But the Romanians keep hacking..

32 people was apprehended in Romania, but the VoIP hacking continues from this country. Low wages, highly educated people and not too many jobs often forces people to start hacking, combined with low risk of being caught.

This was from IP 188.24.194.155 caught in a SIP honeypot belonging to Honeynet Project.

REGISTER sip:IP.removed SIP/2.0
Via: SIP/2.0/UDP 192.168.0.135:5060;rport;
branch=z9hG4bK6640
From: <sip:1234@IP.removed>;tag=3202
To: <sip:1234@IP.removed>
Call-ID: 14862
CSeq: 1 REGISTER
Contact: <sip:1234@192.168.0.135>
Max-Forwards: 70
User-Agent: Linphone/3.3.99.9 (eXosip2/3.3.0)
Expires: 3600
Content-Length: 0

Normal procedures is to use SIPvicious to do scanning, then use Linphone or other softphone to test out if you can dial out on the discovered IP PBX.

VoIP admins, do a pen-test on your own system and lock it down. This is, sadly, just the start….

VoIP hacking is a BIG industry! 32 people apprehended in Romania

This morning, the Directorate for Combating Organized Crime and Terrorism (DIICOT) in Romania conducted 42 raids, identifying 32 people specializing in VoIP hacking.

Numbers so far is 11,5 million euros in fraudulent VoIP traffic from this group. The group made around 10% of this amount from their premium numbers.

The main technique seemed to establish premium numbers in Sierra Leone, Somalia, Austria, Latvia, North Korea, Zimbabwe, Madagascar, Belarus, etc and cash in on calls to these destinations.

This correlates to attacks we have seen, calls trying to go to Somalia and Sierra Leone on our VoIP honeypots (but of course they were not successful).

This only confirms that there are major money in VoIP hacking and this is not single persons doing it but organized crime. I’m afraid this is just the beginning.

Original link

Link translated to English

Sandro Gauci has written more about it here

Another day, another fraud

Another day, another fraud… and there will be more… imagine your company getting hit with a 100 000 USD bill from your telco company? Who to blaim?
here is one company which did…

If you get a SIP trunk from a VoIP provider, make sure they have fraud management and credit limits!

VoIP Abuse project – block the scanners

People has gotten tired of the VoIP scannings. Sometimes they manage to abuse the PBX or just fill up the logs with all the attempts. So Mr. Oquendo started on a list of IP addresses and networks that should be blocked.

The VoIP Abuse Project is aimed at minimizing abuse for networks that have publicly accessible PBX’s. As a security engineer at a managed service provider, one of our services is VoIP. Throughout the course of the day, I got tired of seeing VoIP based brute force attempts that I decided to out companies who sit around and choose to do nothing about the attacks coming from their networks. As a courtesy I often take the time out of my work day to write constant emails to abuse and security desks which go nowhere.

The link: http://www.infiltrated.net/voipabuse/

Personally I think companies should have a white list, just enabling the IPs that you really need to allow traffic from, but that is not easy if you are a VoIP provider with clients all over the world.

Next step on this list would be to automate the whole process.

A new phrase: open sip relay

The most abuse nowadays are open SIP servers, just as the old open mail servers which spammers relayed spam through. So we will use the phrase open sip relay about the scanning going on nowadays. Nothing new, just another protocol (but with much more money in than spam when you find one… )

Open SIP Relay by my definition is: a SIP server open to send SIP messages from whoever to whoever (even channel it through the PSTN network)

Cool way to make a video

Xtranormal.com is an easy way to make simpel videos. You can see mine about telecom fraud here (37 seconds).

Enjoy!

