asterisk users - Nov 2008 - Asterisk SIP security

I was looking at my CLI the other day, and found a lot of those types of
messages:

 

NOTICE[2242]: chan_sip.c:14383 handle_request_invite: Call from '' to
extension '0004525551690000' rejected because extension not found.

 

Looking at the IP, it originated from Asia and was clearly an attempt to
screw with my Asterisk server.  My quick fix was simply to block the IP
adress at the firewall level.  So that was the end of that.

 

What I don`t get is how the person got that far.  How could he attempt to
dial extensions (even though he probably was in the default context which
has nothing in it) when all my SIP peers are either password protected or
linked to a fixed IP.  And, more to the point, "Call from `` " means a
call
from what exactly?  It's not one of my phones, it's not one of my
peers
..Shouldn't the lack of a peer be enough to block the would-be hacker
from tyring extensions?

 

Any help is appreciate, I clearly don't understand SIP peers.

 

Mike

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20081128/01da601d/attachment.htm

On Fri, Nov 28, 2008 at 11:00 AM, Mike <list at virtutel.ca>
wrote:
> I was looking at my CLI the other day, and found a lot of those types of
> messages:
>
>
>
> NOTICE[2242]: chan_sip.c:14383 handle_request_invite: Call from ''
to
> extension '0004525551690000' rejected because extension not found.
>
>
>
> Looking at the IP, it originated from Asia and was clearly an attempt to
> screw with my Asterisk server.  My quick fix was simply to block the IP
> adress at the firewall level.  So that was the end of that.
>
>
>
> What I don`t get is how the person got that far.  How could he attempt to
> dial extensions (even though he probably was in the default context which
> has nothing in it) when all my SIP peers are either password protected or
> linked to a fixed IP.  And, more to the point, "Call from `` "
means a call
> from what exactly?  It's not one of my phones, it's not one of my
> peers?..Shouldn't the lack of a peer be enough to block the would-be
hacker
> from tyring extensions?
>
>
>
> Any help is appreciate, I clearly don't understand SIP peers.
>
>
>
> Mike
>
I think if you remove context from the [general] section, you would
not see these messages.

-- 
Thanks,
Steve Totaro
+18887771888 (Toll Free)
+12409381212 (Cell)
+12024369784 (Skype)