asterisk users - Jan 2015 - Investigating international calls fraud

On 29 Jan 2015, at 11:07, Administrator TOOTAI wrote:
> Le 28/01/2015 22:03, Steven McCann a ?crit :
>> Hello,
>
> Hi
>
>>
>> I'm investigating a situation where there was a hundreds of minutes
>> of
>> calls from an internal SIP extension to an 855 number in Cambodia,
>> resulting in a crazy ($25,000+) bill from the phone company. I'm
>> investigating, but can anyone provide some feedback on what's 
>> happened
>> here? I'm investigating how this happened as well as what types of
>> arrangements can be made with the phone company (CenturyLink in 
>> Texas).
Are you sure the calls weren't actually made internally? Can you see 
anything to suggest the ip or mac address of the phone changed? Because 
for someone to take advantage of the calls (assuming they don't get cash 
out of ringing Cambodia) they needed to proxy through to that phone 
line, which maybe required them leaving some sort of device on the 
network. Otherwise I am guessing they got onto your PBX somehow.

As suggested logs are important, including DHCP, syslog to see if 
anything unusual happened.

Did the calls run all day or just at night when no one was around?
Was there more than one call up at a time? (how many calls does the 
Mitel phone support?)
How long were the calls? Were they varying lengths (more human like) and 
did they just redial as soon as they were dropped? Or were they 
automated to trigger as much cost as possible e.g. if the 1st minute is 
the most expensive then you get a lot of short calls.

Good luck

>>
>> Some details:
>> * PBX is located in Texas
>> * Phone carrier is CenturyLink
>> * FreePBX distro running asterisk 1.8.14
>> * source SIP extension is Mitel 5212, firmware 08.00.00.04, default
>> admin password (argh!). Phone is used by many different people.
>>
>> More PBX setting details:
>> * inbound SIP traffic is not allowed through the firewall
>> * internal network is not accessed by many
>> * FreePBX web interface
>>
>> *Questions I have at this moment:*
>> 1) how were the calls placed? Was the Mitel SIP phone hacked somehow?
>> Asterisk PBX?
>
> Check your logs. In the full log with verbosity 3 you can follow how 
> calls were treated. Also the CDR should give you informations like the 
> extension(s) who placed those calls
>
> [...]
>
> -- 
> Daniel
>
> -- 
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>            http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
> http://lists.digium.com/mailman/listinfo/asterisk-users

Hmm the calls are made during the day (and sometimes very early in the
morning). Right now it looks like someone actually made these calls. If
that is the case it's somewhat comforting to know the system wasn't
compromised. However, the $25,000 phone bill still remains. Yikes. $6.25
per minute to Cambodia seems quite steep to me.

On Wed, Jan 28, 2015 at 6:07 PM, Duncan Turnbull <duncan at
e-simple.co.nz>
wrote:
> On 29 Jan 2015, at 11:07, Administrator TOOTAI wrote:
>
>  Le 28/01/2015 22:03, Steven McCann a ?crit :
>>
>>> Hello,
>>>
>>
>> Hi
>>
>>
>>> I'm investigating a situation where there was a hundreds of
minutes of
>>> calls from an internal SIP extension to an 855 number in Cambodia,
>>> resulting in a crazy ($25,000+) bill from the phone company.
I'm
>>> investigating, but can anyone provide some feedback on what's
happened
>>> here? I'm investigating how this happened as well as what types
of
>>> arrangements can be made with the phone company (CenturyLink in
Texas).
>>>
>>
> Are you sure the calls weren't actually made internally? Can you see
> anything to suggest the ip or mac address of the phone changed? Because for
> someone to take advantage of the calls (assuming they don't get cash
out of
> ringing Cambodia) they needed to proxy through to that phone line, which
> maybe required them leaving some sort of device on the network. Otherwise I
> am guessing they got onto your PBX somehow.
>
> As suggested logs are important, including DHCP, syslog to see if anything
> unusual happened.
>
> Did the calls run all day or just at night when no one was around?
> Was there more than one call up at a time? (how many calls does the Mitel
> phone support?)
> How long were the calls? Were they varying lengths (more human like) and
> did they just redial as soon as they were dropped? Or were they automated
> to trigger as much cost as possible e.g. if the 1st minute is the most
> expensive then you get a lot of short calls.
>
> Good luck
>
>
>
>
>>> Some details:
>>> * PBX is located in Texas
>>> * Phone carrier is CenturyLink
>>> * FreePBX distro running asterisk 1.8.14
>>> * source SIP extension is Mitel 5212, firmware 08.00.00.04, default
>>> admin password (argh!). Phone is used by many different people.
>>>
>>> More PBX setting details:
>>> * inbound SIP traffic is not allowed through the firewall
>>> * internal network is not accessed by many
>>> * FreePBX web interface
>>>
>>> *Questions I have at this moment:*
>>> 1) how were the calls placed? Was the Mitel SIP phone hacked
somehow?
>>> Asterisk PBX?
>>>
>>
>> Check your logs. In the full log with verbosity 3 you can follow how
>> calls were treated. Also the CDR should give you informations like the
>> extension(s) who placed those calls
>>
>> [...]
>>
>> --
>> Daniel
>>
>> --
>> _____________________________________________________________________
>> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
>> New to Asterisk? Join us for a live introductory webinar every Thurs:
>>            http://www.asterisk.org/hello
>>
>> asterisk-users mailing list
>> To UNSUBSCRIBE or update options visit:
>> http://lists.digium.com/mailman/listinfo/asterisk-users
>>
>
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>               http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.digium.com/pipermail/asterisk-users/attachments/20150128/f4d26237/attachment-0001.html>

