Fraudulent REGISTER on SBCE Remoteworker flow 1

[AvayaUC2021]

Hi team,

I have an Avaya SBCE (release 8.0.1) installed with an Avaya IPO (reelase 11.0.4).

I have a remote worker service running on SBCE.

Since yesterday, I received many fraudulent REGISTER and I don't know how to block that correctly.

I have already activaed DDoS options but that doesn't block the attacks.

Thank you for help

Regards

 

[janni78]

They use the Avaya User Agent as default, I get these attacks on systems where you can't access the settings file.

It used to be the User Agent for the old Nortel phone but they've changed it again.

"Trying is the first step to failure..." - Homer

 

[janni78]

Although they could get this from the User Agent you send out.
It would probably make sense to make the SBC remove or alter it.

"Trying is the first step to failure..." - Homer

 

[AvayaUC2021]

Hi team,

So I maked some configuration that's look fine to block attacks !

- I created one URI-Group (BLOCK) that block all domains.

- I created anotehr URI-Group (ALLOW) that allow only my domain

- I affected the ALLOW URI-Group to my subscriber/server flows

Now attacks are directlly blocked by SBCE with 403 message !

I'm working on user's passwords complexity, to enforce users to change their passwords with a password complexity choosed by the admininistrator of IPO.
Also, I'm working on an MDM solution to push my certificate on the user's phones.

I think with all that I'll be safe

Thank you

 

[derfloh]

The MDM/certificate rollout helps if you use TLS mutual authentication if you use a client certificate as a second authentication factor.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[AvayaUC2021]

yes I want to add the mutual authentication to enforce security

 

[AvayaUC2021]

Hi team,

Does someone use DDoS Call Walking feature on SBCE ?
How that's work ?

Thanks

 

[G van Hamburg]

https://downloads.avaya.com/css/P8/documents/101065050

It is not 100% as it should be but you can use it.

Freelance Certified Avaya Aura Engineer

 

[AvayaUC2021]

Hi team,

it is possible that SBCE don't response to hackers with 403 Forbidden message ?

Thank you

 

[G van Hamburg]

Good one, let me check!

Freelance Certified Avaya Aura Engineer

 

[AvayaUC2021]

I Tried that but doesn't work, I still sending 403 Forbidden to hackers...

 

[G van Hamburg]

I think, because the SBCE generates the message, we can’t modify it. I tried a sigma script but same result.

Freelance Certified Avaya Aura Engineer

 

[AvayaUC2021]

I like working on Avaya solutions Ameliorations.
I'll request a GIRP for that fonctionnality.

I requested a GIRP for SBCE license usage in real time with IPO and my request was released on SBCE 8.1.2 (license compliance)

have a nice day !

 

[janni78]

Can't you just change the security settings so if they fail to many times they get ignored?

Default settings is set pretty high before it triggers anything.

"Trying is the first step to failure..." - Homer