Last week I attended Astricon 2017, in Orlando, FL. I’ve attended every Astricon since 2007, each time as a speaker – and last week was the first time as a sponsor. People normally believe that companies sponsor things in trade shows according to the exposure they want to get, that is normally true. However, for Greenfield, sponsorship meant something else. We wanted to sponsor something that meant something for us, which means, an event within the conference we feel close to and see a value to the community. As a result, we’ve decided to sponsor Dangerous Demos, which had become during the past few years one of the highlights of the show. To those who are not familiar, Dangerous Demos is a section of the show, where talented developers/makers/inventors will come up on stage, showing off a cool thing they created – preferably, during the course of the conference or demoing a cool proof of concept. Why does Greenfield have an affinity to Dangerous Demos? Simple, as the makers of cloudonix.io we see ourselves and makers and innovators, thus, we felt that putting our name on this section would best represent the things we believe in.

Now, while most of the demos that were presented indeed showed original work and high level of talent, I can’t stress out how disgusted I was with “false dangerous demos” that came on stage. With all due respect, going on the stage and showing off a feature of a commercial product is simply not the spirit of dangerous demos. This is all about being original, being cheeky, walking on the bleeding edge willing to fail publicly and having a good laugh about it. For me, Dangerous Demos is very much like climbing Mt. Everest – We climb it because it’s there and its a challenge. We want to climb it with our feet and grit, not reach the top of the mountain with a helicopter. Yes, indeed the feature shown by company X or Y had talented people work on it, but there is no risk associated with it – as the feature simply works.

This years’ Astricon marked a special occasion, this was the first time that all leading Open Source VoIP projects participated in the show: Asterisk, Freeswitch, Kamailio, OpenSIPS and Homer. Now, for those who are new to this community, this would seem like something trivial and meaningless. For someone like me, who had been with these projects for over a decade, it’s nothing short than a miracle for something like this to happen. Some may not know this, but Freeswitch developer were originally working on the Asterisk project, while OpenSIPS developers were originally working on the Kamailio (OpenSER) project. The projects branched off due to differences of opinions between people, hence the splits. For example, while Freeswitch people were a little fed-up with the methodology with which Digium was accepting patches to the project, the OpenSIPS project people wanted to go to a more “market oriented” product, while the original OpenSER was fairly “Academic” in nature. The diversity of people and diversity of opinions is the thing that drove all these projects to their success. Nonetheless, when the projects split, some invisible “bad-blood” could have been sensed. Since the various splits, over a decade passed and I believe that the various projects had come to accept one another. Where one project took one path, the other took another, eventually turning each project into its own unique being, instead of being a mere competitive clone. I’ve known most of the people involved in these projects and their creation over the years and during previous years, it was always hard to get them to talk, due to these feelings. Last week was the first time that some of them met face-to-face in over 12 years, which was impressive. I’m not sure exactly who is the person behind this “summit of the minds”, but who ever they are, they need to keep this up and make sure that the projects keep on innovating and succeeding.

Now, let’s talk content. The overall panel of talks and presentations that Astricon boasts is nothing short of amazing. The sheer number of speakers and subjects turns the event to something that is sometimes confusing and hard to attend. Multiple talks at the same time, on 4-5 different tracks, with multiple points of interest always pose a hard choice – “What should I attend?”. However, this year was one of the most packed ones. For example, during the pre-conference day (AKA: DevCon), RedHat held a “NFV Track” which I really wanted to attend, but couldn’t, as I was attending DevCon. I wanted to attend some of the container talks, but couldn’t, as I was either talking at the same time – or was attending a different talk as well. In other words, I really hope the Video’s are good, as I would be truly disappointed. In this respect, I really like KamailioWorld. This one has one track, mostly technical in nature – and you can attend all the talks. It’s not because there aren’t enough speakers, I’m confident that many people answer the call-for-papers, it’s simply a choice of the organizers. In the past, Astricon used to have 3 tracks, thus the choice was simpler. I believe that maybe adding another day to the conference, or changing the format a little bit will enable people to get more from the conference.

I have other thoughts, but I believe these are the primary ones. C’ya all again next year @Astricon 2018.

