<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV>At the suggestion of my VOIP provider I enabled full logging. There were at least two attempts during the night to make calls again from my server. It does now appear they are getting into my asterisk server but I cannot understand how. Someone suggested a "forked IP" whatever the hell that means....</DIV>
<DIV> </DIV>
<DIV>Here are the entries from my full log file:</DIV>
<DIV> </DIV>
<DIV>[Aug 29 23:11:51] NOTICE[92568] chan_sip.c: Registration from '"94.23.222.75:5060.....85.31.178.110.....203.174.41.18....190.10.27.80"<sip:100@98.242.233.74>' failed for '188.161.221.100' - No matching peer found<BR>[Aug 30 00:37:40] NOTICE[92568] chan_sip.c: Registration from '85.43.196.74 ... 87.236.186.110...202.43.190.195..202.43.190.195..203.215.155.38<sip:100@98.242.233.74>' failed for '109.253.85.228' - No matching peer found<BR>[Aug 30 00:37:40] NOTICE[92568] chan_sip.c: Registration from '85.43.196.74 ... 87.236.186.110...202.43.190.195..202.43.190.195..203.215.155.38<sip:100@98.242.233.74>' failed for '109.253.85.228' - No matching peer found<BR>[Aug 30 00:37:55] VERBOSE[92568] logger.c: -- Executing [011972599544327@default:1] Set("SIP/98.242.233.74-00000004", "CALLERID(all)=3058291080") in new stack<BR>[Aug 30 00:37:55] VERBOSE[92568] logger.c: -- Executing
[011972599544327@default:2] Dial("SIP/98.242.233.74-00000004", "SIP/my_voip_provider/011972599544327,,wWFotThH") in new stack<BR>[Aug 30 00:37:55] VERBOSE[92568] logger.c: -- Called my_voip_provider/011972599544327<BR>[Aug 30 00:37:56] VERBOSE[92568] logger.c: -- SIP/my_voip_provider-00000005 is making progress passing it to SIP/98.242.233.74-00000004<BR>[Aug 30 00:37:58] VERBOSE[92568] logger.c: -- Got SIP response 402 "Zero balance" back from 204.74.213.5<BR>[Aug 30 00:37:58] VERBOSE[92568] logger.c: -- No one is available to answer at this time (1:0/0/0)<BR>[Aug 30 00:37:58] VERBOSE[92568] logger.c: -- Executing [011972599544327@default:3] PlayTones("SIP/98.242.233.74-00000004", "congestion") in new stack<BR>[Aug 30 00:37:58] VERBOSE[92568] logger.c: -- Executing [011972599544327@default:4]
Hangup("SIP/98.242.233.74-00000004", "") in new stack<BR>[Aug 30 00:37:58] VERBOSE[92568] logger.c: == Spawn extension (default, 011972599544327, 4) exited non-zero on 'SIP/98.242.233.74-00000004'<BR>[Aug 30 00:38:00] NOTICE[92568] chan_sip.c: Registration from '85.43.196.74 ... 87.236.186.110...202.43.190.195..202.43.190.195..203.215.155.38<sip:100@98.242.233.74>' failed for '109.253.85.228' - No matching peer found<BR></DIV>
<DIV>OK so I see the attempts to register but they fail. Still somehow the call get attempted. The only thing keeping them from going through now is the fact that my VOIP account has a zero balance. Can anyone shed some light on what exactly is happening here. As I see it now there is a major security hole in asterisk.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"><BR>
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"><FONT size=2 face=Tahoma>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Frank Griffith <glassdude45@yahoo.com><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> Asterisk on BSD discussion <asterisk-bsd@lists.digium.com><BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Mon, August 30, 2010 5:31:52 AM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Asterisk-bsd] Securing Asterisk with a DID<BR></FONT><BR>
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt">
