPTables

obelisk · March 24, 2012, 6:14am

Do you get failure attempts showing up in your log?

These attacks do not show in the log. fail2ban is useless. I always wondered why fail2ban is included with FreePBX as it is totally ineffective against certain classes of attacks. It was simply a matter of time before black hats would start using them. Check : http://www.freepbx.org/forum/freepbx/general-help/fail2ban-failregex-and-sip-scanning-attacks
the only purpose of this tool, when used w/asterisk, is providing a false sense of security to the unsuspecting VoIP expert wannabe.

peace

btw: I also wonder why people need to expose port 5060 to the outside world, but that’s another topic entirely …

http://www.freepbx.org/forum/freepbx/general-help/freepbx-security-comments-and-thoughts