Re: SIP - perhaps botnet? anyone else seeing this?

[Andy Davidson <andy () nosignal org>]

On Wed, Apr 15, 2009 at 11:35:43AM -0500, Dane wrote:
> Today I heard from someone who says Verizon is telling them they see
> about 700 calls per hour to Cuba originating from their PRI.
> Obviously some type of toll fraud. 

In the same way that it's possible to configure a mail relay as a
device that forwards mail between unintended parties, it is possible 
to configure a SIP proxy as a device that causes calls to be 
forwarded between unintended parties too.

Likewise, in the same way that spammers scan network ranges for these
misconfigured mail gateways, thieves look for unsecured SIP gateways
to relay calls through.

The SIP traffic mentioned at the start of this thread doesn't follow
the pattern of this constant background noise.


Kind regards,
Andy