 

Recently, a friend sent me a link to the TED talk appearing below:

I found the talk not only interesting, but also it made me think about the Open Source world, trying to apply the same concepts and thinking. I rapidly realised that the Open Source world also has its own set of Takers, Givers and Matchers.

So, let’s talk a little bit about Open Source Givers. The givers will be those who either initiate in open source project, constantly contribute to open source projects, preach and promote the usage of open source as a way of life and most importantly – they do so not because of a commercial or financial agenda – they do so because that’s what they believe in. These include people like John “Maddog” Hall, Linux Torvalds, Richard Stallman, Brian Kernighan, Dennis Ritchie and many others. These people operate under a premise that their work is vitally important, not the world, to mankind and the well being of others.

So, who are our Open Source takers? sorry to say, the number of Open Source takers is far greater than that of the givers. The takers are your “Script kiddies” or “Closed integrators”. Those people who use and abuse Open Source without acknowledging its existence.  In Israel, as an example, when Open Source was still in its infancy stage – people were roaming about claiming that they created a specific project or other. For example, I recall that in 2006, a company in Israel claimed it was the creator of Asterisk – and that their AMP based PBX system is their own creation. How Rude!

Who are your Open Source matchers? matchers are people who jump from being a giver and a taker according to their requirements. These people utilize open source projects, contribute code from time to time, promote the project – nominally due to a business reasoning – and these constitute a slightly bigger portion than the givers. While Open Source innovation relies on Givers, it’s progress into the business world and adaptation to the enterprise relies mostly on Matchers. Takers do not promote the Open Source industry, in some extreme cases, the actually harm the industry.

So, are you a giver, matcher or a taker?

Following yesterday’s post, I’ve decided to take another set of data – this time following the start of the year, with a specific data profile. What is the profile? I will describe:

  1. The honeypot server in this case was a publically accessible Kamailio server
  2. The honeypot changed its location and IP every 48 hours, over a period of 2 weeks
  3. The honeypot was always located in the same Amazon AWS region – in this case N.California
  4. All calls were replied to with a 200 OK, followed by a playback from an Asterisk server

In this specific case, I wasn’t really interested in the attempted numbers, I was more interested to figure out where attacks are coming from. The results were fairly surprising:

The above table shows a list of attacking IP numbers, the number of attempts from each IP number – and the origin country. For some weird reason, 97% of potential attacks originated in Western Europe. In past years, most of the attempts were located in Eastern European countries and the Far-East, but now this is Mainland Europe (Germany, France, Great Britain).

Can we extrapolate from it a viable security recommendation? absolutely not, it doesn’t mean anything specific – but it could mean one of the following:

  1. The number of hijacked PBX systems in mainland Europe is growing?
  2. The number of hijacked Generic services in mainland Europe is growing?
  3. European VoIP PBX integrators are doing a lousy job at securing their PBX systems?
  4. European VPS providers pay less attention to security matters?

If you pay attention to the attempts originating in France, you would notice a highly similar IP range – down right to the final Class-C network, that is no coincidence, that is negligence.

Now, let’s dig deeper into France and see where they are attempting to dial:

So, on the face of it, these guys are trying to call the US. I wonder what are these numbers for?

Ok, that’s verizon… let’s dig deeper…

Global Crossing? that is interesting… What else is in there???

 

So, all these attempts go to Landlines – which means, these attempts are being dialed most probably into another hijacked system – in order to validate success of finding a newly hijacked system.

Well, if you can give me a different explanation – I’m all open for it. Also, if any of the above carriers are reading this, I suggest you investigate these numbers.

 

 

Who would believe, in the age of Skype, Whatsapp and Facebook – telephony fraud, one of the most lucrative and cleanest form of theft – is still going strong. Applications of the social nature are believed to be harming the world wide carrier market – and carrier are surely complaining to regulators – and for a legitimate reason. But having said that, looking at some alarming fraud attempt statistics, thing will show you a fairly different story.

