Blocking "User Agents" similar to "friendly-scanner"

[mukkacow]

Hello,
I have noticed multiple scanning/registration attemps from this user agent:

12/12/2017 1:07:53 PM - [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
Invite-UNK Recv Req INVITE from 185.107.94.121:31980 tid=95dafa57doirino0 Call-ID=DLwVa3SBacifNJlfO3i7nz..:
INVITE sip:[email protected]:5060;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 145.189.92.202:5060;branch=z9hG4bK-524287-1---95dafa57doirino0;received=185.107.94.121
Max-Forwards: 70
Contact: <sip:[email protected]:5060;transport=UDP>
To: <sip:[email protected];transport=UDP>
From: <sip:[email protected];transport=UDP>;tag=p2prdi7a
Call-ID: DLwVa3SBacifNJlfO3i7nz..
CSeq: 1 INVITE
Content-Type: application/sdp
User-Agent: Z 3.14.38765 rv2.8.3
Allow-Events: presence, kpml, talk
Content-Length: 0

12/12/2017 1:07:47 PM - [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
Invite-UNK Recv Req INVITE from 185.107.94.10:14694 tid=k0ipc6todtykdc46 Call-ID=ZQMIDeoIzdG8tIuNeayGYP..:
INVITE sip:[email protected]:5060;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 101.121.71.73:5060;branch=z9hG4bK-524287-1---k0ipc6todtykdc46;received=185.107.94.10
Max-Forwards: 70
Contact: <sip:[email protected]:5060;transport=UDP>
To: <sip:[email protected];transport=UDP>
From: <sip:[email protected];transport=UDP>;tag=qv9vrsvz
Call-ID: ZQMIDeoIzdG8tIuNeayGYP..
CSeq: 1 INVITE
Content-Type: application/sdp
User-Agent: Z 3.14.38765 rv2.8.3
Allow-Events: presence, kpml, talk
Content-Length: 288

I have added these lines to my iptable file:

-A INPUT -j DROP -p udp --dport 5060:5061 -m string --string "Z 3.14.38765 rv2.8.3" --algo bm
-A INPUT -j DROP -p tcp --dport 5060:5061 -m string --string "Z 3.14.38765 rv2.8.3" --algo bm

but it seems not working. Any idea how to get rid of them?

Thanks you

 

[leejor]

I set the options to get an email when IPs are blacklisted, for a period of time, which had been extended to 500,000 seconds. I then go in later and change the year that the blacklist period lasts, to something like 2030. if you use one particular year it then makes it easier to visually scan the list for any new additions. Once you have a collections of IPs that have tried to hack your system, you can start to see a pattern, repeats, from similar IPs. I then change the subnet mask to cast a "wider net", as needed.

 

[sip.bg]

I can share a list of blacklisted IPs, collected from over 50 cloud-based PBXs. When IP is blacklisted by one or more of the PBXs (usually by several simultaneously), a filter rule is created into cloud router to protect all of the PBXs permanently. If there are 2 or more neighboring addresses, the whole subnet /24 is blocked. See leejor's post above for similar IPs.

 

[neotheghost]

Oh such a List would be great! Please be so kind and share it with us! Thank you very much!

 

[sip.bg]

Oh such a List would be great! Please be so kind and share it with us! Thank you very much!

These are the addresses including September 2017 attacks:

 

[neotheghost]

thank you very much!
is a firewall block the only option to avoid such attacks?
is't there a an option in 3cx to disable direct sip calls completely? or change something to only allow autorized sip calls to enter the pbx?

 

[sip.bg]

You can control direct SIP calls in Settings | Network settings | FQDN.
Other settings may be controlled into firewall.

 

[neotheghost]

Yes that's the part i dont fully understand. I disabled "Allow calls from/to external SIP URIs". Still i reviece those calls.

 

[sip.bg]

Depending on your router/firewall you may create a rule with white access list for hosts which could access your PBX on port 5060 -- like certain VoIP provider(s) and remote site(s). Otherwise you would not get rid from attacks.

 

[leejor]

Yes that's the part i dont fully understand. I disabled "Allow calls from/to external SIP URIs". Still i reviece those calls.

You may very well still see the calls in the logs, they won't go anywhere. Be certain that you use secure passwords. It's the people that had a simple password like "ext100", or "100" for extension 100, leftover from the initial testing, that will be in trouble.