Microsoft is hacking my Asterisk??? O_o

older
Re: 100G over 100 km of dark fiber

Max Tulyev

3 Nov 2020 3 Nov '20

2:55 p.m.

Hi All, I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN. What is happening? Am I missed something?

Show replies by date

Mike Hammett

3 Nov 3 Nov

2:59 p.m.

Azure? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Max Tulyev" <maxtul@netassist.ua> To: nanog@nanog.org Sent: Tuesday, November 3, 2020 1:55:45 PM Subject: Microsoft is hacking my Asterisk??? O_o Hi All, I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN. What is happening? Am I missed something?

Christian Kuhtz

3:02 p.m.

Gary E. Miller

3:06 p.m.

Yo Christian! On Tue, 3 Nov 2020 20:02:06 +0000 Christian Kuhtz via NANOG <nanog@nanog.org> wrote:

...

To report suspected security issues or abuse of Azure, please contact the cert.microsoft.com<https://portal.msrc.microsoft.com/engage/cars> team, which is available 24/7.

Useless. RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 gem@rellim.com Tel:+1 541 382 8588 Veritas liberabit vos. -- Quid est veritas? "If you can't measure it, you can't improve it." - Lord Kelvin

Christian Kuhtz

3:22 p.m.

New subject: [EXTERNAL] Re: Microsoft is hacking my Asterisk??? O_o

Sorry, why is this useless? -----Original Message----- From: NANOG <nanog-bounces+chkuhtz=microsoft.com@nanog.org> On Behalf Of Gary E. Miller Sent: Tuesday, November 3, 2020 12:06 PM To: Christian Kuhtz via NANOG <nanog@nanog.org> Subject: [EXTERNAL] Re: Microsoft is hacking my Asterisk??? O_o Yo Christian! On Tue, 3 Nov 2020 20:02:06 +0000 Christian Kuhtz via NANOG <nanog@nanog.org> wrote:

...

To report suspected security issues or abuse of Azure, please contact the cert.microsoft.com<https://portal.msrc.microsoft.com/engage/cars> team, which is available 24/7.

Gary E. Miller

3:25 p.m.

New subject: [EXTERNAL] Re: Microsoft is hacking my Asterisk??? O_o

Yo Christian! On Tue, 3 Nov 2020 20:22:59 +0000 Christian Kuhtz <chkuhtz@microsoft.com> wrote:

...

Sorry, why is this useless?

Because Azure never, ever, acts on my complaints. None of the large number I have sent.

...

-----Original Message----- From: NANOG <nanog-bounces+chkuhtz=microsoft.com@nanog.org> On Behalf Of Gary E. Miller Sent: Tuesday, November 3, 2020 12:06 PM To: Christian Kuhtz via NANOG <nanog@nanog.org> Subject: [EXTERNAL] Re: Microsoft is hacking my Asterisk??? O_o

Yo Christian!

On Tue, 3 Nov 2020 20:02:06 +0000 Christian Kuhtz via NANOG <nanog@nanog.org> wrote:

...
To report suspected security issues or abuse of Azure, please contact the cert.microsoft.com<https://portal.msrc.microsoft.com/engage/cars> team, which is available 24/7.

Useless.

RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 gem@rellim.com Tel:+1 541 382 8588

Veritas liberabit vos. -- Quid est veritas? "If you can't measure it, you can't improve it." - Lord Kelvin

RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 gem@rellim.com Tel:+1 541 382 8588 Veritas liberabit vos. -- Quid est veritas? "If you can't measure it, you can't improve it." - Lord Kelvin

Josh Luthman

3:03 p.m.

I've seen that, a shared IP on Azure that hit my honeypot IP. Ended up being an Xbox authentication IP address one day. Josh Luthman 24/7 Help Desk: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 On Tue, Nov 3, 2020 at 2:59 PM Mike Hammett <nanog@ics-il.net> wrote:

...

Azure?

----- Mike Hammett Intelligent Computing Solutions <http://www.ics-il.com/> <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> Midwest Internet Exchange <http://www.midwest-ix.com/> <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> The Brothers WISP <http://www.thebrotherswisp.com/> <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ------------------------------ *From: *"Max Tulyev" <maxtul@netassist.ua> *To: *nanog@nanog.org *Sent: *Tuesday, November 3, 2020 1:55:45 PM *Subject: *Microsoft is hacking my Asterisk??? O_o

Hi All,

I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN.

What is happening? Am I missed something?

Mike Hammett

3:05 p.m.

Ah, so then potentially spoofed, trying to get people to honeypot blacklist XBox. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Josh Luthman" <josh@imaginenetworksllc.com> To: "Mike Hammett" <nanog@ics-il.net> Cc: "Max Tulyev" <maxtul@netassist.ua>, "NANOG list" <nanog@nanog.org> Sent: Tuesday, November 3, 2020 2:03:01 PM Subject: Re: Microsoft is hacking my Asterisk??? O_o I've seen that, a shared IP on Azure that hit my honeypot IP. Ended up being an Xbox authentication IP address one day. Josh Luthman 24/7 Help Desk: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 On Tue, Nov 3, 2020 at 2:59 PM Mike Hammett < nanog@ics-il.net > wrote: Azure? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP From: "Max Tulyev" < maxtul@netassist.ua > To: nanog@nanog.org Sent: Tuesday, November 3, 2020 1:55:45 PM Subject: Microsoft is hacking my Asterisk??? O_o Hi All, I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN. What is happening? Am I missed something?

Dovid Bender

3:47 p.m.

we have seen 8.8.8.8 end up on some ban lists. On Tue, Nov 3, 2020 at 3:17 PM Mike Hammett <nanog@ics-il.net> wrote:

...

