Slashdot Mirror
SIP Attacks From Amazon EC2 Going Unaddressed
mjgraves writes "Over the past week a number of IP-PBX systems have been suffering SIP attacks from hosts in the Amazon EC2 cloud. At least a dozen known attacks have been reported to Amazon, which has been surprisingly quiet about the matter. The issue has been well documented by one of the attack victims on his blog. The matter was also discussed on the April 16th issue of the VoIP Users Conference (podcast available at the link; EC2 segment begins around 3:30). Amazon appears to have gone silent on the matter even as the attacks are ongoing. This is completely irresponsible behavior from a such a hosting company, which should be acting to take down the attacker in their midst."
This is nothing new. Hosted/PBXs have been getting blown up by dedicated/VPS/cloud/whatever for ages now, all attempting to call farawayistan or $asian_country. Drop at the edge, drop at the edge.
RK
You would think it would be pretty easily for Amazon to find and shut down the attackers... why haven't they done so already?
The goal of computer science is to build something that will last at least until we've finished building it.
I reported a Morpheus scanner running on an EC2 instance last week. I have not received any response from Amazon either. Of course I am not an EC2 customer, so I don't expect any consideration. But, if no response is forthcoming, I expect I won't be shopping at Amazon in the future for more pedestrian needs.
Every mans' island needs an ocean; choose your ocean carefully.
RTFA.
Haida Manga
Actually, TFA didn't say exactly, but it sounds like these SIP attacks are brute-force attempts to authenticate and initiate a session. Presumably they want to spam-call numbers on PBX without paying long distance.
Cloud providers focus on scale and volume to make money; quality support doesn't scale well with volume. Why are they quiet? I wouldn't be surprised if they aren't even aware of any issues.
Website Hosting
I've been reporting an IM spammer for several weeks now an IM spammer hosting sites with a place called Flying Croc. I've even complained to their upstream provider, but to no avail from either. Both of these have AUPs specifically prohibiting spamming from or spam being used to advertise sites on their network, but it seems the AUPs are only really intended to let the host disconnect someone they don't like, not actually to prevent their customers from launching an attack or spamming campaign. Or at least, the webcam sites being spammed for still trace right back to the same networks as they did.
Maybe there needs to be some mandatory service level from companies above a certain size (a response from a human within X days, etc.). Service seems to be getting worse and worse across the board. And maybe a requirement that if said company says something, it damn well better back it up when called upon to.
To fight the war on terror, stop being afraid.
Basically someone used EC2 to launch dictionary attacks against SIP providers. This could have been done from data center or even by a botnet. He's just mad that amazon ignored him.
This is nothing more than someone rying to improve security through wack-a-mole.
There's an awful lot of spam and other abuse coming out of EC2. I'm not surprised to hear that it's being used as a source of SIP attacks as well. Amazon is quite irresponsible about handling abuse. As long as it isn't harming their systems, they wait until someone reports abuse, and then they terminate only the EC2 instance from which the attack originated. They make zero effort to thwart future attacks or prevent more abuse.
Amazon is gaining a reputation as a house of ill repute, and they deserve it.
Tired of FB/Google censorship? Visit UNCENSORED!
Amazon appears to have gone silent
Can you hear me now?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I'm sure they'd take notice if Tier 1 ISP's threatened to De-Peer them.
Maybe it's Amazon's new long distance service, talk all you want, it's someone else's dime!
SIP = Session Initiation Protocol, it's the protocol that sets up and tears down the session on a VOIP call. After the initial setup, VoIP uses RTP, or Real-time Transmission Protocol to transfer the call data packets, while SIP manages the connection itself (adding callers, changing addresses, adding video, etc).
SIP is application layer protocol that sits on top of a transport protocol like TCP or UDP, which sits on top of the IP network layer. If not encrypted (it often isn't), it is vulnerable to everything TCP is, including DOS attacks, man in the middle attacks, packet sniffing, and various hardware related attacks like buffer overflows and such. Even encrypted it is still vulnerable to the hardware related attacks and DOS attacks.
