Building Telephony Systems with OpenSIPS - Second Edition

Preventing DNS and registration poisoning

DNS and registration poisoning are clever attacks, which use your SIP server infrastructure to send unauthorized calls. Actually, the attack is against the authorization process rather than authentication. Once a user has a valid account, it can send unauthorized calls to PSTN. Let's start explaining DNS poisoning, which is simpler. It exploits the possibility in a service provider to make calls to foreign domains. We will describe the following attack steps:

1. Get a valid account.
2. Make a legitimate call to PSTN and get the gateway's IP in the Contact header.
3. Change your DNS server to point a valid fully qualified domain name (FQDN) to the gateway's IP.
4. Initiate a call to the valid FQDN. In many places such ...