TEAMFORREST

Previously we posted a little script for quickly checking your asterisk log for failed peer registrations. Building on that script, and with the use of iptables and cron, you can easily (and automatically) block flooding traffic from your system. Iptables, a linux command line program to filter IP traffic, provides high level packet filtering before the traffic can be used to corrupt a program. Cron, the linux time scheduler, enables you to automatically run commands at scheduled time periods.

Set up IP Tables

We will not be discussing the intricacies of iptables in this post. There are excellent tutorials on iptables, and with most things linux, help is only a google away. To help identify the traffic blocked as asterisk related, a new chain will be created appropriately called… asterisk.

Here’s how to add the new chain:

iptables -N asterisk
iptables -A INPUT -j asterisk
iptables -A FORWARD -j asterisk

This will help identify hosts blocked for failed registrations.

Asterisk’s Log for Failed Registrations

In most cases of a sip flood attack, the host attempts registration to Asterisk. These hosts are identified in the Asterisk log (/var/log/messages) as “No matching peer found.” The following perl script scans /var/log/messages for these patterns, strips the IP address, and puts the IP address into an array.

After the file has been read, the IP addresses are counted (each count is a failed attempt), compared against the existing blocked hosts, and new occurrences are blocked. With this script we are blocking any host after the 4th failed attempt.

Here’s the script (last updated 21 APR 2010):

#!/usr/bin/perl -w
use strict;
use warnings;
my (@failhost);
my %currblocked;
my %addblocked;
my $action;

open (MYINPUTFILE, "/var/log/asterisk/messages") or die "\n", $!, "Does log file file exist\?\n\n";

while (<MYINPUTFILE>) {
	my ($line) = $_;
	chomp($line);
	if ($line =~ m/\' failed for \'(.*?)\' - No matching peer found/) {
		push(@failhost,$1);
	}
}

my $blockedhosts = `/sbin/iptables -n -L asterisk`;

while ($blockedhosts =~ /(.*)/g) {
	my ($line2) = $1;
	chomp($line2);
	if ($line2 =~ m/(\d+\.\d+\.\d+\.\d+)(\s+)/) {
		$currblocked{ $1 } = 'blocked';
	}
}

while (my ($key, $value) = each(%currblocked)){
	print $key . "\n";
}

if (@failhost) {
	&count_unique(@failhost);
	while (my ($ip, $count) = each(%addblocked)) {
		if (exists $currblocked{ $ip }) {
			print "$ip already blocked\n";
		} else {
			$action = `/sbin/iptables -I asterisk -s $ip -j DROP`;
			print "$ip blocked. $count attempts.\n";
		}
	}
} else {
	print "no failed registrations.\n";
}

sub count_unique {
    my @array = @_;
    my %count;
    map { $count{$_}++ } @array;
    map {($addblocked{ $_ } = ${count{$_}})} sort keys(%count);
}

Schedule the script with cron

The final step is to schedule your script to run every X minutes in cron. We’ve chosen to run our script every 2 minutes, but you can change this to 1 minute or any other time period you choose. Just remember… you can receive thousands of attempts within 2 minutes.

If you have named your script check-failed-regs.pl and placed it in your /usr/local/bin directory, your cron statement would look like this:

*/2 * * * * perl /usr/local/bin/check-failed-regs.pl &> /dev/null

Questions? Comments? We love feedback. Or, contact us for more information.

I guess this might be better titled as the Quick and Dirty Perl Script… but here we go:

#!/usr/bin/perl -w
use strict;
use warnings;
my (@failhost);

open (MYINPUTFILE, "/var/log/asterisk/$ARGV[0]") or die "\n", $!, "Does log file file exist\?\n\n";

while (<MYINPUTFILE>) {
	my ($line) = $_;
	chomp($line);
	if ($line =~ m/\' failed for \'(.*?)\' - No matching peer found/) {
		push(@failhost,$1);
	}
}

if (@failhost) {
	&count_unique(@failhost);
} else {
	print "no failed registrations.\n";
}

sub count_unique {
    my @array = @_;
    my %count;
    map { $count{$_}++ } @array;

	#print them out:

    map {print "$_ = ${count{$_}}\n"} sort keys(%count);

}

And while we duck from @Merlyn’s criticisms (although we love his criticism), the basic usage is:

perl [Whatever you named it].pl messages
or perl [Whatever you named it].pl messages.1

Results look like:

184.73.53.22 = 13586
64.76.45.100 = 9895
78.46.87.14 = 9960

Or “no failed registrations.” if you have no failed attempts.

