topic Re: SIP Register Message Brute Force Attack in General Topics

SIP Register Message Brute Force Attack

MUNNA2117 — Tue, 17 Aug 2021 03:02:04 GMT

Can anyone suggest why this alerts keep triggering on regular basis. Internal connection - destination port is 5060. Observed multiple SYN/FIN connection.

SIP Register Request Attempt(33592)

SIP clients typically use TCP or UDP on port numbers 5060 or 5061 for SIP traffic to servers and other endpoints. Port 5060 is commonly used for non-encrypted signaling traffic whereas port 5061 is typically used for traffic encrypted with Transport Layer Security (TLS).A SYN-FIN flood is a DDoS attack designed to disrupt network activity by saturating bandwidth and resources on stateful devices in its path. By continuously sending SYN-FIN packets towards a target, stateful defenses can go down (In some cases into a fail open mode).On checking logs in DT,
# SF Normal establishment and termination.
# RSTR Established, responder aborted.
# SH Originator sent a SYN followed by a FIN, we never saw a SYN ACK from the responder (hence the connection was "half" open).
# OTH No SYN seen, just midstream traffic (a "partial connection" that was not later closed).

Re: SIP Register Message Brute Force Attack

S.Cantwell — Tue, 24 Aug 2021 16:46:38 GMT

That is good question. In order for a session to be seen/evaluated by the FW, we would agree that there needs to be a 3 way handshake between Client and Server (responder). So, the FW is seeing multiple of these requests coming in from the CLIENT. We (the FW) are see these attempts. Why are you clients sending these? We do not know, and I believe you may not know. Only the developer of the SIP application can determine how and why their application is sending out the packets. I have so many crazy (non protocol following) applications. For example... when Chrome users go out to the Internet, why does Chrome perform a host sweeping technique (communicating to various servers on port 80/443) rather than connect to a single server? This is due to the application and we (the FW/security guys) have the visibility to see unusual patterns of traffic, due to developer's application. So.. I guess you will need to read/research/contact the SIP application company to see why they do the things they do. (sorry, wish I could be more helpful)

Re: SIP Register Message Brute Force Attack

S.Cantwell — Tue, 24 Aug 2021 16:47:44 GMT

To add to my statement. If you want, just modify that ID from alert to ALLOW, and commit. now, you will not see those alerts (but you also have not determined why.... )

Re: SIP Register Message Brute Force Attack

BPry — Tue, 24 Aug 2021 21:10:43 GMT

@MUNNA2117,

Just a suggestion, but do you have a Message Waiting Indicator (MWI) light on your phones? This sounds a lot like MWI registration which in general is pretty poorly implemented across most vendors. Easy enough to work around, but I would guess that this is due to that MWI registration process.