sipvicious Attacken Gira TKS IP Gateway

[Bodo]

Hoi

Der Vorteil von dem Update ist, dass ich weder mit dem iOS App auf die fritzbox komme, noch im LAN die Anrufer abfragen kann.
Die haben einfach mal alles mögliche dicht gemacht!



Sent from unterwegs

[powerpaulchen]

Hallo zusammen,

ich hatte heute morgen seit längerer Zeit mal wieder einen ungebetenen Anrruf von sipvicious.
Gibts mittlerweile irgendwelche Neuigkeiten zu dem Thema?

[bramgn]

(Sorry for non German post)

Hi,

I don't have an answer to the original question on how to prevent these intrusive calls, but these are my findings, hoping that this might give someone a better understanding as to what's going on.

I've also been having calls from sipvicious for a while now, occurring seemingly at random, sometimes during the day, sometimes at night. Weeks or months can be between calls. Just not quite often enough for me to look at this problem more seriously. Lately, though, they occur more frequently.

I have currently 2 SIP numbers configured on my Fritzbox, both wired to a different telephone. (100 + 101).

When looking at the call log from the Fritzbox (7390, firmware 06.07), the calls are directed to either number, but mostly 100. My guess is that whenever a SIP account is registered, the Fritzbox will start listening on port 5060 in order to receive legitimate phonecalls from the SIP registrar. However, i don't believe it is possible for the attacker to actually make outbound phonecalls through the Fritzbox.

The problem seems to be that any one host is allowed to establish a SIP connection with the listening port on the Fritzbox, not just the SIP registrar, pretending to be an incoming call, provided the caller knows (or rather guesses) the internal phonenumber. Since 100 and 101 are really quite common phone numbers for internal use, this seems an easy target. I haven't tested this yet, but i suspect it's possible to establish a normal incoming phonecall by having a SIP device making a direct connection.

I did have a closer look at the output of tcpdump and it confirms that the Fritzbox accepts the incoming phone without asking for it to authenticate first. This sounds bad, but it's actually quite common for SIP devices to accept calls without an authentication header, because they often lack the ability to provide credentials that the SIP proxy or server should be using. In a home or office LAN this shouldn't be any problem, but for a device that is directly connected to the Internet is asking for such troubles.

I will be changing my internal numbers to less typical ones in order to ward off these first wave scan attacks. A probably better solution would be to not have the telephone system directly visible from the Internet, but rather through a VPN or behind a physical firewall. If i find that changing the internal numbers is not solving the problem, i will be updating this post.

[imojoe]

Changing the internal numbers is not solving the problem. That was one of the first things i have tried.

Still having sipvicious incoming calls every few days/weeks...

[bramgn]

An update.

I have changed my internal numbers from 101 to 3101. So far i haven't had any phantom calls, but it's too early to say anything sensible about it.

In the meantime, I have downloaded and tested this sipvicious software.
https://code.google.com/p/sipvicious/

It's basically a couple of Python scripts that perform scans and bruteforce password attacks on vulnerable SIP systems.

Some noteworthy results:
After running the "svmap.py" script (on a remote system!) on my IP address at home, it succesfully detects the router (where x.x.x.x is my IP address)

./svmap.py x.x.x.x
| SIP Device | User Agent | Fingerprint |
-------------------------------------------------
| x.x.x.x:5060 | FRITZ!OS | disabled |

Running the "svwar.py" script, it returns the following information:

./svwar.py x.x.x.x -m INVITE
WARNING:TakeASip:using an INVITE scan on an endpoint (i.e. SIP phone) may cause it to ring and wake up people in the middle of the night
WARNING:TakeASip:extension '100' probably exists but the response is unexpected
WARNING:TakeASip:extension '101' probably exists but the response is unexpected
WARNING:TakeASip:extension '102' probably exists but the response is unexpected
etc.

This results in the ringing of the phone. After i changed the number to 3101, and performing the same scan, no telephone is ringing.

When specifying the internal number on the command line, it *does* ring:

./svwar.py -e3101 x.x.x.x -m INVITE

Another thing, running the sipvicious against my Fritzbox, it appears to totally crash the telephony system of it, ringing or no ringing. I have to reboot the router in order to receive or make phone calls again.

I have created a trouble ticket over at AVM support about this issue and my findings. Hopefully they'll be able to come up with a solution.

[bramgn]

AVM did answer my ticket, but just provided general guidelines. Perhaps useful for somebody:

Telefon an FRITZ!Box klingelt, obwohl kein Anruf eingeht | FRITZ!Box 7390 | AVM Deutschland

[maeckes]

Gibt es hier was neues?
Habe das Problem aktuell auch wieder.

Fritzbox 7390 mit aktuellem OS
Gira TKS IP-GW mit aktuellem OS

[2Fast4You78]

Interne Nummer ändern.. Wie oben...

[maeckes]

Changing the internal numbers is not solving the problem. That was one of the first things i have tried.

Still having sipvicious incoming calls every few days/weeks...

Daher die Frage
Warum sollte das Ändern der Nummer eine Lösung sein?

[Hermes]

Hallo zusammen,

bei mit ist es gestern und heute auch wieder aufgetreten. Lange Zeit war Ruhe.
Fritzbox 7390 mit aktuellem OS
Gira TKS IP-GW mit aktuellem OS

Danke und VG

[2Fast4You78]

Keine Ahnung.. Weil dieses Tool halt immer nur 601 und 602 wählt...

[maeckes]

Ich habe aber gar keine 601 oder 602 Nummer...?
welches Tool?

[2Fast4You78]

Gemeint ist die interne Nummer die du den Telefonen zugewiesen hast..
Das ist irgendeine Malware oder so.. Die huschen durchs Netz und klingeln eben an...
ich hab allerdings seit einem der Updates seitens AVM keine Attacken mehr

[maeckes]

Und wie können die von außen die Nummern wählen?
Intern habe ich keine 600er Nummern.

[maeckes]

Habe Kontakt mit Gira und AVM gehabt und da das Problem mal geschildert.
Gira hat mir wirklich sehr guten Support geliefert und sich sehr hilfsbereit gezeigt! Daumen hoch!
AVM sagt über eine A4-Seite mit einer Menge Links gefiltert ungefähr: "Liegt nicht an der Fritzbox, aber ein Neustart sollte man sowieso mal alle 3-4 Wochen machen..."

Ich habe also gemacht, was mir Gira empfohlen hat:
- alle Passwörter der IP-Telefonie der Fritzboxen (Oberfläche und IP-Telefonie) geändert
- interne IP-Rufnummern geändert. Diese sind nun mindestens 6-stellig und nicht nach dem Muster 123456 o.ä.
- Backup vom IP-GW, zurückgesetzt per Hardwareschalter, Wiederhergestellt aus Backup und mit neuen Rufnummern neu konfiguriert. Neue Passwörter im Bereich IP-Telefone wie auch bei der Oberfläche und anschließenden Neustart vom TKS-IP-GW
- Außerdem Passwort für den Zugriff des Homeservers auf dem Gateway geändert

Passwörter sind aus 9 Stellen mit Sonderzeichen und Groß- und Kleinschreibung.

Daraufhin habe ich dann noch den wertvollen Tipp von AVM beherzigt und... einen Neustart gemacht

Fazit:
Seit dem keine Phantomanrufe!

Leider nun ein anderes Problem.
Die Telefone klingeln teilweise nicht alle. Aber das muss ich mal genauer analysieren.