Author Topic: Asterisk and Security  (Read 5149 times)

mihajzm

  • Regular Poster
  • **
  • Posts: 43
    • View Profile
Asterisk and Security
« on: June 24, 2010, 07:58:35 am »
today I became phone bill  from my SIP account provider and it was a shock for me. It was for 1000 EUR. :(
I do not not believed it. Than I examined call log's in FreePBX, there were to see 24 calls to Siera Leone and Litva
total time about 30 minutes. After that I became list of calls from my provider. There were also 24 call's
but total time about 6 hours. I don't understand this. Why has Asterisk different call duration in log as my provider?

I have searched in Asterisk logs and found attack from outside. The hacker has connected to extension 1001 and placed calls.

My first problem was in instruction from my provider. They told me that I must open port 5060 in firewall to be able to
place and receive calls. Before that Asterisk was not able to register in their system. But this was also a open door
and invitation for attacker  to connect to on of my extensions. My fault, i did not realize at that moment that this is a big security problem.


Second problem is that the password for certain extension is the same as extension number!!! That's the first a attacker try.
We mus definitely change this. At first install it's OK, but after that, there should be a possibility in Wizard->Phones to change
the password.

Third problems. I also saw in log's other attack to my system. Should we not utilise some sort of program as fail2ban
to protect the system against such attacks?

has someone from you the target of similar attack?







tschak909

  • LinuxMCE God
  • ****
  • Posts: 5497
  • DOES work for LinuxMCE.
    • View Profile
Re: Asterisk and Security
« Reply #1 on: June 24, 2010, 08:23:34 am »
This has already been fixed in the latest snapshots. We generate a strong password now for media director phones and hard phones that have configuration scripts by default.

-Thom

mihajzm

  • Regular Poster
  • **
  • Posts: 43
    • View Profile
Re: Asterisk and Security
« Reply #2 on: June 24, 2010, 09:31:46 am »
OK I checked it my test setup of 0810 and it's there.
But at home I have 0710. I must definitely upgrade to 0810.

in 0810 version is the port 5060 in firewall default open. that means the attacks wont stop. OK I understand that it's a need to be so.
What do you think about implementing some script to create a ban list for IP addresses that tries to connect many times with bad password or
username? I search for something usable or cook something together with some web interface to show up.

Do you have clue why the log's in asterisk have another call durations as log from my SIP provider? Probably I should ask this in Asterisk forum.


tschak909

  • LinuxMCE God
  • ****
  • Posts: 5497
  • DOES work for LinuxMCE.
    • View Profile
Re: Asterisk and Security
« Reply #3 on: June 24, 2010, 02:12:30 pm »
If it can be done in an automated fashion, then go for it.

-Thom

mihajzm

  • Regular Poster
  • **
  • Posts: 43
    • View Profile
Re: Asterisk and Security
« Reply #4 on: June 24, 2010, 02:56:13 pm »
OK. I already started to write a script that search Asterisk log for suspicious behaviour and logs the IP's in database.
Next I write a web Interface for this and a automatic script for firewall update.
I would need some help to ingrate the the web page in to LinuxMCE Admin panel. When I have something usable ready I will write to you.






rndinokc

  • Veteran
  • ***
  • Posts: 87
    • View Profile
Re: Asterisk and Security
« Reply #5 on: July 06, 2010, 12:14:01 am »
I had same problem.  As an addition in broad voice I banned any international calling.  Of course, not everyone can do this but it is a second line of defense.  I had calls to Sierra Leone too!  Wonder what's going on there?
Randy

los93sol

  • Guru
  • ****
  • Posts: 396
    • View Profile
Re: Asterisk and Security
« Reply #6 on: July 07, 2010, 12:22:01 am »
Have you guys updated to the latest snapshot yet and re-added your extensions to secure your extensions?  I have not had a single issue since we implemented the SIP secret code recently.

mihajzm

  • Regular Poster
  • **
  • Posts: 43
    • View Profile
Re: Asterisk and Security
« Reply #7 on: July 07, 2010, 09:15:47 am »
I'am working on it.
I have seen that in the latest snapshot.It's OK. But I think the system should ban IP that attacks it. Now I'am studying how to work with IPtables.

cfernandes

  • Guru
  • ****
  • Posts: 288
    • View Profile
    • my company web site
Re: Asterisk and Security
« Reply #8 on: July 07, 2010, 08:14:38 pm »
Hello ,

i use in my home system a failtoban to create rules  on iptables to block  attack's

i go to post my rules wheni go home.


Carlos

LmceCape

  • Veteran
  • ***
  • Posts: 65
    • View Profile
Re: Asterisk and Security
« Reply #9 on: July 08, 2010, 05:25:51 pm »
Hi los93sol

I have seen the updates on the Asterisk secrets which is great but the phones cannot login, I keep getting "chan_sip.c: Registration from '<sip:200@dcerouter>' failed for '192.168.80.1' - Wrong password".

The asterisk tables are correct and the orbiters reflect the passwords but it seems the the orbiter phone software is not using the passwords. if I remove the passwords then orbiter phones login.

Anyone else having these issues.

Regards

los93sol

  • Guru
  • ****
  • Posts: 396
    • View Profile
Re: Asterisk and Security
« Reply #10 on: July 09, 2010, 01:28:53 am »
interesting it sounds like simplephone did not get updated

los93sol

  • Guru
  • ****
  • Posts: 396
    • View Profile
Re: Asterisk and Security
« Reply #11 on: July 09, 2010, 01:38:23 am »
LmceCape: Please try again in the next snapshot, it seems I forgot to update the beta page with the pluto-simplephone package so it would get into the snapshots, done now, thanks for the feedback!

LmceCape

  • Veteran
  • ***
  • Posts: 65
    • View Profile
Re: Asterisk and Security
« Reply #12 on: July 12, 2010, 03:39:24 pm »
Thanks los93sol, I will give it a shot

Cheers

pbulteel

  • Making baby steps
  • Posts: 2
    • View Profile
Re: Asterisk and Security
« Reply #13 on: September 14, 2010, 01:54:29 pm »
I'm lucky to be reading all these posts and not having setup my host yet. I've used SSHblack in the past and it's easy to just make it look at any other logs so I imagine this should work for this as well.

I'm going to keep on reading.

To the devs: Thanks for all the hard work. I'm very impressed and look forward to setthing things up. Maybe once I have more experience with the environment I'll be able to contribute.

 

tschak909

  • LinuxMCE God
  • ****
  • Posts: 5497
  • DOES work for LinuxMCE.
    • View Profile
Re: Asterisk and Security
« Reply #14 on: October 19, 2010, 09:14:36 pm »
If it ever comes out?

We're constantly making releases as we squash bugs and round things out. Grab a snapshot.

-Thom