<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Also make sure the phones dont have the default 456 password. In some versions the sip credentials are not hashed out and in other versions even if it is hashed if you inspect the element you can see the pw.<br><div><span><br></span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> David Thompson <dthompson@esi-estech.com><br> <b><span style="font-weight: bold;">To:</span></b> PE <peeip989@gmail.com>; voiceops@voiceops.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, September 27, 2013 2:13 PM<br> <b><span style="font-weight:
bold;">Subject:</span></b> Re: [VoiceOps] Phone hack<br> </font> </div> <div class="y_msg_container"><br><div id="yiv4341284454"><style><!--
#yiv4341284454
_filtered #yiv4341284454 {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered #yiv4341284454 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
_filtered #yiv4341284454 {font-family:Tahoma;panose-1:2 11 6 4 3 5 4 4 2 4;}
#yiv4341284454
#yiv4341284454 p.yiv4341284454MsoNormal, #yiv4341284454 li.yiv4341284454MsoNormal, #yiv4341284454 div.yiv4341284454MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:12.0pt;font-family:"Times New Roman", "serif";}
#yiv4341284454 a:link, #yiv4341284454 span.yiv4341284454MsoHyperlink
{color:blue;text-decoration:underline;}
#yiv4341284454 a:visited, #yiv4341284454 span.yiv4341284454MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
#yiv4341284454 span.yiv4341284454EmailStyle17
{font-family:"Calibri", "sans-serif";color:#1F497D;}
#yiv4341284454 .yiv4341284454MsoChpDefault
{font-family:"Calibri", "sans-serif";}
_filtered #yiv4341284454 {margin:1.0in 1.0in 1.0in 1.0in;}
#yiv4341284454 div.yiv4341284454WordSection1
{}
--></style><div><div class="yiv4341284454WordSection1"><div class="yiv4341284454MsoNormal"><span style="font-size:11.0pt;color:#1f497d;">I have seen this before yes. Very low risk on Polycoms to my knowledge what they are attempting to do is see if this is an open or exploitable SIP proxy to commit toll fraud. Disable SIP ALG on the router and reboot the Polycoms if possible they are most likely getting port scanned and someone is seeing a device answering on 5060. If the SIP ALG cannot be disabled consider replacing the router with something that supports this functionality. Here is something that’s super useful in checking to see if something is there and answering to SIP requests.</span></div>
<div class="yiv4341284454MsoNormal"><span style="font-size:11.0pt;color:#1f497d;"> </span></div><div class="yiv4341284454MsoNormal"><a rel="nofollow" target="_blank" href="http://blog.sipvicious.org/">http://blog.sipvicious.org/</a><span style="font-size:11.0pt;color:#1f497d;"></span></div>
<div class="yiv4341284454MsoNormal"><span style="font-size:11.0pt;color:#1f497d;"> </span></div><div class="yiv4341284454MsoNormal" style=""><span style="color:#1f497d;">David Thompson <br>
Network Services Support Technician <br>(O) 858.357.8794 <br>(F) 858-225-1882 <br>(E) <a rel="nofollow" ymailto="mailto:dthompson@esi-estech.com" target="_blank" href="mailto:dthompson@esi-estech.com"><span style="color:blue;">dthompson@esi-estech.com</span></a><br>(W) <a rel="nofollow" target="_blank" href="http://www.esi-estech.com/"><span style="color:blue;">www.esi-estech.com</span></a></span></div>
<div class="yiv4341284454MsoNormal"><span style="font-size:11.0pt;color:#1f497d;"> </span></div><div class="yiv4341284454MsoNormal"><b><span style="font-size:10.0pt;">From:</span></b><span style="font-size:10.0pt;"> VoiceOps [mailto:<a rel="nofollow" ymailto="mailto:voiceops-bounces@voiceops.org" target="_blank" href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a>] <b>On Behalf Of </b>PE<br>
<b>Sent:</b> Friday, September 27, 2013 10:46 AM<br><b>To:</b> <a rel="nofollow" ymailto="mailto:voiceops@voiceops.org" target="_blank" href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br><b>Subject:</b> [VoiceOps] Phone hack</span></div><div class="yiv4341284454MsoNormal"> </div><div><div class="yiv4341284454MsoNormal">
Greetings!</div><div><div class="yiv4341284454MsoNormal"> </div></div><div><div class="yiv4341284454MsoNormal">We have a customer whose users work from home over the local broadband carrier. They have 3 users who have complained of similar circumstances, where they are receiving multiple calls from caller ID such as "100(100)", "101(101)", and "1001(1001)". We show no record of these calls, either from CDR's, logs, or SIP captures, so it seems that there is an outside party sending SIP directly to the (Polycom) handsets.</div>
</div><div><div class="yiv4341284454MsoNormal"> </div></div><div><div class="yiv4341284454MsoNormal">Anyone seen this? Any idea if there is a particular security hole being attempted? Assuming the users cannot control their broadband router, any suggestions on how to better lock this down?</div>
</div><div><div class="yiv4341284454MsoNormal"> </div></div><div><div class="yiv4341284454MsoNormal">Thanks</div></div></div></div></div></div><br>_______________________________________________<br>VoiceOps mailing list<br><a ymailto="mailto:VoiceOps@voiceops.org" href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br><a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br><br><br></div> </div> </div> </div></body></html>