Brute force attack

Asterisk Asterisk Support
1

The logfile below shows that extensions are being sent to the system to try and find a match. Hundreds of these are coming in within a few seconds. They all appear as coming from “internal”, but the numbers are local and international numbers. The freePBX firewall doesn’t seem to be paying any attention to this and there is not an IP to block. The following is a small sample of the logfile. Appreciate any suggestion to block this seeming attack. Asterisk version 13.12.2.

[2016-11-26 10:31:10] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-915-9178 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-831-252-2594 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 832-326-6025 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-771-3178 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-831-252-2594 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 323-793-8088 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 209-814-0119 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[2804]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-408-368-6854 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-887-5850 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4158676469 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-831-252-2594 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:10] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 323-793-8088 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 323-793-8088 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-515-2444 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-990-5774 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12680]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-887-5850 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29270]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-888-0070 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[26406]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-314-4900 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6387]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 916-601-8421 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29233]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 717-824-9040 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6614]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 916-601-8421 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 717-824-9040 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[15811]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650.740.6770 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6482]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-515-2444 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-515-2444 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-306-6310 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +14083907565 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 916-601-8421 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085293347 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +14083907565 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085293347 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650.703.6611 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085293347 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650.703.6611 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650.703.6611 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-506-0155 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-506-0155 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-506-5553 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12680]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-506-5553 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29270]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-766-9945 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[26406]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 510.292.0102 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6387]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 510.292.0102 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29233]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-987-0971 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6614]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-766-9945 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-766-9945 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[15811]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 5189150340 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16628]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-515-9204 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6482]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-533-3449 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4082028800 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085952618 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 714-290-6381 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-778-995-6329 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 5189150340 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085952618 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 940-447-1618 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[2804]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-533-3449 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4085952618 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4082028800 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-299-0155 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4087442213 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4082028800 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-306-0706 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 8432520556 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12680]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4087442213 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29270]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 940-447-1618 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[26406]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 15128265547 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6387]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 714-309-3900 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29233]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 714-309-3900 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6614]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-533-3449 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-817-0490 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-817-0490 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[15811]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-778-995-6329 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 714-309-3900 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6482]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-778-995-6329 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension +1-778-995-6329 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 8432520556 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-306-0706 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 8432520556 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 714-309-3900 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-255-2172 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[2804]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-299-0155 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408.838.1154 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 585-415-4132 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 15128265547 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 707-853-6960 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 707-853-6960 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9102742044 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 585-415-4132 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12680]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-336-6876 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29270]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-710-3622 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[26406]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 707-853-6960 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6387]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408.838.1154 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29233]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408.838.1154 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6614]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-255-2172 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 5034751336 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16628]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 650-255-2172 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[15811]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-888-9629 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 5185783759 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6482]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-888-9629 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 707-853-6960 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9252236200 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 805-203-5136 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-710-3622 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-710-3622 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 617-365-0432 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[2804]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9252236200 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-313-0420 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 617-365-0432 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 301-296-9400 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9255845676 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 925-225-1200 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 510-673-1980 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-292-7373 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29270]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 510-673-1980 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12680]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 510-673-1980 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[26406]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-601-8463 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6387]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9255845676 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[29233]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-981-6365 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6614]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-672-4742 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27059]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408.244.7000 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16628]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 415-601-8463 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[15811]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 9542987383 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[19539]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4086909992 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[28588]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 206.200.7250 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[6482]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 206.200.7250 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22480]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4086909992 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[16673]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 206.200.7250 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[32348]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 512-415-9367 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[12925]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 206.200.7250 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[5795]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 512-415-9367 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[2804]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-806-1837 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[13145]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 512-870-7401 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[30619]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 512-870-7401 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[23577]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 4082895906 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[9631]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 520.289.7117 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[565]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-806-5669 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[22688]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed: Extension 408-784-2345 does not exist in context 'from-internal' or has no associated hint
[2016-11-26 10:31:11] NOTICE[27395]: res_pjsip_exten_state.c:358 new_subscribe: Extension state subscription failed:
2

For FreePBX support, use http://community.freepbx.org/

Such attacks are normal.

You should have multiple layers of firewall stopping these from reaching you (I’m not actually sure what you mean by the FreePBX one). Firewalls need to be configured to know friend from foe.

You should enable the security log to see where they are coming from. Many people use fail2ban to analyse that log and dynamically add rules to the Linux firewall.

Also note that SUBSCRIBE Is not a normal attack vector.

3

David551,

Thank you for the response.

I posted on FreePBX…

This appears to be an Asterisk issue as the logfiles are generated from running the asterisk logging in verbose mode from the command line in CentOS.

I haven’t seen this level of attack and the attacker is obviously familiar with their target only saturating the switch for a few seconds every 15 minutes which bypasses all of the FreePBX safeguards and “fail2ban”.

FreePBX does now have a built-in firewall, but the “from internal” attack, such as this doesn’t narrow down the attacker.

This switch is behind a SonicWALL NSA240, NAT, Fail2Ban and the built-in FreePBX firewall. How are they forcing the switch to even consider the hundreds of requests in the first place?

I don’t think we have the switch misconfigured, but possible. Not sure which module would allow this type of attack.

4

The fact that Asterisk logs them just means they got through the firewall.

Thinking about it, the fact that they have got so far, and the context is from_internal, suggests they have cracked the device name (unfortunately FreePBX requires this to be the extension) and password on one of your local devices. chan_sip authenticates before it gets here. I would have though pjsip would authenticate as well, although it is possible that it doesn’t authenticate until after it has checked if there is something that can be subscribed to.

However, I can’t see what information they would hope to get with those numbers, and a subscribe is not going to result in a toll call.

5

David551,

Any suggestion on backtracking this so I can determine which device has been compromised?

You mentioned security logging. I am not familiar with that.

6

If you can get the SIP traffic using “pjsip set logger on” it can be used to determine the endpoint.

7

Thank you all for your input. We shut everything down systematically and watched the result. Our impression is that it was the Zulu UC module gone crazy. Shutting it down showed the greatest change. We did however restart it and the flooding stayed low. It has stopped, but we are not 100% sure why…

Thank you again.

8

Discovered the culprit. It wasn’t ZULU. Misconfiguration of Bria 4 for desktop. All of the accounts were set with XMPP/Presence selected. Watching the log files in Asterisk showed errors regarding Presence after every seeming attack. By unchecking the XMPP/Presence check box in Bria all the attacks stopped and have not returned. Thank you to everyone who responded with ideas on this issue.