<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I have seen this before yes. Very low risk on Polycoms to my knowledge what they are attempting to do is see if this is an open or exploitable SIP proxy to commit toll fraud. Disable SIP ALG on the router and reboot the Polycoms if possible they are most likely getting port scanned and someone is seeing a device answering on 5060. If the SIP ALG cannot be disabled consider replacing the router with something that supports this functionality. Here is something that’s super useful in checking to see if something is there and answering to SIP requests.</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><a href="http://blog.sipvicious.org/">http://blog.sipvicious.org/</a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal" style><span style="font-family:"Arial","sans-serif";color:#1f497d">David Thompson <br>
Network Services Support Technician <br>(O) 858.357.8794 <br>(F) 858-225-1882 <br>(E) <a href="mailto:dthompson@esi-estech.com" target="_blank"><span style="color:blue">dthompson@esi-estech.com</span></a><br>(W) <a href="http://www.esi-estech.com" target="_blank"><span style="color:blue">www.esi-estech.com</span></a></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> </span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> VoiceOps [mailto:<a href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a>] <b>On Behalf Of </b>PE<br>
<b>Sent:</b> Friday, September 27, 2013 10:46 AM<br><b>To:</b> <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br><b>Subject:</b> [VoiceOps] Phone hack</span></p><p class="MsoNormal"> </p><div><p class="MsoNormal">
Greetings!</p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">We have a customer whose users work from home over the local broadband carrier. They have 3 users who have complained of similar circumstances, where they are receiving multiple calls from caller ID such as "100(100)", "101(101)", and "1001(1001)". We show no record of these calls, either from CDR's, logs, or SIP captures, so it seems that there is an outside party sending SIP directly to the (Polycom) handsets.</p>
</div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Anyone seen this? Any idea if there is a particular security hole being attempted? Assuming the users cannot control their broadband router, any suggestions on how to better lock this down?</p>
</div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Thanks</p></div></div></div></body></html>