[asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
Hi, We all know most people are reporting that Amazon hasn't been helpful at all. A few people say they've received answers, but most are getting smoke screen PR BS. You can vote this up on Slashdot, send the message: SIP Attacks From Amazon EC2 Going Unaddressed: http://bit.ly/bOkNNx Send this

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Tzafrir Cohen
On Sun, Apr 18, 2010 at 12:10:32PM +0200, Randy R wrote: Hi, We all know most people are reporting that Amazon hasn't been helpful at all. A few people say they've received answers, but most are getting smoke screen PR BS. You can vote this up on Slashdot, send the message: SIP Attacks

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Fred Posner
Tzafrir Cohen tzafrir.co...@xorcom.com wrote: On Sun, Apr 18, 2010 at 12:10:32PM +0200, Randy R wrote: Hi, We all know most people are reporting that Amazon hasn't been helpful at all. A few people say they've received answers, but most are getting smoke screen PR BS. You can vote this

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
On Sun, Apr 18, 2010 at 1:56 PM, Tzafrir Cohen tzafrir.co...@xorcom.com wrote: It seems that at least Slashdot is responsive: http://it.slashdot.org/story/10/04/17/2059256/SIP-Attacks-From-Amazon-EC2-Going-Unaddressed Yes, there's a lot of talk here, some of it sympathetic, some less so, but

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Stuart Sheldon
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Randy R wrote: On Sun, Apr 18, 2010 at 1:56 PM, Tzafrir Cohen tzafrir.co...@xorcom.com wrote: It seems that at least Slashdot is responsive: http://it.slashdot.org/story/10/04/17/2059256/SIP-Attacks-From-Amazon-EC2-Going-Unaddressed Yes,

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
On Sun, Apr 18, 2010 at 5:38 PM, Stuart Sheldon s...@actusa.net wrote: I a related question, if the IP addresses were spoofed, how could a response be directed back? Don't the register attempts, because they If the IP addresses were spoofed, it would be simply a DoS attack. This is what I

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Stuart Sheldon
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Randy R wrote: On Sun, Apr 18, 2010 at 5:38 PM, Stuart Sheldon s...@actusa.net wrote: I a related question, if the IP addresses were spoofed, how could a response be directed back? Don't the register attempts, because they If the IP addresses

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Fred Posner
On Apr 18, 2010, at 1:14 PM, Randy R wrote: On Sun, Apr 18, 2010 at 6:02 PM, Stuart Sheldon s...@actusa.net wrote: For what it's worth, here is my Blog Article from the incident... http://www.stuartsheldon.org/blog/2010/04/sip-brute-force-attack-originating-from-amazon-ec2-hosts/ Saw it

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
On Sun, Apr 18, 2010 at 6:02 PM, Stuart Sheldon s...@actusa.net wrote: For what it's worth, here is my Blog Article from the incident... http://www.stuartsheldon.org/blog/2010/04/sip-brute-force-attack-originating-from-amazon-ec2-hosts/ Saw it early on Stu, and quoted your excellent summary:

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
On Sun, Apr 18, 2010 at 7:17 PM, Fred Posner f...@teamforrest.com wrote: There's also a link to it from the VoIP Tech Chat article. And we are also linking to Fred's original story which says it all about Amazon: http://www.voiptechchat.com/voip/457/amazon-ec2-sip-brute-force-attacks-on-rise/

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Rob Townley
On Sun, Apr 18, 2010 at 12:25 PM, Randy R randulo2...@gmail.com wrote: On Sun, Apr 18, 2010 at 7:17 PM, Fred Posner f...@teamforrest.com wrote: There's also a link to it from the VoIP Tech Chat article. And we are also linking to Fred's original story which says it all about Amazon:

Re: [asterisk-users] Amazon EC2 SIP floods - you can help

2010-04-18 Thread Randy R
On Sun, Apr 18, 2010 at 8:16 PM, Rob Townley rob.town...@gmail.com wrote: Just a thought or my worst nightmare.  i wonder if it isn't a hyperkit / hyperrootkit.  A malicious variant of BluePill on a Virtual Machine that can spread through all other VM's on a machine because it becomes the