<div dir="ltr">oops. that was supposed to be off list.....<br><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Jun 16, 2019 at 7:07 PM Dovid Bender <<a href="mailto:dovid@telecurve.com">dovid@telecurve.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">John,<br></div><div dir="ltr"><br></div><div>I spoke about security last year at Astricon [1]. If I had to guess without even knowing what your setup is I would say they either got in via an insecure phone (either default pass or one with a known security issue) or via a provisioning server. If you want I can help poke around your system tomorrow to see if we can figure out how they get in.</div><div><br></div><div>Regards,<br></div><div><br></div><div>Dovid</div><div><br></div><div><br></div><div>[1] <a href="https://www.youtube.com/watch?v=9Wzzlo1kfTQ&t=1s" target="_blank">https://www.youtube.com/watch?v=9Wzzlo1kfTQ&t=1s</a></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Jun 16, 2019 at 6:37 PM John T. Bittner <<a href="mailto:john@xaccel.net" target="_blank">john@xaccel.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_1162380842208895889gmail-m_-6728084976984929136WordSection1">
<p class="MsoNormal">Anyone know how someone can hack an asterisk box and register with every single account on the box.<u></u><u></u></p>
<p class="MsoNormal">This box only has 3 accounts, with very complex passwords. Have VoIP blacklist setup and fail2ban…<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The hackers were able to make 2 calls to Cuba before my alerting system texted me.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am running asterisk 16.3 with PJSIP.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This is my only box open to the outside world, a requirement for this one customer.<u></u><u></u></p>
<p class="MsoNormal">Looked into my logs… can't find anything out of the ordinary.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any ideas ?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> Contact: <Aor/ContactUri..............................> <Hash....> <Status> <RTT(ms)..><u></u><u></u></p>
<p class="MsoNormal">==========================================================================================<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> Contact: 12120001001/<a href="http://sip:12120001001@5.79.64.23:9227" target="_blank">sip:12120001001@5.79.64.23:9227</a> ee80678930 NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: 848842405/sip: <a href="http://848842405@5.79.64.23:9227" target="_blank">848842405@5.79.64.23:9227</a> 031ed703ba NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: 848842405/sip: <a href="http://848842405@5.79.64.23:9227" target="_blank">848842405@5.79.64.23:9227</a> 031ed703ba NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: ghbhhm0000/<a href="http://sip:ghbhhm0000@5.79.64.23:9227" target="_blank">sip:ghbhhm0000@5.79.64.23:9227</a> 959fc8fbf4 NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: ghbhhm0000/<a href="http://sip:ghbhhm0000@5.79.64.23:9227" target="_blank">sip:ghbhhm0000@5.79.64.23:9227</a> 959fc8fbf4 NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: ghbhhm0000/<a href="http://sip:ghbhhm0000@5.79.64.23:9228" target="_blank">sip:ghbhhm0000@5.79.64.23:9228</a> d7bf838918 NonQual nan<u></u><u></u></p>
<p class="MsoNormal"> Contact: ghbhhm0000/<a href="http://sip:ghbhhm0000@5.79.64.23:9228" target="_blank">sip:ghbhhm0000@5.79.64.23:9228</a> d7bf838918 NonQual nan<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any helps is much appreciated.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">John Bittner<u></u><u></u></p>
<p class="MsoNormal">CTO<u></u><u></u></p>
<p class="MsoNormal"><img width="172" height="47" id="gmail-m_1162380842208895889gmail-m_-6728084976984929136Picture_x0020_1" src="cid:16b62894b794cff311" alt="xaccellogoemail"><u></u><u></u></p>
<p class="MsoNormal">380 US Highway 46, Suite 500<u></u><u></u></p>
<p class="MsoNormal">Totowa, NJ 07512<u></u><u></u></p>
<p class="MsoNormal">Phone: 201.806.2602 x2405<u></u><u></u></p>
<p class="MsoNormal">Fax: 201.806.2604<u></u><u></u></p>
<p class="MsoNormal">Cell: 973.390.1090<u></u><u></u></p>
<p class="MsoNormal"><a href="http://www.xaccel.net/" target="_blank"><span style="color:blue">www.xaccel.net</span></a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><i><span style="font-size:7.5pt;color:gray">CONFIDENTIALITY NOTICE:<br>
This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential<br>
and privileged information which should not be shared or forwarded. Any unauthorized review, use, disclosure or distribution<br>
is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the e-mail.</span></i></b><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
-- <br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.org/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Getting+Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a></blockquote></div></div>
</blockquote></div>