Re: SIP dictionary attacks

I'm using openbsd as my firewall, in which there is a connection/time
feature. I can set it to block any ip that makes X connection with in
X time. for instance if someone connects to my ssh port more than 3
times in 30 seconds, they get blocked, since your on sip, you could do
like say, anyone connecting more than 5 times in 5 minutes gets
blocked, sip usually doesnt have that many connections, it just
connects then its up sorta thing.

I believe there is a version of this in iptables, but ive never seen
it in a hardware firewall.

That is at least how i solved the problem you face.



2009/4/1 Paul D. Robertson <[email protected]>:
> Well, besides losing my voice which has given me a little time to catch up
> on things, one of my problems last week was a successful dictionary attack
> against a SIP extension with an eight digit password.
>
> Obviously, I've changed the passwords and lengths, but I did want to make
> sure folks knew that there were active attacks out there, and they're
> obviously scanning for systems randomly, since the system in question was
> only recently moved to a new IP address space.  The initial scans came
> from a box in China (surprise!)
>
> Anyway, all I've found for blocking outside of static IP address ranges is
> a bunch of check the logs and react stuff for Linux.  I'm starting to
> think IPS might actually have a use- time to Google for snort inline sutff
> I suppose.
>
> Attackers made about calls out to people telling them they owed money.
> Calls were initiated from Europe, Asia and the US.  Likely from
> compromised hosts.
>
> Paul
> -----------------------------------------------------------------------------
> Paul D. Robertson      "My statements in this message are personal opinions
> [email protected]       which may have no basis whatsoever in fact."
>           Moderator: Firewall-Wizards mailing list
>           Art: http://PaulDRobertson.imagekind.com/
>
> _______________________________________________
> firewall-wizards mailing list
> [email protected]
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
>