today I became phone bill from my SIP account provider and it was a shock for me. It was for 1000 EUR.
I do not not believed it. Than I examined call log's in FreePBX, there were to see 24 calls to Siera Leone and Litva
total time about 30 minutes. After that I became list of calls from my provider. There were also 24 call's
but total time about 6 hours. I don't understand this. Why has Asterisk different call duration in log as my provider?
I have searched in Asterisk logs and found attack from outside. The hacker has connected to extension 1001 and placed calls.
My first problem was in instruction from my provider. They told me that I must open port 5060 in firewall to be able to
place and receive calls. Before that Asterisk was not able to register in their system. But this was also a open door
and invitation for attacker to connect to on of my extensions. My fault, i did not realize at that moment that this is a big security problem.
Second problem is that the password for certain extension is the same as extension number!!! That's the first a attacker try.
We mus definitely change this. At first install it's OK, but after that, there should be a possibility in Wizard->Phones to change
the password.
Third problems. I also saw in log's other attack to my system. Should we not utilise some sort of program as fail2ban
to protect the system against such attacks?
has someone from you the target of similar attack?
