RedMax EXtreme EX-LRT Guía para resolver problemas descargar pdf (Pagina 61)

Oracle SBC Security Guide

Appendix E: Mitigating SIP Attacks

Goals

The goal of this appendix is to provide configuration recommendations to be implemented on the Session

Border Controller (SBC) to reduce the negative effects of SIP scanning tools.

The configuration techniques described will reduce the impact of attacks by known tools. The intent is to

drop all packets received from these tools without responding wherever possible. This is not possible in

all cases. DDoS configuration adjustments will be recommended to reduce the impact of attacks on SBC

resources and allow uninterrupted service to legitimate, trusted users.

Overview

SIP scanning and attack tools employed by fraudsters may target specific IP address ranges directly, but

most tend to be random scans of a whole range of IP addresses. The scanning and attack methodology

seen most frequently includes:

1. OPTIONS - Discover whether a SIP process is open and listening by asking for supported SIP

options

2. INVITE - Check for an open service that will forward calls without authorization or challenge for

registration by sending an initial call request

3. INVITE or REGISTER – Send calls and/or user authentication requests; Based on the error

received it may be possible to enumerate user extensions, or in other words determine what

accounts are available for password cracking.

4. REGISTER - Guess weak or default passwords; The attacker sends tens, hundreds, or even

thousands of passwords per discovered extension until a password is found.

5. Start making calls. The attacker then registers a soft client and makes call attempts. The initial

call attempt may not work if a dial prefix is needed, so attackers try all of those until they get an

outside line

Most of the scanning tools such as SIPVicious, SIPScan, smap, and Sipsak are open source and freely

available. Other tools are used exclusively by specific segments of criminals. As of the end of 2012, 99%

of the attacks on customer systems and public SIP honeypots that we tracked were committed using an

open source tool with easily identifiable characteristics.

This appendix provides configuration recommendations and references for more detailed information

used to mitigate attacks by SIP scanning and attack tools. Several methods will be discussed since not all

solutions may be acceptable in all customer environments.

Deployment Archetypes

Oracle classifies SIP deployments in three different major archetypes:

Peering: Calls are sent from a SIP proxy to the SD. The proxy may host SIP user agents or analog

devices if a gateway function is provided. Peering is deployed either over a private network such as

MPLS from service provider to customer, or over-the-top (OTT) via the Internet.

Customers using SIP peering or “trunking” deployments can usually implement a combination of trusted

Session Agents (SA) and Access Control Lists (ACLs) to limit what remote IP addresses are able to

communicate with the SD. In a peering network there is an implicit level of trust since the remote IP

address is known and provisioned. When the trunk is delivered over a private network we are not usually

concerned with SIP scanning prevention since there is no direct Internet access. In deployments where

1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 141 142

Sin comentarios

RedMax EXtreme EX-LRT Guía para resolver problemas Pagina 61