VAXSIP Hacking?

[IPOCraft]

I monitoring last nigth the IPO I see this kind of traffic (I replace the public IP with the tag [Public IP]):

00:15:18 204427mS SIP Reg/Opt Rx: phone
REGISTER sip:[Public IP]:5060 SIP/2.0
Via: SIP/2.0/UDP 212.83.138.43:5134;branch=z9hG4bK15247dc09219d16545c565c;rport
From: "780" <sip:780@181.65.151.92:5060>;tag=15247dc09f2f
To: "780" <sip:780@[Public IP]:5060>
Call-ID: dc09219-3b8fd16-545c565c@181.65.151.92
CSeq: 1 REGISTER
Contact: "780" <sip:780@212.83.138.43:5134>
User-Agent: VaxSIPUserAgent/3.1
Expires: 1800
Max-Forwards: 70
Content-Length: 0

00:15:18 204427mS Sip: SIPDialog f5540cd8 created, dialogs 1
00:15:18 204427mS Sip: SIP REG: Remote worker. No extn nor user.
00:15:18 204427mS SIP Reg/Opt Tx: phone
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 212.83.138.43:5134;branch=z9hG4bK15247dc09219d16545c565c;rport
From: "780" <sip:780@181.65.151.92:5060>;tag=15247dc09f2f
Call-ID: dc09219-3b8fd16-545c565c@[Public IP]
CSeq: 1 REGISTER
User-Agent: IP Office 9.0.2.0 build 860
Allow: INVITE,ACK,CANCEL,OPTIONS,BYE,REFER,NOTIFY,INFO,SUBSCRIBE,REGISTER,PUBLISH
Supported: timer
Server: IP Office 9.0.2.0 build 860
Reason: Q.850;cause=21;text="Call rejected"
To: "780" <sip:780@181.65.151.92:5060>;tag=a05878a337b53f45
Content-Length: 0


VAXSIPUserAgent? Do you see something like this? It sees like hacking... I don't have a user 780 (and I see a lot of message with user extn 780, 970, 940, etc).

 

[smokinjoe2938]

Are you serious you are only asking for trouble with a public ip, ( a hackers dream)

 

[amriddle01]

Yes that's what hackers do, they'll keep trying fom months now, then they'll try TAPI and Phone Manager.....

 

[smokinjoe2938]

Lock that sucker down ASAP!

 

[amriddle01]

You will probably also see sip vicious and friendly sip scanner having a go

 

[IPOCraft]

Yes a lot of extrange SIP messaging... I'm behind a firewall smokingjoe2938, but I need public IP for 1XM implementation!

 

[Gunnaro]

A firewall that opens up for traffic to everyone is not a secure boundary anymore.
You'd be surprised how much damage they can do with only one port open.

An SBC might be your best way to go.

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[tlpeter]

Do you have SIP trunks?
If not then turn off the option on the lan port.
But this is where a SBC is needed.
You could also change the default ports on the voip tab.


BAZINGA!

I'm not insane, my mother had me tested!