jimbojimbo
Vendor
If you have an Avaya ASBCE configured for remote worker, you're probably subject to hacking attempts. It is strongly suggested to place the ASBCE external interface in a DMZ behind a firewall. Even so. SIP and HTTPS services have to be exposed on the internet.
For SIP hacking attempts the ASBCE EMS Web Interface gives you easy access to "Incidents" from the top menu. The source IP Address will tell you where the hacking attempt is coming from. I see hacking attempts daily. There are many internet services which provide IP lookup. I use whatismyip.com which gives a simple ARIN output. You can then put it IP Address or Address Range (I always put the address range when I find it is a hosted service since I never expect SIP user clients to be on hosted services) into the DMZ Services>Firewall>Blacklist.
For HTTP hacking attempts you can go into the SBC command line and review
/archive/log/tracesbc/tracesbc_http/access.log
There can be too much data to swim through due to clients accessing the AADS and PPM services so just start by looking for 403 errors. Back to whatsmyip.com and the blacklist.
I will typically send an e-mail to the abuse e-mail address from the ARIN record just to let them know I've blocked all traffic to/from their service. Most hosted solution providers don't seem to do much (in my opinion). I think they feel insulated by section 230 and the lack of interest from the FBI Cybercrimes unit unless there is a significant $$$ loss associated with the hack.
You may want to start off with Blacklist rules for NetSysResearch, Censys and Shodan scanners. This will help limit your exposure to hackers who use these services to find targets.
There is no easy way natively to import a set of firewall blacklist rules into the SBC. The 8.1.X ASBCE does have an API service available so if I ever get the time I'll look to see if it is possible to import the firewall rules.
For SIP hacking attempts the ASBCE EMS Web Interface gives you easy access to "Incidents" from the top menu. The source IP Address will tell you where the hacking attempt is coming from. I see hacking attempts daily. There are many internet services which provide IP lookup. I use whatismyip.com which gives a simple ARIN output. You can then put it IP Address or Address Range (I always put the address range when I find it is a hosted service since I never expect SIP user clients to be on hosted services) into the DMZ Services>Firewall>Blacklist.
For HTTP hacking attempts you can go into the SBC command line and review
/archive/log/tracesbc/tracesbc_http/access.log
There can be too much data to swim through due to clients accessing the AADS and PPM services so just start by looking for 403 errors. Back to whatsmyip.com and the blacklist.
I will typically send an e-mail to the abuse e-mail address from the ARIN record just to let them know I've blocked all traffic to/from their service. Most hosted solution providers don't seem to do much (in my opinion). I think they feel insulated by section 230 and the lack of interest from the FBI Cybercrimes unit unless there is a significant $$$ loss associated with the hack.
You may want to start off with Blacklist rules for NetSysResearch, Censys and Shodan scanners. This will help limit your exposure to hackers who use these services to find targets.
There is no easy way natively to import a set of firewall blacklist rules into the SBC. The 8.1.X ASBCE does have an API service available so if I ever get the time I'll look to see if it is possible to import the firewall rules.
