Foreign hacking attempts constantly 3

[safenestvmem]

Hello, I've got an Avaya IP office 500 V2 9.1 with primarily digital handsets but we do have 10 off site 9608 handsets.

Up until recently we haven't had a problem until we have been getting event notifications of constant attempts to log in to the manager using various credentials. These are all coming from foreign IP addresses from other countries.

We have very complex passwords to protect us but I'm wondering if there is any way for me to turn off this specific access since we do not use remote access to the system for configuration using manager we only use a local PC in the phone room for programming. Many thanks

 

[derfloh]

Remove IPO from the internet.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[safenestvmem]

How will this effect our 9608 off site handsets and our voice mail to email?

 

[qtelcom]

VPN your 9608's or set them up properly as remote extn's with security

 

[ipohead]

Have a look at Geo-IP Filtering if your firewall supports it.

 

[derfloh]

If someone tries login with Manager the IP Office probably has a public IP and is directly connected to the public internet.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[ipohead]

Derfloh - that is what I thought ..

 

[critchey]

we do have 10 off site 9608 handsets

Based on that and your thread I am assuming you have the IPO directly on a public IP which is why you are having hack attempts. You should NEVER put your IPO on a public IP for this very reason they will attempt to hack you and likely, at some point, eventually will hack you. The problem is I am betting you don't have the licensing to do remote worker the right way. You only get 4 remote workers for free and after that you need user licenses (like power user) which requires preferred edition. This is likely one reason this was done this way (the wrong way mind you) in the first place.

Since you likely could only have 4 remote workers you will likely have to setup a VPN on your firewall and then either VPN through the phone (which can be a pain) or a site to site if all the remote phones are at one location. You are looking at a lot of work and some hardware needed to do this the right way and really lock it down securely. How you have it setup (we are guessing but its likely based on the info) should of never been setup that way and will end up costing you and/or the customer in the end.

I attached where in the security guidelines it specifically tells you not to do this.



The truth is just an excuse for lack of imagination.

 

[derfloh]

Be aware that building a site to site VPN to each remote phone site with a decent VPN router at each site will cost mich less than of a hacking attempt will be successful.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[biglebowski]

Sounds like you don't have a firewall between the IPO and your internet connection (router)

I would very strongly advise installing one.

Biglebowskis Razor - with all things being equal if you still can't find the answer have a shave and go down the pub.

 

[ogTOKYO]

block the administrative ports, they're in the upper default range of the 48-53xxx ports, stupid implementation on avaya's side.

______________________
|........................................|
|.....i.eat.bunny.children......|
|______________________|
(\__/) ||
(•Y•). ||
/ < )<||

 

[derfloh]

Why is it stupid? IPO is not made to be Internet facing… oder releases shared the same ports for admin and RTP but not the newer releases.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[jamie77]

It is stupid, and that is why Avaya changed teh defaults (after some presure from members on this forum!!) to 40750-50750 (SE) or 46750-50750 (500) at R9.1 or R10 (can't recall).

The real issue was only UDP was needed to be forwarded in this upper range, but many people/dealers/engineers/firewall guys didn't have a clue, so forwarded TCP & UDP to be 'sure'. Hence you got admin ports 50790-50814 TCP sent through from the internet.

To sort this, either change your RTP range on the IPO and firewall to match. May as well use the new defaults of 46750-50750 UDP for you RTP, and trim down to your aactual needs. Don't push TCP through on these ports.

Or like others have suggested, you lumped a public IP on LAN 2. Which is very stupid indeed.

Either way, you ARE still going to get people trying to register phones, no way to stop it (without VPN anyway!. Only way to address this is with a proper security policy for passwords.

Every system we have, either with or without an SBC, is getting attemots all the time to register a phone. They just don't succeed!!!

Jamie Green

[bold]A[/bold]vaya [bold]R[/bold]egistered [bold]S[/bold]pecialist [bold]E[/bold]ngineer