So, analysing fraud is one of my things, I enjoy dropping honeypots around the world, let them live for a few days and then collect my data. My rig is fairly simplistic:

  1. A have a Homer (www.sipcapture.org) server to capture all my traffic
  2. A have an amazon AWS cloudformation script that launches up instances of Asterisk, FreeSwitch and Kamailio
  3. All instances are pre-configured to report anything back to Homer
  4. Upon receiving a call – it will be rejected with a 403

Why is this a good honeypot scheme? simple – it gives the remote bot a response from the server, making it keep on hitting it with different combinations. In order to make the analysis juicy, I’ve decided to concentrate on the time period between 24.12.2016 till 25.12.2016 – in other words, Christmas.

I have to admit, the results were fairly surprising:

  1. A total of 2000 attacks were registered on the honeypot server
  2. The 2 dominant fraud destinations were: The palestinian authority and the UK
  3. All attacks originated from only 5 distinct IP numbers

Are you wondering what the actual numbers are? Here is the summary:

Row Labels 185.40.4.101 185.62.38.222 195.154.181.149 209.133.210.122 35.166.87.209 Grand Total
441224928354 19         19
441873770007       204   204
76264259990     1     1
17786514103         2 2
972592315527   1774       1774
Grand Total 19 1774 1 204 2 2000

As you can see, the number 972592315527 was dailed 1774 from a single IP – 185.62.38.222. I can only assume this is a botnet of some sort, but the mix of IP numbers intrigued me. So, a fast analysis revealed the following:

Amsterdam? I wonder if it’s a coffee shop or something. The thing that also intrigued me was the phone number, why would the bot continue hitting the same mobile phone number? I couldn’t find any documentation of this number anywhere. Also, the 97259 prefix automatically suggests a mobile number in the PA, so my only conclusion would be that this is a bot looking for a “IPRN” loop hole – which is again fraudulent.

So, if this what happens in 48 hours – you can imagine what happens over a month or a year.

DISCLAIMER:

The above post contains only partial information, from a specific server on a network of worldwide deployed honeypots. The information provided as-is and you may extrapolate or hypothesize what it means – as you see fit. I have only raised some points of discussion and interest.

Should you wish to join the lively discussion on HackerNews, please follow this link: https://news.ycombinator.com/item?id=13354693 for further discussion.

 

 

 

Last week marked a sad point in the history of Open Source, the highly acclaimed and established Asterisk distribution was taken down from the Internet, leaving all of its users, followers, eco-system, resellers, integrators and more with a gigantic void to be filled.

While the void will be filled at some point, I can’t but help but observe the joy and cheerfulness of the proprietary telecommunications industry, as 3CX had rapidly taken over the Elastix business in such brutal manner. According to the various discussions in the Open Source community, the entire thing was cause by, a so called “violation of copyright” or “violation of IP” of some sort, within the Open Source communities. In the past, as far as I know, when various distributions or projects violated each other’s copyright, they would notify one another – and would ask to rectify the situation. Apparently, this hadn’t happened here – or if it happened, it wasn’t published in an open manner – as you would expect.

One of the things that the community started shouting was: “Elastix had been trixboxed”. Honestly, I don’t see the similarity between the two cases. When fonality acquired trixbox, they had a clear indication of where they are going. This is not 3CX acquired Elastix, this is 3CX obliterated Elastix. This is something completely different – and with major personas in the open source community indicating that a certain, well known and renowned, Open Source persona was involved in this happening, I can only be highly offended by the everlasting stench of people’s own ambition and personal hatred towards things that are not their own.

I admit it, I never really used Elastix in my projects, I found it to be bloated, inflated with software that shouldn’t be there, too slow for my taste and with a lack of proper project leadership, patches went in and out like crazy. Yet, I can’t argue with their success and the acceptance of the product around the world. I remember being at VoIP2Today in Madrid only a few weeks ago, and there were Elastix boxes sitting on tables. Yes, Elastix wasn’t my first choice for an Office PBX, but yes, they were a choice – the idea of a commercial company coming in and removing that choice off the table – is just annoying and troubling at the same time.

My hope is that some Elastix developers will simply post the entire source code to Github or some other public repository, slapping a BSD/MIT license on their work – telling the world: “Here is our creation, the proprietary daemons decided it should die – but no one can kill an idea!” – and Elastix will keep on living in the Open Source like other projects. If the world will forget it, then so be its fate – but if the world needs it, let the world take it in two hands and raise it up to the sky and say: “You shall not die!”