What you can do with these attacks is the same as what you'd do with TCP attacks: eavesdropping, call re-routing, disconnecting calls, SIP agent impersonation to place new calls, etc.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
Had I been hearing of lots of this sort of thing, I'd be less interested in giving them the benefit of the doubt. Since I haven't, I'd like to point out that often the type of behavior that Amazon is displaying right now is due to them working with law enforcement to catch the person...versus just shutting down the instances.
An IP-PBX system is a PBX system on an IP network. ;)
A PBX is a call center through which all phone calls for a specific area are routed - like a building or a telco's service area. It stands for Private Branch Exchange.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
When did slashdot stop being news for the nerds?
Nanu Nanu...
What's not nerdy or newsworthy about network attacks on an IP-PBX system?
Or are we to assume that because someone is a nerd they must know everything about everything? If that were the case, why would nerds need news?
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
Even blackholing a whole IP block wont necessarily halt attacks. The inbound UDP packet still has to be read and have its source address resolved to one that's been blackholed, assuming that it's a legitimate address to begin with.
There is a piece of equipment that can handle this: it's called a router. And it can do all that in hardware at wire speed.
Why is Amazon allowing outgoing SIP connections? That's just asking for trouble. Amazon probably shouldn't allow instances to open outgoing connections to external IP addresses (outside Amazon's "cloud") at all unless the customer signs up for that service. Most don't need it, and the ones that do need to be monitored more closely.
So, by definition, a SIP attack is a use of a the protocol in an unauthorized way (trying to simulate an incoming call that doesn't exist, or trying to authenticate as an account that doesn't belong to you...) and even though there's no known theft of service yet, it still interferes with the legit users.
Or you could type a few words into a paragraph that told the basics of the story. If you did this on a systematic basis, you would have to think of a word for a paragraph that summarized a longer story; maybe, a summarization?
Their they're doing there hair.
I think you're overly optimistic about the performance of most routers...
That's why you use IAX2 every time it's possible, even better if it's listening on a non-standard port. If you receive only big-ass traffic (carrier2carrier) you are already expecting traffic from certain IPs, and so you drop anything else at the firewall. If you also receive small traffic (softphones, etc) you use a different server for that, with different policies. All accounts require a mandatory huge password (md5 of a random number will do) and they all have a very clean and small per-month and per-day traffic limit. You monitor all of your accounts and match that days traffic against their average, and take a closer look to anything that goes above the mark. You restrict simultaneous calls to two unless specifically asked to do otherwise on a specific account. You run port sentry and you actively block anything suspicious. You ban access to all sip accounts from Brasil, Russia and China, and you only unblock that for specific accounts upon customer request.
I receive a shitload of weird attempts on all my servers, mostly to ssh, apache and asterisk. Most of them are bots and those attacks are not targeted. Every once in a while I get something targeted, and rarely it's something sophisticated.
The internet is a wild place. It's your duty as a sysadmin to stay on top. Doing your job well is easier than asking other people to be nice.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
As a web host, like every other company of this type, we had our bunch of hackers getting-in (credit card and paypal account fraudsters/scammer mostly). As we record each IP used to register and systematically check what has been written in the registration form, many times, we have seen hackers registering with a proxy on another host. Each time we see this behavior, we get in touch with our peer, to let them know that we believe they've been hacked, and which IP (together with a timestamp) to investigate.
Very few times, we received such report. Very few times, we received an answer from these host we warned. I believe that we also sent such email at least once to Amazon and didn't get an answer.
I've come to the conclusion that, unfortunately, it is useless to do reporting (even though we will still continue to do so as this is a mater of ethic as well). It has been YEARS like this, and governments don't seem to care anyway.
I hope you are being sarcastic here right? I mean EC2 isn't only for simple web site hosting. There are tons of services that need outside access. SIP might be less common but it's still a possible that someone would use it for legal things like alerting a sysadmin that his EC2 is spamming the world. I could see a ACL service being provided by Amazon as a good idea but in the end, a lot of people will just open everything to make debugging simple.