Don't have your IP phone on a public IP

My friend Thomas sent me this. He has a Polycom telephone on a public IP. Nice when some computer calls you in the evening…

Picture: Copyright Thomas Nilsen (C) 3MT.no

The owner of the IP:
status:       ALLOCATED PORTABLE
source:       APNIC
person:       Chinanet Hostmaster
nic-hdl:      CH93-AP
e-mail:       anti-spam@ns.chinanet.cn.net

address:      No.31 ,jingrong street,beijing
address:      100032
phone:        +86-10-58501724
fax-no:       +86-10-58501724
country:      CN
changed:      dingsy@cndata.com 20070416

mnt-by:       MAINT-CHINANET
source:       APNIC
person:       Wu Xiao Li
address:      Room 805,61 North Si Chuan Road,Shanghai,200085,PRC

country:      CN
phone:        +86-21-63630562
fax-no:       +86-21-63630566
e-mail:       ip-admin@mail.online.sh.cn
nic-hdl:      XI5-AP
mnt-by:       MAINT-CHINANET-SH

changed:      ip-admin@mail.online.sh.cn 20010510
source:       APNIC

so hard to get any further on this…

An old SIP scanning has started again.

Now the scanning has started again.
For those remembering back in 2008 there was a large scanning in Germany, where customers with softphones experienced incoming calls (very annoying during the night..), it has now started again. A good paper from ipcom.at describing it extensively.

What caugt my attention was the very long branch and callid fields. They contain IP of the scanner, the scanned victim, the phone number trying to be called and several other fields (if you know what the rest of the codes are, please let me know!)

INVITE sip:82727117149111@the.honeypot.ip;transport=udp SIP/2.0
Via: SIP/2.0/UDP 202.71.111.5:3916;branch=11010010111010001010101000110202.71.111.5the.honeypot.ip751302518;rport
Max-Forwards: 70
From: <sip:736115896703798455@the.honeypot.ip>;tag=5475511560139881995954755115605475511560202.71.111.5
To: <sip:82727117149111@the.honeypot.ip>
Call-ID: ed6681d610110011110110100100110111000011010010111010001010101000110202.71.111.5the.honeypot.ip7513025181c895d9827271171491115475511560139881995954755115605475511560202.71.111.51621419374
CSeq: 1 INVITE
Contact: <sip:1c895d9@202.71.111.5:3916;transport=udp>
Content-Type: application/sdp
Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE, PUBLISH
User-Agent: eyeBeam release 1003s stamp 31159
Content-Length: 208

v=0
o=- 16264 18299 IN IP4 the.honeypot.ip
s=CounterPath eyeBeam 1.5
c=IN IP4 the.honeypot.ip
t=0 0
m=audio 34222 RTP/AVP 18 0 8 101
– Hide quoted text –
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15

And no, it is definely not “CounterPath eyeBeam 1.5” but a custom-made scanner. This is just an indication that people are willing to put mony into developing software to attack these insecure VoIP servers.

Status now is frequent usage of stand-alone SIPviciuous and other scanners, and two kits doing extensively scanning:

the userAgent=sundayddr
they started this spring, getting scannings from all over the world, but an overweight of Chinese IP addresses.

the current scannings with “Counterpath” as user-agent.
They have been active before, and now started again (scanning latest month)

And this is just the beginning…. so secure your VoIP servers!

Just 10 000 USD in hacking this time..

A VoIP hacking that actually reached the public, was just 10 000,- USD being frauded for. I would say they were lucky. This is just top of the iceberg, I hear about so many more not being reported because the firm or institution does not want to “have beeing hacked”. The latest news about it in Norwegian or translated to English

Another VoIP hacking in Norway

The latest month of scanning has seemed valuable for the hackers. A Norwegian municipality has been hacked and their PBX has been calling Somalia and a lot of others destinations we have picked up on our VoIP honeypots during the last month.

If you have an unsecure IP PBX on the net, now it will only take hours before it will be detected. Most normal cause for this is misconfiguration. The people setting up the IP PBX has not taken security seriously and the IP PBX is wide open for calling.

The simplest ways is that inbound calls is routed out again if no local destination is found.  A little harder is to just brute-force the password on extensions. I can only say, there will be more like this!

Norwegian version

English version

The hacker can sell this “gateway” to a third party dealing with calling cards. I have investigated frauds in Norway where they managed to send 1,2 million NOK (approx 200 000 USD) within 10 days. This was a Cisco installation, but misconfigured Asterisk installations are also abused a lot.