I made a comment about this at Astridevcon. We have seen an increase in Automated Brute Force hacking attempts against publically accessible VoIP systems. Basically, the hackers use an automated tool to hack into a VoIP system w/ insecure passwords (ala extension 100 w/ a password of 100). Once they gain access, they use it to either:
a. Send a bunch of calls to places like Cuba, were costs can be $.30 / minute. b. Have an auto-dialer blast out calls for credit-card scamming. There was an FBI announcement not too long ago about a "Vishing" scam that was targeting Asterisk PBX systems: http://blogs.digium.com/2008/12/06/sip-security-and-asterisk/ At this point, if you have your VoIP system attached to the public Internet, and are not taking security precautions such as using strong passwords and judicious firewalling, it is only a matter of time until you get hacked. From: [email protected] [mailto:[email protected]] On Behalf Of Jai Rangi Sent: Saturday, February 07, 2009 6:57 PM To: Commercial and Business-Oriented Asterisk Discussion Subject: Re: [asterisk-biz] PBX got Hacked $2000 calls in one hours? The fraud user must be a professional hacker and should have some kind of VoIP system and 10s (if not hundreds) of friends calling at the same time. On Sat, Feb 7, 2009 at 3:46 PM, Gregory Boehnlein <[email protected]> wrote: Let me guess. 1. The Switchvox was open to the Internet 2. The extensions were simple (three / four digits) and the passwords matched the extensions 3. The attacker was able to register from the public Internet as one of the users and send the calls. Sounds much more like an installation done by someone who had no clue about IP security. Don't blame Switchvox for the installers lack of a clue.. Switchvox is designed to run behind a firewall, and best practices for installation would dictate that you be very paranoid about what to allow to communicate w/ the PBX. Allowing it to be openly accessed on the Public Internet is shear stupidity. So.. what am I missing here? From: [email protected] [mailto:[email protected]] On Behalf Of VIP Carrier Sent: Saturday, February 07, 2009 6:36 PM To: Commercial and Business-Oriented Asterisk Discussion Subject: [asterisk-biz] PBX got Hacked Guys, I can't belive that our client's PBX got hacked today. My client has a SwitchVOX SMB and it got hacked! some f...@ckers with a following IP's 91.121.132.208 69.60.114.222 was able to send a calls in a matter of 1 hr for more then $2000 what can I say stay a way from switchvox -- This message has been scanned for viruses and dangerous content by <http://www.n2net.net/Products.asp?PageId=1&SubId=14> N2Net Mailshield, and is believed to be clean. _______________________________________________ --Bandwidth and Colocation Provided by http://www.api-digital.com-- asterisk-biz mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-biz -- This message has been scanned for viruses and dangerous content by N2Net Mailshield <http://www.n2net.net/Products.asp?PageId=1&SubId=14> , and is believed to be clean.
_______________________________________________ --Bandwidth and Colocation Provided by http://www.api-digital.com-- asterisk-biz mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-biz
