[asterisk-users] Investigating international calls fraud
duncan at e-simple.co.nz
Wed Jan 28 17:07:11 CST 2015
On 29 Jan 2015, at 11:07, Administrator TOOTAI wrote:
> Le 28/01/2015 22:03, Steven McCann a écrit :
>> I'm investigating a situation where there was a hundreds of minutes
>> calls from an internal SIP extension to an 855 number in Cambodia,
>> resulting in a crazy ($25,000+) bill from the phone company. I'm
>> investigating, but can anyone provide some feedback on what's
>> here? I'm investigating how this happened as well as what types of
>> arrangements can be made with the phone company (CenturyLink in
Are you sure the calls weren't actually made internally? Can you see
anything to suggest the ip or mac address of the phone changed? Because
for someone to take advantage of the calls (assuming they don't get cash
out of ringing Cambodia) they needed to proxy through to that phone
line, which maybe required them leaving some sort of device on the
network. Otherwise I am guessing they got onto your PBX somehow.
As suggested logs are important, including DHCP, syslog to see if
anything unusual happened.
Did the calls run all day or just at night when no one was around?
Was there more than one call up at a time? (how many calls does the
Mitel phone support?)
How long were the calls? Were they varying lengths (more human like) and
did they just redial as soon as they were dropped? Or were they
automated to trigger as much cost as possible e.g. if the 1st minute is
the most expensive then you get a lot of short calls.
>> Some details:
>> * PBX is located in Texas
>> * Phone carrier is CenturyLink
>> * FreePBX distro running asterisk 1.8.14
>> * source SIP extension is Mitel 5212, firmware 08.00.00.04, default
>> admin password (argh!). Phone is used by many different people.
>> More PBX setting details:
>> * inbound SIP traffic is not allowed through the firewall
>> * internal network is not accessed by many
>> * FreePBX web interface
>> *Questions I have at this moment:*
>> 1) how were the calls placed? Was the Mitel SIP phone hacked somehow?
>> Asterisk PBX?
> Check your logs. In the full log with verbosity 3 you can follow how
> calls were treated. Also the CDR should give you informations like the
> extension(s) who placed those calls
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
More information about the asterisk-users