[asterisk-users] Am I cracked?

[Dereck D]

For such cases i created a dialplan in the default dialplan which blocks
the ip of the hacker with iptables.

On Monday, June 8, 2015, Luca Bertoncello <lucabert at lucabert.de> wrote:

> Hi list!
>
> Very strange...
> I ran the Asterisk CLI for other tasks, and suddenly I got this message:
>
>   == Using SIP RTP CoS mark 5
>     -- Executing [000972592603325 at default:1]
> Verbose("SIP/192.168.20.120-0000002a", "2,PROXY Call from 0123456 to
> 000972592603325") in new stack
>   == PROXY Call from 0123456 to 000972592603325
>     -- Executing [000972592603325 at default:2]
> Set("SIP/192.168.20.120-0000002a", "CHANNEL(musicclass)=default") in new
> stack
>     -- Executing [000972592603325 at default:3]
> GotoIf("SIP/192.168.20.120-0000002a", "0?dialluca") in new stack
>     -- Executing [000972592603325 at default:4]
> GotoIf("SIP/192.168.20.120-0000002a", "0?dialfax") in new stack
>     -- Executing [000972592603325 at default:5]
> GotoIf("SIP/192.168.20.120-0000002a", "0?dialanika") in new stack
>     -- Executing [000972592603325 at default:6]
> Dial("SIP/192.168.20.120-0000002a", "SIP/pbxluca/000972592603325,,R") in
> new stack
> [Jun  8 21:42:50] WARNING[18981]: app_dial.c:2345 dial_exec_full: Unable
> to create channel of type 'SIP' (cause 20 - Subscriber absent)
>   == Everyone is busy/congested at this time (1:0/0/1)
>     -- Executing [000972592603325 at default:7]
> Hangup("SIP/192.168.20.120-0000002a", "") in new stack
>   == Spawn extension (default, 000972592603325, 7) exited non-zero on
> 'SIP/192.168.20.120-0000002a'
> [Jun  8 21:43:22] WARNING[16633]: chan_sip.c:3830 retrans_pkt:
> Retransmission timeout reached on transmission
> 8dc31ca4e660a0408450715638784d86 for seqno 1 (Critical Response) -- See
> https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
> Packet timed out after 32001ms with no response
>
> At the time no phone try to call...
> On my Firewall I see a SIP packet coming from an IP in Palestine...
> Am I cracked? I think I disabled all "guest" access. How can I check if my
> Asterisk allows guest to originate calls?
>
> Thanks
> Luca Bertoncello
> (lucabert at lucabert.de <javascript:;>)
>
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>                http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>    http://lists.digium.com/mailman/listinfo/asterisk-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20150610/7e3079c0/attachment.html>