I rented a small VPS in the UK and put Asterisk 13 on it. I thought I followed the installation and security instructions carefully, making sure to put a good strong password on it.
Within minutes of starting Asterisk, I see lots of things like this whizzing by if I turn sip set debug on. This is with a pretty empty sip.conf and extensions.conf. I’ve not connected any IP phones, nor have I peered with a SIP provider.
I’ve x’d out part of my IP address, but here’s what seems to be happening:
69.197.182.202 which is in Missouri USA appears to be dialling out as if I was in Australia (0011 is the Australia exit code according to the interweb) to dial a number in York, UK.
And they try this number a LOT! Day and night. I tried ringing it - it works but no answer.
Does this indicate that something hasn’t been secured properly somewhere, or is this standard “drive-by” hack attempts which are failing as they should?
EDIT: Yes, I realise I could and should probably block via IPTables (which I have done now) or Fail2Ban, but for a bit of fun, is there some way to identify a hack attempt and deliver them an audio file of obscenity (or whatever!) before dropping the call and then banning?
SIP Debugging enabled
<--- SIP read from UDP:69.197.182.202:5070 --->
INVITE sip:0011441904891102@178.62.x.x SIP/2.0
To: 0011441904891102<sip:0011441904891102@178.62.x.x>
From: 701<sip:701@178.62.x.x>;tag=fb838278
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;rport
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Contact: <sip:701@69.197.182.202:5070>
Max-Forwards: 70
Allow: INVITE, ACK, CANCEL, BYE
User-Agent: sipcli/v1.8
Content-Type: application/sdp
Content-Length: 285
v=0
o=sipcli-Session 1312261071 1159230035 IN IP4 69.197.182.202
s=sipcli
c=IN IP4 69.197.182.202
t=0 0
m=audio 5072 RTP/AVP 18 0 8 101
a=fmtp:101 0-15
a=rtpmap:18 G729/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=ptime:20
a=sendrecv
<------------->
--- (12 headers 13 lines) ---
Sending to 69.197.182.202:5070 (no NAT)
Sending to 69.197.182.202:5070 (no NAT)
Using INVITE request as basis request - 4a12d97e9c2ff328b99d9ef35b94ac5e
No matching peer for '701' from '69.197.182.202:5070'
Found RTP audio format 18
Found RTP audio format 0
Found RTP audio format 8
Found RTP audio format 101
Found audio description format G729 for ID 18
Found audio description format PCMU for ID 0
Found audio description format PCMA for ID 8
Found audio description format telephone-event for ID 101
Capabilities: us - (ulaw|alaw|gsm|h263), peer - audio=(ulaw|alaw|g729)/video=(nothing)/text=(nothing), combined - (ulaw|alaw)
Non-codec capabilities (dtmf): us - 0x1 (telephone-event|), peer - 0x1 (telephone-event|), combined - 0x1 (telephone-event|)
Peer audio RTP is at port 69.197.182.202:5072
Looking for 0011441904891102 in default (domain 178.62.x.x)
<--- Reliably Transmitting (no NAT) to 69.197.182.202:5070 --->
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
<------------>
Scheduling destruction of SIP dialog '4a12d97e9c2ff328b99d9ef35b94ac5e' in 32000 ms (Method: INVITE)
Retransmitting #1 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #2 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #3 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #4 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #5 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #6 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #7 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #8 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #9 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Retransmitting #10 (no NAT) to 69.197.182.202:5070:
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 69.197.182.202:5070;branch=z9hG4bK-4a12d97e9c2ff328b99d9ef35b94ac5e;received=69.197.182.202;rport=5070
From: 701<sip:701@178.62.x.x>;tag=fb838278
To: 0011441904891102<sip:0011441904891102@178.62.x.x>;tag=as75caaa19
Call-ID: 4a12d97e9c2ff328b99d9ef35b94ac5e
CSeq: 1 INVITE
Server: Asterisk PBX 13.0.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0
---
Really destroying SIP dialog '4a12d97e9c2ff328b99d9ef35b94ac5e' Method: INVITE