[VoiceOps] Phone hack

[Anthony Orlando]

Also make sure the phones dont have the default 456 password.  In some versions the sip credentials are not hashed out and in other versions even if it is hashed if you inspect the element you can see the pw.




________________________________
 From: David Thompson <dthompson at esi-estech.com>
To: PE <peeip989 at gmail.com>; voiceops at voiceops.org 
Sent: Friday, September 27, 2013 2:13 PM
Subject: Re: [VoiceOps] Phone hack
 


I have seen this before yes. Very low risk on Polycoms to my knowledge what they are attempting to do is see if this is an open or exploitable SIP proxy to commit toll fraud. Disable SIP ALG on the router and reboot the Polycoms if possible they are most likely getting port scanned and someone is seeing a device answering on 5060. If the SIP ALG cannot be disabled consider replacing the router with something that supports this functionality. Here is something that’s super useful in checking to see if something is there and answering to SIP requests.
 
http://blog.sipvicious.org/
 
David Thompson 
Network Services Support Technician 
(O) 858.357.8794 
(F) 858-225-1882 
(E) dthompson at esi-estech.com
(W) www.esi-estech.com
 
From:VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of PE
Sent: Friday, September 27, 2013 10:46 AM
To: voiceops at voiceops.org
Subject: [VoiceOps] Phone hack
 
Greetings!
 
We have a customer whose users work from home over the local broadband carrier. They have 3 users who have complained of similar circumstances, where they are receiving multiple calls from caller ID such as "100(100)", "101(101)",  and "1001(1001)". We show no record of these calls, either from CDR's, logs, or SIP captures, so it seems that there is an outside party sending SIP directly to the (Polycom) handsets.
 
Anyone seen this? Any idea if there is a particular security hole being attempted? Assuming the users cannot control their broadband router, any suggestions on how to better lock this down?
 
Thanks
_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20130927/40cf6468/attachment.html>