<span style="font-family: Arial, Helvetica, sans-serif; font-size: 10pt">When we designed our systems on asterisk we designed it to me multi-tenant. Se we use customer prefixes on all extensions. This allows us to have multiple customers using the same extension pools. It also reduces the hack foot print as hackers must know the prefix for a customer to try and brute force things. All passwords use 8+ characters with alfa/numeric and special characters. <br />
<br />
As I see it Asterisk does very good keeping out the hackers if you use a solid design in your peer and dialplans. At the least put an alpha character post or pre other wise you are just asking for it. Use your head you can be smarter then they are.<br />
<br />
We are looking into ipban as well. If any one has an example of ipban I would love to see how best to implement it. In a 4 year period we have not had a breach but we do get about 10 to 15 hack attempts a week. We have blocking scripts that block ip's at the primary firewall but I would like to trigger the ipban at each switch level. Could I also use the ipban method to trigger the audo updates to our primary firewalls? Any advice is appreciated. <br />
<br />
<div id="divSignature"></div>
Bryant<br />
<br />
<span style="font-family: tahoma,arial,sans-serif; font-size: 10pt;"><hr width="100%" size="2" align="center" />
<b>From</b>: "Steve Totaro" <stotaro@totarotechnologies.com><br />
<b>Sent</b>: Friday, October 15, 2010 11:22 AM<br />
<b>To</b>: "Asterisk Users Mailing List - Non-Commercial Discussion" <asterisk-users@lists.digium.com><br />
<b>Subject</b>: Re: [asterisk-users] fraud advice</span><br />
<br />
On Fri, Oct 15, 2010 at 10:29 AM, Steve Edwards<br />
<asterisk.org@sedwards.com> wrote:<br />
> On Thu, 14 Oct 2010, bruce bruce wrote:<br />
><br />
>> But it also sickens me at how badly Asterisk is made to not cope with<br />
>> situations like this and worse than that is FreePBX.<br />
><br />
> Kind of like blaming the gun manufacturer instead of the criminal with<br />
> their finger on the trigger?<br />
><br />
> Is there some gaping hole in Asterisk security or are you just asleep at<br />
> the wheel?<br />
><br />
> --<br />
> Thanks in advance,<br />
> -------------------------------------------------------------------------<br />
> Steve Edwards sedwards@sedwards.com Voice: +1-760-468-3867 PST<br />
> Newline Fax: +1-760-731-3000<br />
><br />
<br />
This is nothing new. Trunk to trunk transfers and other exploits<br />
could be used on old school phone systems to do the same thing.<br />
<br />
I would start with getting the current balance, if over $10k call the<br />
FBI, call them anyways, it couldn't hurt. You want the Feds to check<br />
things out before local police if possible.<br />
<br />
Gather as much info as possible, along with police and FBI case<br />
numbers and then call the carrier and see what can be done.<br />
<br />
A friend of mine took what was supposed to be my one month rotation to<br />
Iraq. I had too much going on to be in Iraq for a month and a half<br />
and had taken the last rotation so it wasn't even my turn.<br />
<br />
The phone bill came for his cell (company provided on Asia Cell) for<br />
$4k in just a couple weeks. It turns out that he was not using the<br />
cell and one of the cleaning people stole his SIM.<br />
<br />
After contacting Asia Cell a few times about the matter, they credited<br />
the whole amount back. So you never know.<br />
<br />
As for security, I assume you need to allow these extensions to<br />
register from outside the LAN? If not, then only allow them to<br />
register via a LAN IP, I would do it with iptables, only allow the<br />
provider IP through.<br />
<br />
I am curious what your user:pass was? something like 1000:1000, I see<br />
many systems setup like this and am surprised they haven't been hit<br />
yet.<br />
<br />
In the future, you could use a scheme that makes it much more secure<br />
and also pretty easy to maintain.<br />
<br />
The username could be the MAC and the pass could be the serial number<br />
or asset tags if you use them.<br />
<br />
I know there must be dozens of people reading this that have had the<br />
same issue but are embarrassed to speak up.<br />
<br />
(BTW Sierra Leone is in West Africa, not the Middle East.)<br />
<br />
Thanks,<br />
Steve T<br />
<br />
-- <br />
_____________________________________________________________________<br />
-- Bandwidth and Colocation Provided by http://www.api-digital.com --<br />
New to Asterisk? Join us for a live introductory webinar every Thurs:<br />
http://www.asterisk.org/hello<br />
<br />
asterisk-users mailing list<br />
To UNSUBSCRIBE or update options visit:<br />
http://lists.digium.com/mailman/listinfo/asterisk-users<br />
<br /></span>