<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://27/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On 18 Oct 2013, at 04:06, John T. Bittner <<a href="mailto:john@xaccel.net">john@xaccel.net</a>> wrote:</div><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Today I was hacked but caught it very quickly. This is the weird part, they hacked an IP Auth based account by simply knowing the account name.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><br>How is this possible? I am running Asterisk 11.5.0. Now it’s my fault I used a dictionary based account name but how did they bypass the set ip I had under the account for this host.</div></div></div></blockquote><br></div><div>Did the IP show under sip show peer xxx? If it's realtime it's possible to set it and need to prune it / sip reload.</div><div><br></div><div>Steve</div></body></html>