Question

Do some online research about the “friendly-scanner” SIP flood/intrusion attack, then answer the following.


a. Which port does the attack target?

b. Besides flooding to deny service, how does this attack attempt to break in to a VoIP system?

c. What is an effective defense against this attack?

Answer 1

Hi, I would love to answer you with this question. Hope after the explanation of the answer you will be having a clear idea related to the same . So not wasting much time lets head towards the question.

Ans.(a) The port number 5060 is used by the Voip (Voice over ip) . This is a standard port number which acts as the gateway for the voip and streaming like services.

Ans.(b) SIP flooding ( Session Initiation Protocol) mainly uses to Deny the serivces for the voip gateway or the server resluting in the Denial of Service attack but apart from DDOS attack an attacker can try other methods to evade through the system or al lest try to gather some critical information.

Beside DDOS the eavesdropping or the session highjacking may be used to evade through the system or get some detailed information about the system of the network. Where eavesdropping is an attack to gather some sensitive information to prepare at attack or to gain the target information, which may give some outcom in the form of vulnerabilities and the evasion is done.

Session Hghjacking is mostly done for the web servers but the attacker can still try to capture the session and gain access as the legitimate user.

Ans.(c) Expected mitigations for these type of attacks are:

• Using Intrusion Detection System - The network prevention systems should be used like the IDS and IPS for the prevention of these type of attacks
• Network Monitoring - The above sytems will be of no support if the proper monitoring is not present by the network administrator
• Proper authentication - Every time an user tries to get access to his/her voip server legitimate authetication must be present so as to maintain the integrity
• Stateless Proxies - Proxies helps Network admin to trick the attacker for the original server ip source and the attacker may be trapped for the same

These are the answers for the above questions , hope you got a clear idea related the same

Please like an answer and do comment for any queries

Thanks and Happy to help :)

HAPPY LEARNING