<DIV>Once again thanks for the advice. I am too much of a noob to understand what's happening here. This is an entry from the log file from this morning. The thieves tried again to use my server but since my provider as no credit on my account they are being rejected. Okay that's cool but now it appears that they are getting in through my asterisk server not through the DID #. Note I have "x"ed out the information I need to remain private in this entry. The IP address 100.100.100.100 is actually my IP address from Comcast.</DIV>
<DIV> </DIV>
<DIV>"","xxxxxxxxxx","011972599544327","default","xxxxxxxxxx","SIP/100.100.100.100-00000004","SIP/my_voip_provider-00000005","Hangup","","<SPAN id=lw_1283167540_2 class=yshortcuts>2010-08-30 04:37:55</SPAN>",,"<SPAN id=lw_1283167540_3 class=yshortcuts>2010-08-30 04:37:58</SPAN>",3,0,"NO ANSWER","DOCUMENTATION","<SPAN id=lw_1283167540_4 class=yshortcuts>1283143075</SPAN>.4",""</DIV>
<P> </P>
<P>Some of the log file entires show other outside IP addresses instead of my router's IP address. A couple of them actually show 127.0.0.1 which leads me to believe they have gotten access to my asterisk server. This boggle my mind because without the username and password how would asterisk allow them to make calls. I understand how they could do this using the DID because my dialplan was weak. But it now appears they did not use the DID # instead they hacked in through some method.</P>
<DIV><BR></DIV>
<DIV style="FONT-FAMILY: times new roman, new york, times, serif; FONT-SIZE: 12pt"><BR>
<DIV style="FONT-FAMILY: arial, helvetica, sans-serif; FONT-SIZE: 13px"><FONT size=2 face=Tahoma>
<HR SIZE=1>
<B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> Tim St. Pierre <tim@communicatefreely.net><BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B> Asterisk on BSD discussion <asterisk-bsd@lists.digium.com><BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Sun, August 29, 2010 11:37:38 PM<BR><B><SPAN style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Asterisk-bsd] Securing Asterisk with a DID<BR></FONT><BR>-----BEGIN PGP SIGNED MESSAGE-----<BR>Hash: SHA1<BR><BR>The IP address should tell you a lot.<BR><BR>If the IP address that the calls come from does not belong to your DID provider, then the call<BR>didn't come in on your DID.<BR><BR>Some things you may want to look at -<BR><BR>In your sip.conf, before you declare any peers, what context are you pointing "anonymous" calls to?<BR><BR>If it still says default, anything in your default context is accessible to anyone from anywhere.<BR><BR>An easy way to fix this is to change it to
something like "public", then create a public context<BR>that only allows calls to extensions, or other places you want the public at large to be able to access.<BR><BR>Good luck!<BR><BR>- -Tim<BR><BR>Frank Griffith wrote:<BR>> Thanks. I'm still a novice at hardening my asterisk system. I never had<BR>> any trouble until recently. I think someone found my DID number and<BR>> that's what the source of the hack is, not actually through my asterisk<BR>> server. But the VOIP provider is convinced that's how it happened. But<BR>> wouldn't the /var/log/asterisk/cdr-cvs/Master.csv file show which<BR>> extension they used. And I'm not seeing any of the illegal calls being<BR>> logged with an extension in my asterisk sip.conf file. They are logged<BR>> with an IP address...which again I don't know how to interpret other<BR>> than running a whois and seeing that alot of them originate from Amsterdam.<BR>> <BR>>
