3 ms·
Adding to this, the last time it was mentioned here I started watching SIP SRV requests on my DNS servers and sure enough it's non stop. I added bogus records
by LinuxBender 4y ago
Adding to this, the last time it was mentioned here I started watching SIP SRV requests on my DNS servers and sure enough it's non stop. I added bogus records and the bots follow them and try to connect.
Now I just need to find a medium interaction SIP honeypot / tarpit. I already do this for SMTP. Perhaps there is a way to run Asterisk in some debugging mode to accept anything, never tried.
- yokem55 4y agoThere are kamailio setups that just respond to every request with a 200 OK, and then log the source in a db. If you want to get fancy with that you could make it reply to invites with 100 Trying and make them wait a bit for whatever timout they want to have. The problem with tarpiting them though is that it is hard to make them tie up more resources then you spend on it. SMTP can abuse tcp to send replies 1 charachter at a time with long delays between each one. SIP TCP doesn't really have the same capability.
- LinuxBender 4y agoI will give Kamailio a shot. It's at least a starting point so I can get some stats on what a majority of them are doing. It seems Kamailio is already in the Alpine Linux repository so that saves me a step.
- jeroenhd 4y agoWith SIP you'll probably need to exploit SIP directly, not the underlying protocol. Things like redirect loops may confuse callers. With a bit of luck you can redirect the caller to call sip:defaultspamuser@localhost so it calls itself, or redirect it to another bot you've detected to make the spammers bother each other.