A Tale of Two Services
Yesterday afternoon, my girlfriend discovered a particularly large volume of voicemails on her phone, after having cleaned out her mail box just 36 hours prior. She listened to several blank voicemails, as well as one from someone who wanted us to return their call…
I began investigating by looking into the metadata for the voicemails which were left; all were from unusual phone numbers outside of our area code. My next trip was to the CDR records and my provider’s call history. These sources showed that over 1000 phone calls were attempted to be connected through our phone system to various communities around the country. Two patterns emerged while looking at the details of the calls:
- The calls were being generated in a non-sequential pattern; clearly an unscrupulous telemarketer was war-dialing to South Carolina, Michigan, and Virginia.
- All of the outbound calls were originating with my girlfriend’s CallerID.
So, I knew what was going on, but I had yet to determine to how this incident occured. Further digging revealed that the Linksys ATA being used internally was lagging significantly and intermittently. It was a moment of epiphany; I understood where the problem was, and I could take action to address it.
Several years ago, I installed an Asterisk server to provide home phone service with a company that provided an IAX trunk. At the time, all we were using softphones to make and receive calls. Over time, I upgraded to a Cisco 7940 for myself and an analog cordless phone on a Linksys ATA for my girlfriend. At the time I installed the ATA, I had not used a significant amount of security of the SIP peer registration, as the network was firewalled from the Internet.
Fast forward to 5 months ago… I obtained a business phone service through a major provider using SIP. Due to their configuration, I was required to open the SIP and RTP ports to the general Internet and forward them to my Asterisk server.
Now, we return to the present time. Several days ago, this telemarketer scanned my router, found open SIP ports, and began to issue a brute-force attack against my Asterisk server. The telemarketer scanned every possible 3 and 4 digit peer name, was able to find the Linksys ATA’s peer name, and was quickly able to brute-force the password. With this information, the telemarketer was able to register as that peer and make calls outbound, according to the dialplan configured for my girlfriend. My Cisco’s peer was not impersonated, but it would not be likely to be responsible for outbound calling due to the unique dialplan I am using.
With the understandng of what has happened, I could work to correct and block the means by which this telemarketer was using my phone system and service:
- I unloaded chan_iax.so to remove the possibility of additional phone calls being made.
- I then enabled a moderate amount of security, particularly a random password for each of my SIP devices.
- Next, I modified my firewall configuration to drop all packets through my router which contained the IP address from which the attack came.
- I then re-enabled the IAX phone service by reloading the chan_iax.so module.
After the initial security containment, I turned my focus to handling the inbound phone calls being returned based upon the messages left with the various victims around the country. I recorded an announcement indicating what had happened and that the compromise was taken care of. Finally, I crafted the dialplan to play this announcement to every caller not from a local phone number.
Overall, this breach was not as extensive as it could have been, but it does illustrate that security must be vigilantly monitored and maintained. My complacency in the security of my network ultimately led to this incident. Fortunately, it does not seem to have led to any major financial loss to any party, including myself.
