Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

They'll just change names again, so your suit will be for a new dead company

My guess is Spectrum has been rate limiting port 5060 for a while, and finally just turned it off.

Nice.

Ah, yes. The classic "all our customers are morons" approach, with no opt-out for those 0.1% who, in fact, are not. Very typical among ISPs/Telcos.

Where I am, we used to have a different, "nerdy" ISP [0], where customer was allowed to bring their own modem; they also provided real IPv4/v6 dual-stack since forever, easy to request a /29, tech-support that's realistic to reach, and staffed with people who know what they are talking about, no bulk-firewalling port-25, etc... All for a modest 2x price increase over market average. Alas, they're out of business now.

[0] https://en.wikipedia.org/wiki/Xs4all

Yeah, in the past I tunneled everything through a VPS. These days I no longer bother, but I'm also getting service via a small ISP. It's a co-op and I got voted onto the board, so I have reasonable confidence against shenanigans.

Glad this is at the top. The linked Reddit thread demonstrates a common but fundamental misunderstanding of SIP.

Port 5060 is used for call control and is very low traffic. At most you may have timed OPTIONS messages but a “standard” SIP deployment is at most a handful of (small) packets per second per call setup and tear down with occasional REGISTER messages on an interval measured in seconds. Very low traffic and very low bandwidth. Obviously with more devices you get multiples of these numbers but still very low. 15 kbps is a pretty significant amount of SIP traffic.

This is most likely targeting VoIP abuse from tools like sipvicious. In a nutshell they scan the internet looking for open SIP ports. They then try to brute force credentials to place calls.

Why? Toll fraud. The scam works like this:

1) Setup an international toll charge number in some country. Let’s say it charges $5/min. For those that don’t know calls to these numbers get charged to the person placing the call from their phone company and end up on their phone bill with the amount getting paid out (less a cut) to the operator of the number.

2) Compromise a bunch of random exposed SIP implementations on the internet.

3) Place calls to your (or a partners) toll number.

4) Get paid from the toll charges.

5) Some time later the owner of the compromised system gets a huge bill depending on fraud detection systems at the carrier, how fast you could pump calls, etc.

It’s gotten so bad many VoIP providers block international calls by default and now (apparently) might be blocking 5060 traffic in some way.

This isn’t that different to what’s happened with SMTP over the years. To combat spam many last mile ISPs started blocking outbound TCP port 25 so compromised machines couldn’t directly send spam. This is where port 465/587 for SMTP “submission” came from.