Vulnerability scanning and assessment identifies security risks within your network. Team Forrest highly recommends proactive, routine scanning to help assess, react, and improve your network security.

Utilizing a variety of techniques, applications, and tools, Team Forrest remotely examines your network over the public Internet. identified weaknesses and vulnerabilities are assessed for risk and detailed, with recommendations, to the customer.

What is a Vulnerability Scan?

A vulnerability scan assesses computer systems, networks, and applications for weaknesses. Vulnerability Scans are recommended (and may be required) for any business conducting e-commerce, hosting a server with a publicly accessible IP Address, or allowing remote access to company assets. Team Forrest recommends a comprehensive scan, including:

1. Checking for vulnerabilities of remote systems
2. Checking for misconfiguration of remote systems, software, and services
3. Checking commonly used passwords
4. Checking Denial of Service sensitivity
5. Checking for Web Vulnerability (such as SQL Injection)

How does a Vulnerability Assessment Work?

Team Forrest performs the scan remotely, accessing your network over the Public Internet. There is nothing for you to do and no software will need to be installed. Our servers will simply assess your network remotely.

Once the scan completes, Team Forrest provides a detailed assessment including identified risks and vulnerabilities, as well as their severity level. Team Forrest also provides recommendations and assisting in correcting any identified flaws or vulnerabilities.

For more information on a Team Forrest Vulnerability Scan / Assessment, please call 888-295-0025 or contact us for details.

If you’re running Firefox 3.6, Mozilla strongly recommends you update to version 3.6.2. The new version corrects a critical security hole allowing an attacker to crash your browser and/or run arbitrary code on your machine.

For more information, check out the post at VoIP Tech Chat.

Update On 7/16/2009, Firefox released version 3.5.1 to address the issue. Read Update Below!

Mozilla.com released details today on a critical JavaScript vulnerability in the latest version of the popular Firefox 3.5 Web Browser. The vulnerability allows execution of code on the client (or target) system simply by visiting a website.

No patch is currently available for the flaw and several organizations (such as Scurnia, The Sans Institute, and the United States Computer Emergency Response Team) are recommending the complete disabling of JavaScript in Firefox (see below). Additionally, The Sans Institute is recommending the use of the NoScript Firefox plugin (that enables javascript only from white-listed sites).

Additional information:

• Mozilla Security Blog Post
• Secunia.com Advisory
• United States Computer Emergency Response Team
• NoScript Plugin

How to Disable the Javascript Engine in Firefox:

1. Enter about:config in the browser’s location bar.
2. Type jit in the Filter box at the top of the config editor.
3. Double-click the line containing javascript.options.jit.content setting the value to false.

Mozilla advises that disabling the JIT will result in decreased JavaScript performance and is only recommended as a temporary security measure.  Once users have been received the security update containing the fix for this issue, they should restore the JIT repeating the process above and setting the javascript.options.jit.content value to true.

Update — 7/16/2009

Firefox has introduced version 3.5.1 to address the security risk, as posted on their developer blog:

Firefox 3.5.1 update is now available for download

As part of the Mozilla Corporation’s ongoing security and stability process, Firefox 3.5.1 is now available for Windows, Mac, and Linux users as a free download from www.firefox.com.

We strongly recommend that all Firefox 3.5 users upgrade to this latest release. If you already have Firefox 3.5, you will receive an automated update notification within 24 to 48 hours. This update can also be applied manually by selecting “Check for Updates…” from the Help menu.

For a list of changes and more information, please see the Firefox 3.5.1 release notes.

Please note: If you’re still using Firefox 2.0.0.x, this version is no longer supported and contains known security vulnerabilities. Please upgrade to Firefox 3.5 by downloading Firefox 3.5.1 from www.firefox.com.

This entry was posted by beltzner on Thursday, July 16th, 2009 at 6:34 pm.