The 25000$ @6.25/min means 4000 minutes of calls (or 66H) 
Not sure in how many days this has accumulated but i seriously dought this is
made from a human accessing the phone.
The fact that you get the calls at certain times might have to do with the
timezone the calls are going

If you phone has an API (most have) and allows for calls to be made, or the web
interface allows calls to be placed from there, and there is no password or the
default credentials then this is how the calls are made.
Check the call velocity (number of calls per minute) from that phone and if you
see multiple calls at the same time frame then its probably not a (single) human
doing it but some dialler.

We start seen this way more often than before. i.e using the phone as an attack
surface instead of breaking into to pbx.
Also there seem to be a lot of javascript "cross-site? scripting attacks on
the loose that target voip networks from the inside.
I.e using the browser to execute attacks from inside of a secure/firewalled
network.
 



Stelios Koroneos

Jabber : stelios at soldecom.com



> On Jan 29, 2015, at 1:19 AM, Steven McCann <steven.r.mccann at
gmail.com> wrote:
> 
> Hmm the calls are made during the day (and sometimes very early in the
morning). Right now it looks like someone actually made these calls. If that is
the case it's somewhat comforting to know the system wasn't compromised.
However, the $25,000 phone bill still remains. Yikes. $6.25 per minute to
Cambodia seems quite steep to me.
> 
> On Wed, Jan 28, 2015 at 6:07 PM, Duncan Turnbull <duncan at
e-simple.co.nz> wrote:
> On 29 Jan 2015, at 11:07, Administrator TOOTAI wrote:
> 
> Le 28/01/2015 22:03, Steven McCann a ?crit :
> Hello,
> 
> Hi
> 
> 
> I'm investigating a situation where there was a hundreds of minutes of
> calls from an internal SIP extension to an 855 number in Cambodia,
> resulting in a crazy ($25,000+) bill from the phone company. I'm
> investigating, but can anyone provide some feedback on what's happened
> here? I'm investigating how this happened as well as what types of
> arrangements can be made with the phone company (CenturyLink in Texas).
> 
> Are you sure the calls weren't actually made internally? Can you see
anything to suggest the ip or mac address of the phone changed? Because for
someone to take advantage of the calls (assuming they don't get cash out of
ringing Cambodia) they needed to proxy through to that phone line, which maybe
required them leaving some sort of device on the network. Otherwise I am
guessing they got onto your PBX somehow.
> 
> As suggested logs are important, including DHCP, syslog to see if anything
unusual happened.
> 
> Did the calls run all day or just at night when no one was around?
> Was there more than one call up at a time? (how many calls does the Mitel
phone support?)
> How long were the calls? Were they varying lengths (more human like) and
did they just redial as soon as they were dropped? Or were they automated to
trigger as much cost as possible e.g. if the 1st minute is the most expensive
then you get a lot of short calls.
> 
> Good luck
> 
> 
> 
> 
> Some details:
> * PBX is located in Texas
> * Phone carrier is CenturyLink
> * FreePBX distro running asterisk 1.8.14
> * source SIP extension is Mitel 5212, firmware 08.00.00.04, default
> admin password (argh!). Phone is used by many different people.
> 
> More PBX setting details:
> * inbound SIP traffic is not allowed through the firewall
> * internal network is not accessed by many
> * FreePBX web interface
> 
> *Questions I have at this moment:*
> 1) how were the calls placed? Was the Mitel SIP phone hacked somehow?
> Asterisk PBX?
> 
> Check your logs. In the full log with verbosity 3 you can follow how calls
were treated. Also the CDR should give you informations like the extension(s)
who placed those calls
> 
> [...]
> 
> -- 
> Daniel
> 
> -- 
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>            http://www.asterisk.org/hello
> 
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
> http://lists.digium.com/mailman/listinfo/asterisk-users
> 
> -- 
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>               http://www.asterisk.org/hello
> 
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-users
> 
> -- 
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>               http://www.asterisk.org/hello
> 
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>   http://lists.digium.com/mailman/listinfo/asterisk-users