Ah, so then potentially spoofed, trying to get people to honeypot blacklist XBox.

----- Mike Hammett Intelligent Computing Solutions <http://www.ics-il.com/> <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> Midwest Internet Exchange <http://www.midwest-ix.com/> <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> The Brothers WISP <http://www.thebrotherswisp.com/> <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ------------------------------ *From: *"Josh Luthman" <josh@imaginenetworksllc.com> *To: *"Mike Hammett" <nanog@ics-il.net> *Cc: *"Max Tulyev" <maxtul@netassist.ua>, "NANOG list" <nanog@nanog.org> *Sent: *Tuesday, November 3, 2020 2:03:01 PM *Subject: *Re: Microsoft is hacking my Asterisk??? O_o

I've seen that, a shared IP on Azure that hit my honeypot IP. Ended up being an Xbox authentication IP address one day.

Josh Luthman 24/7 Help Desk: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373

On Tue, Nov 3, 2020 at 2:59 PM Mike Hammett <nanog@ics-il.net> wrote:

...
Azure?

----- Mike Hammett Intelligent Computing Solutions <http://www.ics-il.com/> <https://www.facebook.com/ICSIL> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> <https://www.linkedin.com/company/intelligent-computing-solutions> <https://twitter.com/ICSIL> Midwest Internet Exchange <http://www.midwest-ix.com/> <https://www.facebook.com/mdwestix> <https://www.linkedin.com/company/midwest-internet-exchange> <https://twitter.com/mdwestix> The Brothers WISP <http://www.thebrotherswisp.com/> <https://www.facebook.com/thebrotherswisp> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> ------------------------------ *From: *"Max Tulyev" <maxtul@netassist.ua> *To: *nanog@nanog.org *Sent: *Tuesday, November 3, 2020 1:55:45 PM *Subject: *Microsoft is hacking my Asterisk??? O_o

Hi All,

I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN.

What is happening? Am I missed something?

Mike Hammett

3:52 p.m.

When I had honeypot blacklisting for my whole network, I ran across people spoofing the Google authoritative name servers. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP ----- Original Message ----- From: "Dovid Bender" <dovid@telecurve.com> To: "Mike Hammett" <nanog@ics-il.net> Cc: "Josh Luthman" <josh@imaginenetworksllc.com>, "NANOG list" <nanog@nanog.org> Sent: Tuesday, November 3, 2020 2:47:58 PM Subject: Re: Microsoft is hacking my Asterisk??? O_o we have seen 8.8.8.8 end up on some ban lists. On Tue, Nov 3, 2020 at 3:17 PM Mike Hammett < nanog@ics-il.net > wrote: Ah, so then potentially spoofed, trying to get people to honeypot blacklist XBox. ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP From: "Josh Luthman" < josh@imaginenetworksllc.com > To: "Mike Hammett" < nanog@ics-il.net > Cc: "Max Tulyev" < maxtul@netassist.ua >, "NANOG list" < nanog@nanog.org > Sent: Tuesday, November 3, 2020 2:03:01 PM Subject: Re: Microsoft is hacking my Asterisk??? O_o I've seen that, a shared IP on Azure that hit my honeypot IP. Ended up being an Xbox authentication IP address one day. Josh Luthman 24/7 Help Desk: 937-552-2340 Direct: 937-552-2343 1100 Wayne St Suite 1337 Troy, OH 45373 On Tue, Nov 3, 2020 at 2:59 PM Mike Hammett < nanog@ics-il.net > wrote: <blockquote> Azure? ----- Mike Hammett Intelligent Computing Solutions Midwest Internet Exchange The Brothers WISP From: "Max Tulyev" < maxtul@netassist.ua > To: nanog@nanog.org Sent: Tuesday, November 3, 2020 1:55:45 PM Subject: Microsoft is hacking my Asterisk??? O_o Hi All, I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN. What is happening? Am I missed something? </blockquote>

Gary E. Miller

3:04 p.m.

Yo Max! On Tue, 3 Nov 2020 21:55:45 +0200 Max Tulyev <maxtul@netassist.ua> wrote:

...

I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN.

I have also been sing that for a few weeks. My assumption is they let Azure customers hack all they want. They ignore email complaints. RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 gem@rellim.com Tel:+1 541 382 8588 Veritas liberabit vos. -- Quid est veritas? "If you can't measure it, you can't improve it." - Lord Kelvin

Dovid Bender

3:04 p.m.

No it's not Microsoft. Welcome to the internet. It's probably someone on Azure trying to find vulnerable systems. Have a look at some of the Videos from Astricon explaining the pitfalls of voip fraud and security. https://www.youtube.com/watch?v=9Wzzlo1kfTQ (disclaimer: that's my talk) https://www.youtube.com/watch?v=CCDqpJc2aXQ https://www.youtube.com/watch?v=h5Fw70KzAls https://www.youtube.com/watch?v=hLFz8mlmKIY On Tue, Nov 3, 2020 at 2:55 PM Max Tulyev <maxtul@netassist.ua> wrote:

...

Hi All,

I have just seen a number of IPs trying to brute-force my VoIP server from Microsoft network. For example, 13.90.148.133, 20.55.203.249, 40.76.244.210... Traceroute really goes to MSN. More than a half of all usual attempts to hack my Asterisk I got today, came from MSN.

What is happening? Am I missed something?

1528

Age (days ago)

1528

Last active (days ago)

List overview

Download

11 comments

6 participants

participants (6)

Christian Kuhtz
Dovid Bender
Gary E. Miller
Josh Luthman
Max Tulyev
Mike Hammett