<BR>> ------------------------------------------------------------------------<BR>> *From:* Tim St. Pierre <<A href="mailto:tim@communicatefreely.net" rel=nofollow target=_blank ymailto="mailto:tim@communicatefreely.net">tim@communicatefreely.net</A>><BR>> *To:* Asterisk on BSD discussion <<A href="mailto:asterisk-bsd@lists.digium.com" rel=nofollow target=_blank ymailto="mailto:asterisk-bsd@lists.digium.com">asterisk-bsd@lists.digium.com</A>><BR>> *Sent:* Sun, August 29, 2010 9:07:07 PM<BR>> *Subject:* Re: [Asterisk-bsd] Securing Asterisk with a DID<BR>> <BR>> You mean, you didn't before?<BR>> <BR>> I wouldn't really call them a terrorist if there was nothing stopping<BR>> them from dialing through your<BR>> system. Oppertunist, unscrupulous perhaps. Terrorists generally try to<BR>> cause mass destruction or<BR>> panic in a large group of people.<BR>> <BR>> At any rate, it isn't
hard.<BR>> <BR>> You could use vm_authenticate, which will authenticate based on the<BR>> voice mail password, or just<BR>> plain authenticate.<BR>> <BR>> You should also do some pattern matching on the numbers that are input,<BR>> before the call is sent back<BR>> out. Do you really need to call anywhere in the world, or just certain<BR>> places? You could restrict<BR>> the destinations, which might save you if someone figures your password out.<BR>> <BR>> -Tim<BR>> <BR>> Frank Griffith wrote:<BR>>> I have a DID with a VOIP provider which has worked pretty well. Until<BR>>> some terrorist of some one of similar liking discovered it and used up<BR>>> all my credits calling Israel, Morroco and Cuba. I would like to find<BR>>> out how to be able to setup this DID so that only I could call into it<BR>>> and access my service for making outside calls. I could disable this
all<BR>>> together but then that defeats my reason for needing the DID in the<BR>>> first place. Is there a way to perhaps password protect this, that is<BR>>> when I call in I have to enter a password before being allowed to dial<BR>> out?<BR>> <BR>> <BR>> <BR><BR>- --<BR>_____________________________________________________________________<BR>- -- Bandwidth and Colocation Provided by http://www.api-digital.com --<BR><BR>Asterisk-BSD mailing list<BR>To UNSUBSCRIBE or update options visit:<BR> http://lists.digium.com/mailman/listinfo/asterisk-bsd<BR><BR><BR>- --<BR>Tim St. Pierre<BR>IP Voice technician<BR>Communicate Freely<BR>1-877-291-8647 x5101<BR>sip:<A href="mailto:5101@communicatefreely.net" rel=nofollow target=_blank ymailto="mailto:5101@communicatefreely.net">5101@communicatefreely.net</A><BR><A href="mailto:tim@communicatefreely.net" rel=nofollow target=_blank
ymailto="mailto:tim@communicatefreely.net">tim@communicatefreely.net</A><BR>-----BEGIN PGP SIGNATURE-----<BR>Version: GnuPG v1.4.10 (FreeBSD)<BR>Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org<BR><BR>iJwEAQECAAYFAkx7J4IACgkQipVy80Kcc6sDDgQAg7KB5Ngbr5H7gB5LOPGCH+lh<BR>1kzD+XCcoZcq4W8SY6uCTpVi5Jdua6DI8pdWMRRrkkMOPpbyp8/dgIBZuIFMQ+th<BR>04/8W3K8gwWyiljLy1qCmFdklJO1g4LZYsXVqY4jsmWor2rEs17l1WnYUJnFEH+v<BR>gmD6ROuwkUCqUBM0dM4=<BR>=S16L<BR>-----END PGP SIGNATURE-----<BR><BR>-- <BR>_____________________________________________________________________<BR>-- Bandwidth and Colocation Provided by <A href="http://www.api-digital.com/" rel=nofollow target=_blank>http://www.api-digital.com</A> --<BR><BR>Asterisk-BSD mailing list<BR>To UNSUBSCRIBE or update options visit:<BR> <A href="http://lists.digium.com/mailman/listinfo/asterisk-bsd" rel=nofollow
target=_blank>http://lists.digium.com/mailman/listinfo/asterisk-bsd</A><BR></DIV></DIV></DIV><BR></DIV></DIV></div><br>
</body></html>