I do get a ton of EC2 scanning and ssh attacks on a VPS instance I have with another provider. I still don't think we should automatically kill all of EC2 for this. I would consider dropping all packets from EC2 but I'm not sure if this will block S3 also which I'm planning to use.
I don't believe this is Amazon real intent here. If these IPs end up dirtied and on black lists around the world, this could cause them more trouble. But why should they automatically disconnect these instances without first investigating.
I don't think this should be down modded so quickly. He has a point, in what way is Amazon forced to tell this guy if they killed this spammers account or not.
I agree and I am disgusted by Amazon's lack of cogent response. I just wrote to them about losing my business. Since I use AWS and have been purchasing from Amazon since they started, this is no joke, but it will take more than one customer doing this to make them wake up. Please keep posting on the web if you are convinced that they should be proactive in resolving the attacks quickly. This is NOT comparable to spammers abuse. In one case, 200 register requests per second were being received. Yes, you can drop packets but your connection itself is still being hit at that level. Best case, your upstream might drop the packets. This would actually be a business plan for someone: guaranteed packet filtering before your own connection. In that case, you only need to enter an IP or range, and you'd never see that IP again. Unfortunately, it isn't that simple with some of these attacks, I I guess EC2 makes them easier to perform, which is a part of my complaint. Keep hammering until this is resolved! It's legitimate to complain about their lack of reaction.
Surprise, a company released a hosted service (in this case 'cloud computing') where they did not have well thought through security support. AWS is a hot bed of bad activity. So are many of the other cloud providers (to lesser degrees related to popularity of the service). It's going to get worse before it gets better so make sure your own infra is ready to deal with the attacks through blocking on the edge, host firewalls, IDS, whatever you deem is helpful for your setup ... and don't be afraid to block outright and request the addition of the IP's to a public block list.
.... but that would be bad :-).
But that is just my $0.02.
Of course, someone *could* use an AWS account to send calls to her phone over and over
As I see it Amazon should be compelled to act. Failure for them to do so is in effect harboring a fugitive. While there are ways to reduce the impact of the attack at your firewall that does not overcome the fact that it consumes all of the targets available bandwidth. You can protect your systems, but you remain cutoff from the rest of the world. It's a classic DOS attack just moving to the voip application space. That this is not getting much attention is a travesty. Amazon needs to be a more responsible corporate citizen, or face the consequences. It's up to use to determine what those consequences might be. I for one have simply committed to boycot Amazon as I explained here: http://www.mgraves.org/voip/2010/04/amazon-you-got-some-splaining-to-do/
Yes I know what a router is, but routers also have limits as to what they are able to process in a given amount of time. Even if a router can switch a million packets a second a half decent botnet could still bring that to a crawl
We're talking about SIP brute forcing here, not DoS. Most botnets are not large enough to emit a 1 million pps flood, especially not accidentally, while trying to brute force SIP registration.
Most of the ones that are large enough, are unlikely to be used to create such a large flood against you. They got so large by avoiding detection, and sending too large of floods from a node results in detection.
Large botnets get rented out to perform activities profitable to people who rent services from their owner. Usually spam sending.
Unless you allow IRC on your network, or one of your customers is with the anti-botnet/anti-spam camp and the botnet operator sees you as a threat, or you are a national company suitable for extortion, you are extremely unlikely to be singled out to receive a 1 million pps flood.
You are far more likely to be sending such a flood, due to compromise of hosts on your network.
Aaahh.. so the PHB types have got mod points. I see...
Them being PHBs, they obviously can’t stand reality, and rather kill the messenger (me).
Yay. Great job. Well done PHBs and in-a-castle-on-clouds-livers. Pat yourself on the back. Another problem “solved”.
Let’s see who’s the one laughing at who, in the end. ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Could they just not allow any of the cloud computing to even send out these specific attacks, or raise a flag to the admins what is going on, or are they helpless as their contracts bind them to allow whatever is going on to continue because they rented out those cycles and now can not touch them by law, because they are bound by contract?
Amazon has posted a security bulleting on their website addressing this issue: https://aws.amazon.com/security/ Frank