[OpenSIPS-Users] Attack with UA: firendly-scanner

[Mike Tesliuk]

i remove the reply, thanks .

2011/6/28 <duane.larson at gmail.com>

> I wouldn't even reply back with a "403 - Access Denied". If you do that
> then you just told whoever that you exist and you are SIP
>
> if($ua=~"friendly-scanner"){
> xlog("L_NOTICE","Auth error for $fU@$fd from $Ri cause $var(auth_code)");
> xlog("FRIENDLY-SCANNER: UA: $ua From_TAG: $ft From_URI: $fu Received IP:
> $Ri IP Source: $si");
> exit;
> }
>
>
>
> On Jun 28, 2011 4:55pm, Mike Tesliuk <mike at ultra.net.br> wrote:
> > Hello,
> >
> >
> > Im new to Opensips and im getting an attack that i can read the ip just
> on the first register, the attacker are sending my own ip on the sip package
>
> >
> >
> > on the begin of my main route i put the rule below
> >
> >
> >
> >
> >
> >
> >
> >         if($ua=~"friendly-scanner"){
> >                 xlog("L_NOTICE","Auth error for $fU@$fd from $Ri cause
> $var(auth_code)");
> >                 xlog("FRIENDLY-SCANNER: UA: $ua From_TAG: $ft From_URI:
> $fu Received IP: $Ri IP Source: $si");
> >
> >
> >
> >
> >                 sl_send_reply("403", "Access Denied");
> >         }
> >
> >
> > Small time later the attacker start the attack i get this message
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light:
> failed to allocate shmem buffer
> >
> >
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no
> more share memory
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> >
> >
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light:
> failed to allocate shmem buffer
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> >
> >
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no
> more share memory
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light:
> failed to allocate shmem buffer
> >
> >
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:relay_reply: no
> more share memory
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: WARNING:core:fm_malloc:
> Not enough free memory, will atempt defragmenation
> >
> >
> >
> >
> > Jun 28 18:31:06 ser1-vm /sbin/opensips[19848]: ERROR:tm:_reply_light:
> failed to allocate shmem buffer
> >
> >
> >
> > i can get the log, but the ip that i show is my own, how can i block this
> kind of attack ?
> >
> > Thanks
> >
> >
> >
> >
> >
> >
> > below you have the firs 3 packages that i can get on ngrep (the
> XXX.XXX.XXX.XXX is my IP)
> >
> > U 2011/06/28 17:46:11.898262 60.171.75.147:5100 -> XXX.XXX.XXX.XXX:5060
> >
> >
> >
> >
> > REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> > Via: SIP/2.0/UDP 127.0.0.1:5100;branch=z9hG4bK-693079904;rport.
> > Content-Length: 0.
> > From: "6362" .
> > Accept: application/sdp.
> > User-Agent: friendly-scanner.
> >
> >
> >
> >
> > To: "6362" .
> > Contact: sip:123 at 1.1.1.1.
> > CSeq: 1 REGISTER.
> > Call-ID: 1696826551.
> > Max-Forwards: 70.
> > .
> >
> > #
> >
> >
> > U 2011/06/28 17:46:11.899246 XXX.XXX.XXX.XXX:5060 -> XXX.XXX.XXX.XXX:5060
>
> >
> >
> > REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> > Via: SIP/2.0/UDP XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.7864db01.0.
> > Via: SIP/2.0/UDP 127.0.0.1:5100;received=60.171.75.147;branch=z9hG4bK-693079904;rport=5100.
>
> > Content-Length: 0.
> >
> >
> >
> >
> > From: "6362" .
> > Accept: application/sdp.
> > User-Agent: friendly-scanner.
> > To: "6362" .
> > Contact: sip:123 at 1.1.1.1.
> >
> >
> >
> >
> > CSeq: 1 REGISTER.
> > Call-ID: 1696826551.
> > Max-Forwards: 69.
> > P-hint: outbound.
> >
> >
> > #
> > U 2011/06/28 17:46:11.899388 XXX.XXX.XXX.XXX:5060 -> XXX.XXX.XXX.XXX:5060
>
> > REGISTER sip:XXX.XXX.XXX.XXX SIP/2.0.
> >
> >
> >
> >
> > Via: SIP/2.0/UDP XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.8864db01.0.
> > Via: SIP/2.0/UDP
> XXX.XXX.XXX.XXX;rport=5060;received=XXX.XXX.XXX.XXX;branch=z9hG4bKe9e1.7864db01.0.
>
> > Via: SIP/2.0/UDP 127.0.0.1:5100;received=60.171.75.147;branch=z9hG4bK-693079904;rport=5100.
>
> >
> >
> >
> >
> > Content-Length: 0.
> > From: "6362" .
> > Accept: application/sdp.
> > User-Agent: friendly-scanner.
> > To: "6362" .
> > Contact: sip:123 at 1.1.1.1.
> >
> >
> >
> >
> > CSeq: 1 REGISTER.
> > Call-ID: 1696826551.
> > Max-Forwards: 68.
> > P-hint: outbound.
> > P-hint: outbound.
> > .
> >
> >
> >
> >
> >
> >
> >
> >
>
> _______________________________________________
> Users mailing list
> Users at lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20110628/e6db1512/attachment-0001.htm>