Anti-Hacking Breach - uptick

[ian.watts]

For the last week or two, my email alerts about blocked IPs has rather blown up.
Anybody else seeing many of these?

Example:

Request from  52.16.197.48 are rejected/blocked by Anti hacking modue because of security breach 
The IP 52.16.197.48 has been blacklisted for 201 sec.
Reason: Requests rate is too high!

Somewhat odd.. the duration varies between address.. but the settings don't really reflect these values at all.

Anyway, I'm starting to clamp down on firewall rules to block inbound SIP for most of the world.. considering just allowing to the SIP provider(s) and forcing a tunnel for remote extensions (via softphone and via SBC for handset).

Given I don't have any remote handsets outside of North America, I started with blocking most of IPv4 which isn't ARIN. Globetrotters won't be taking handsets, can provision their softphones to tunnel.

 

[leejor]

Apparently...

huge-uptick-in-blocked-ips-as-of-9-11-2016-45772.html

 

[Pierre_3CX]

Hi there,
Please open a support ticket so that we can review your logs and help further on this.

In the meantime, some prevention steps can be taken from your side
- in the Settings / Security / Anti-Hacking / divide each values by two, except the blacklist time interval, and the security barrier (green). Set the blacklist time interval to a higher value such as 31536000 (1 year).
- in your firewall, filter the SIP port to allow only trusted sources, meaning your VoIP providers IP/range, and remote extensions (if any).
- validate, restart services.