How to crash SIPVicious - introducing svcrash.py

A new tool has been added to SIPVicious - svcrash.py. As the name implies, it crashes something - svwar.py and svcrack.py. This tool is meant to be used by system administrators and organizations that are receiving unauthorized scans on their exposed IP PBX.<br /><br />Quick links: <i><b><a href="http://code.google.com/p/sipvicious">Download the latest version</a></b></i> :: <i><b><a href="http://vimeo.com/12744376">Watch a short demo of svcrash.py</a></b></i><br /><br />Since this is a little different from the usual, I'll provide a bit of background first.<br /><br />Background<br /><br />If you had been following the Asterisk or VoIP provider blogs and forums, you might have noticed people <a href="http://jcs.org/notaweblog/2010/04/11/properly_stopping_a_sip_flood/">complaining</a> about <a href="http://www.voiptechchat.com/voip/457/amazon-ec2-sip-brute-force-attacks-on-rise/">bandwidth</a> saturation due to <a href="http://isc.sans.edu/diary.html?storyid=8641">SIP scans</a>. Some people had been using Amazon EC2 based servers to look for SIP servers such as Asterisk, which have weak passwords. As a result of these scans, organizations were getting a considerable amount of bandwidth used - leading to denial of service (DoS). Why did this happen?<br /><ul><li>The attackers were using huge lists of extensions / passwords in their scans, (apparently) sometimes using <a href="http://code.google.com/p/sipvicious/wiki/FrequentlyAskedQuestions?ts=1276588667&updated=FrequentlyAskedQuestions#I%27m_running_svwar_against_a_PBX_server_and_not_getting_any">the --force option in svwar.py</a></li><li>Even if blacklisted, old versions of svwar.py and svcrack.py keep sending <a href="http://code.google.com/p/sipvicious/wiki/FrequentlyAskedQuestions?ts=1276589037&updated=FrequentlyAskedQuestions#What_is_a_stateless_scanner?">messages because they are stateless</a></li><li>Originally, Amazon's abuse team did not respond to these attacks in a timely fashion</li><li>The victim providers had less bandwidth than Amazon's cloud</li></ul>This meant that just like other denial of service attacks, dropping the packets at the victim host (eg. using iptables) is not enough.<br /><br /><span style="font-size: large;"><b>So what's new?</b></span><br /><br />1 - Updated SIPVicious to care more...<br /><br />A few weeks ago I released a new version of SIPVicious (v0.2.5) which has a timeout for svwar.py and svcrack.py. If either of these tools receives no response then it stops scanning. The reason why they receive no response could be that an intrusion prevention system blocked the scanning IP, thus making it useless to keep on scanning anyway.<br /><br />I urge everyone to update to the <a href="http://code.google.com/p/sipvicious/downloads/list">latest version (v0.2.6)</a>.<br /><br />2. Create a small basic tool that breaks the attack:<br /><br />A more aggressive approach is to make use of svcrash.py. What this tool does is abuse an unhandled exception when decoding the information from the "To" tag. This causes both svwar and svcrack to crash, thus stopping an attack. This tool is included in v0.2.6, which also includes a fix for this bug.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhx4UBcUysTAHrYN7Y_l36wJU43XRTNDHBAWlmVPscAjM3IIE-defSAnO-gemfZ_hpCfvh3h3oBQEvJdLNYbuLl6MBE8CjO7jNBCsvB-4M74EGUrYDXQGPvSiAWSWieIqWJD53l7E9fCOQ/s1600/suicide-bear.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhx4UBcUysTAHrYN7Y_l36wJU43XRTNDHBAWlmVPscAjM3IIE-defSAnO-gemfZ_hpCfvh3h3oBQEvJdLNYbuLl6MBE8CjO7jNBCsvB-4M74EGUrYDXQGPvSiAWSWieIqWJD53l7E9fCOQ/s1600/suicide-bear.jpg" /></a></div><br /><span style="font-size: large;"><b>How to run svcrash.py</b></span><br /><br />Mode 1: python svcrash.py -d attackerip -p attackerport<br />This would send one message which causes the attack to stop. You would need to find out the IP address and the attacker port from your PBX log files or by taking a look at Wireshark or tcpdump during the attack.<br /><br /><b>Mode 2:</b> sudo python svcrash.py --auto<br />This would make use of scapy (i.e. you need to have scapy v2 installed) to monitor the traffic and respond automatically every 2 seconds. This automates the whole thing so that one can leave it running to block the next attack. <br /><br /><b>Mode 3: </b>sudo python svcrash.py --astlog=/var/log/asterisk/full<br />Makes use of the Asterisk log file as a source of information. This option is still experimental as it does quite a bit of guessing. Needs more testing. For production use, the --auto mode is probably safer.<br /><br />If you have any questions about svcrash, check out the <a href="http://code.google.com/p/sipvicious/wiki/SvcrashFrequentlyAskedQuestions">FAQ</a>, and do not forget the <a href="http://code.google.com/p/sipvicious/wiki/FrequentlyAskedQuestions">SIPVicious FAQ</a> too.

How to crash SIPVicious - introducing svcrash.py

A new tool has been added to SIPVicious - svcrash.py. As the name implies, it crashes something - svwar.py and svcrack.py. This tool is mean...

Read more »

Nokia takes Apple to court, again

<a href="http://prohackingtricks.blogspot.com/search/label/Mobile">Nokia</a>, not content with the pair of existing patent actions in Delaware, has filed another action for five patent infringements. This time it's in Wisconsin, presumably for variety.<br /><br />These patents cover speech codecs, data transmission, the use of location information in applications and compact-antenna designs, all of which Nokia claims are infringed by the iPhone and iPad 3G.<br /><br />Given the <a href="http://prohackingtricks.blogspot.com/search/label/iPad">iPad</a>'s lack of speech capability we're guessing it might be not be included in that specific infringement, though we wouldn't put it past Nokia to have a punt anyway.<br /><br />The details of the allegedly infringing patents aren't known, and nor is it clear why the Finns have decided to move the action to Wisconsin. Such actions traditionally take place in Texas, where juries respect the rights of the patent holder, but the popularity of Texan courts has led some companies to Delaware - "Delaware is the new Texas" as one patent attorney put it to us.<br /><br />Which makes Wisconsin even more unlikely - unless patent actions are just going to spread, from state to state, until the entire US legal system is consumed in one almighty patent action.

Nokia takes Apple to court, again

Nokia , not content with the pair of existing patent actions in Delaware, has filed another action for five patent infringements. This time ...

Read more »