POLY SYSTEMS - H323 & SIP BOTNET CALLING

SOLUTION

Firewalls:

Poly cannot give advice on specific firewall configurations or specific firewalls. Those who have a third-party firewall as their defense against incoming H.323 calls should consult with their firewall and/or security experts before implementing any of the high-level recommendation in this advisory.

H.323 is not traditionally a firewall-friendly protocol. H.323 uses both UDP and TCP over a range of ports both static and dynamic. Firewalls that support H.323 natively include special rules or modules to deal with the nuances of the H.323 protocol. Such firewalls might be able to use the field information above in the form of rules or ACL’s.

Alternatively, a firewall can come at the problem with more traditional IP-based whitelisting or blacklisting techniques.

RealPresence Access Director (RPAD):

RPAD administrators can make rules to enable blocking for the two fields listed above.

The since the release of software version 4.2.2, RPAD improves these rules and administrators should ensure they’re running this or later versions.

H.323

There are several malicious H.323 agents that can cause problems for customer environments. The table below lists some of the more common agents.

The rule for Product ID of “ooh323” is shown here below. Similar rules should be set for other agents.

SIP

There are a growing number of malicious SIP agents that can cause problems with customer environments. The table below lists some of the more common malicious SIP agents.

The rule for SIP agent “friendly-scanner” is shown here below. Similar rules should be set for other malicious SIP agents.

Video Border Proxy (VBP):

VBP version 11.2.20 has fixed the issue without need for any configuration changes. This version disables fastStart on the WAN side when the call originates from a non-registered client.

This change appears to reduce the nuisance factor of the H.323 botnet without the need for configuration changes.

WORKAROUND

The challenge with these scenarios is that the target hosts (all H.323 and SIP-listening devices) are doing exactly what they are set up to do: answering calls. Polycom products are not vulnerable to anything in this situation. Mitigations to relieve the burden presented by these non-stop calls therefore come in the form of adding some ability to discern desired calls from undesired calls.

Whitelisting is the most common method for separating the good calls from the bad. In an environment where all of the “good guys” are known, it is best to simply create whitelists comprised of those addresses, and to deny all inbound calls NOT from those addresses.

Other times blacklists can be grown and maintained, blocking each of the botnet callers as it is logged and confirmed to be a “bad guy”.

The initial botnet has consistently populated two key H.323 fields with the same information.

A newer variant has changed this, using an IP address for its h323-ID field but consistently populates the productId field with “MERA RTU”

The below RPAD screenshot taken from an RPAD management interface

shows both fields from the initial botnet findings:

The latest variant of the botnet can be seen using “MERA RTU” in

the RPAD screenshot below: