[AsteriskBrasil] (URGENTE) Tentativa de Invasão?

brunoantognolli em email.com brunoantognolli em email.com
Sexta Janeiro 22 11:01:56 BRST 2010 

Ok, já vamos providenciar isso, obrigado pela dica Wendell.

Mas isso é uma tentativa de invasão?
Se sim, quais os prejuízos que posso ter com isso?

É possível o invasor acessar um ramal sip, tentando conectar através desse ip e realizar ligações, por exemplo?

Att,
Bruno






-----Original Message-----
From: Wendell Silva <wendbandeira em gmail.com>
To: asteriskbrasil em listas.asteriskbrasil.org
Sent: Fri, Jan 22, 2010 10:47 am
Subject: Re: [AsteriskBrasil] (URGENTE) Tentativa de Invasão?


Configura o ipfw no seu servidor e bloqueia este ip.

Att.

Wendell Silva Bandeira


2010/1/22 <brunoantognolli em email.com>




Pessoal, estava olhando o Log do Asterisk e ví a seguinte msg:
 
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password
[Jan 22 10:00:25] NOTICE[14350]: chan_sip.c:15593 handle_request_register: Registration from '"1013" <sip:1013 em XXX.XXX.XXX.XXX>' failed for '174.129.173.249' - Wrong password

Notem que em 1 segundo o "invasor" tentou várias vezes se registrar no sip 1013 (através do método BruteForce) pelo meu link do speedy. O IP do "invasor" é 174.129.173.249.
 
Isso seria uma tentativa de invasão? 
 
Se sim, como ele conseguiu acesso aos meus ramais SIP?
O que preciso fazer para tirar esse cara da rede?
 
Em uma pesquisa rápida descobri que esse IP é de Washington.
http://www.botsvsbrowsers.com/ip/174.129.173.249/index.html
 
Estou alarmado a toa ou é realmente uma tentativa de invasão?
 
Obrigado lista.

_______________________________________________
KHOMP: qualidade em placas de E1, GSM, FXS e FXO para Asterisk.
- Hardware com alta disponibilidade de recursos e qualidade KHOMP
- Suporte técnico local qualificado e gratuito
Conheça a linha completa de produtos KHOMP em www.khomp.com.br
_______________________________________________
Lista de discussões AsteriskBrasil.org
AsteriskBrasil em listas.asteriskbrasil.org
http://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil




_______________________________________________
HOMP: qualidade em placas de E1, GSM, FXS e FXO para Asterisk. 
 Hardware com alta disponibilidade de recursos e qualidade KHOMP
 Suporte técnico local qualificado e gratuito 
onheça a linha completa de produtos KHOMP em www.khomp.com.br
______________________________________________
ista de discussões AsteriskBrasil.org
steriskBrasil em listas.asteriskbrasil.org
ttp://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil

-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: http://listas.asteriskbrasil.org/pipermail/asteriskbrasil/attachments/20100122/139d3e8e/attachment-0001.htm

Mais detalhes sobre a lista de discussão AsteriskBrasil