VoIP/SIP Brute-Force Protection. Stop dictionary-based brute-force attacks on your IP Telephony System.

RdpGuard

Intrusion prevention system for your Windows Server

Follow:

Twitter
Facebook
RSS

Just as the name says, Session Initiation Protocol (SIP) is used to establish a session between 2 or more participants, modify that session, and eventually terminate that session.

The most common use case of this protocol is to establish a session in IP telephony (VoIP/PBX Systems)

If you are running SIP enabled server software like PBX server for your office with open SIP ports, your logs may contain thousands of entries like below:
[2017/12/07 01:30:24,286] SEND,104.155.45.68:55428
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:55428>;tag=0621306b-529e-4de3-8af3-16c2add9ee9a
	To: <sip:100@10.240.0.7:5060>;tag=a162044457133908
	Contact: <sip:100@54.145.237.120:5060>
	Call-ID: 0e03060d-8ed9-423b-8a87-a869b2c0c63f
	CSeq: 361100138 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752341025378199770a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0

[2017/12/07 01:30:30,96] SEND,104.155.45.68:57620
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:57620>;tag=7e1c5fae-72db-4e42-9fe2-4615477df7c9
	To: <sip:101@10.240.0.7:5060>;tag=a191130192120953
	Contact: <sip:101@54.145.237.120:5060>
	Call-ID: 2042b411-fdf0-4ef1-ae74-68ac6445cf68
	CSeq: 1674088010 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752399215815299769a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0
	
[2017/12/07 01:30:36,153] SEND,104.155.45.68:59834
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/TCP 10.240.0.7
	From: Nessus <sip:10.240.0.7:59834>;tag=1e0db670-d96b-4826-9863-aa17f45e34fc
	To: <sip:102@10.240.0.7:5060>;tag=a112172719731331
	Contact: <sip:102@54.145.237.120:5060>
	Call-ID: ce597314-fb00-4c26-ad40-121be94cde0f
	CSeq: 101627762 REGISTER
	Warning: 399 104.155.45.68 "Digest authorization required"
	WWW-Authenticate: Digest realm="172.30.2.236", nonce="752459741691999768a104b155b45b68", stale=FALSE, algorithm=MD5
	Server: MizuVoIPServer 8.6
	Content-Length: 0
These repeating REGISTER attempts usually mean brute-force attack on your IP telephony system.

Attackers are finding valid usernames first and then use dictionary-based brute-force attack to find weak passwords.

Once the password is found, the attackers can use your phone system to make expensive international phone calls.

Even if you have strong passwords, your phone system constantly works under the heavy load to serve malicious requests, consuming your CPU, Memory, Bandwidth and Disk Space (logs may grow enormously).

RdpGuard allows you to stop endless brute-force attacks on your VoIP/SIP Server.

RdpGuard works with any SIP enabled software.

It monitors one or multiple SIP ports on your server and detects failed REGISTER/INVITE attempts. If the number of failed attempts from a single IP address reaches a set limit (three by default), the attacker's IP address will be blocked.

For Windows Vista/7/8/8.1/10/11 and Windows Server 2008/2012/2016/2019/2022

Brute-Force Protection for Session Initiation Protocol (SIP)

See Also