How common are wide open SIP gateways?

Fri Feb 5 17:45:13 UTC 2010

If you are using Asterisk (and many derived PBXs), and your installation is old 
enough, and your default context will complete a call...then you may find you 
are giving free calling out.  This was fixed at some point in the Asterisk 
default configuration files.

We have noticed a lot of issues with Asterisk 1.2 and some 1.4 rollouts. 
FreePBX had some truck-sized holes in it.

On our relatively small client base, we are seing SIP probing on more or less a 
non-stop basis, and some of our customers have been hacked over the years. 
It's definitely increasing - the modern equivilent of the open-DISA access many 
old PBX/VMs offer.

On the plus side, they ususal start calling North Korea or Somalia or something 
which triggers the alarms, so they get shut down right away; we offer a default 
"Axis of Evil" block to stop international calling to the high-fraud countries 
that are out there and only allow calling there upon customer request.  I 
wouldn't be at all surprised to find much cleverer people that have hacked PBXs 
and are making calls at a moderate pace to domestic or other inexpensive areas 
as to avoid detection.

Cheers,

David.

-----

On Fri, 5 Feb 2010, Drew Weaver wrote:

> Heya,
>
> 	Has anyone done any research or have any anecdotal numbers related to how common it is to have a SIP gateway sitting out on the Internet with no ACL or authentication? Recently we have noticed a couple of instances where we get abuse complaints from companies who claim that one of our hosting clients 'stole SIP service' from them. This reminds me somewhat of the 'SMTP open relay' days. We obviously take action and shut the offending user down but I can't help but wonder how common this practice is. Usually I just ask the company why their system allows anyone to use their SIP gateway and they usually say something like "We can't predict what IP our users will come in from... etc"
>
> I am just wondering if anyone else has noticed this trend.
>
> -Drew
>
>
>