I've been hacked. Now what?

[rolfbeethoven]

I have a dedicated PIAF server at home with an spa3102 for the PSTN tie-in and two VOIP trunks. It's my fault, but I didn't realize that keeping the extension and the secret the same number isn't a good idea.

Last week we starting getting calls from Michigan with people telling us that they missed our call but saw our number on their caller id. I checked the caller logs and noticed that someone had made over 2,000 phone calls from noon to five in the evening. Ouch. I called a few of the numbers with longer connection times and learning that these people had received a telemarketing phone call at this time.

I searched the forum and found several threads regarding the extension/secret issue. I have since changed all the extension passwords/secrets and I checked that fail2ban was installed. I checked the logs and found that on the day before an IP from poland had made multiple attempts to authenticate as extensions 100-300.

The good news is that the total monetary cost for me was a little over a dollar since I have an alldistance service on the PSTN line, over which most of the calls were made. Most of the calls were unanswered, but I could have really run up a bill had the person been calling some expension foreign location. I also reported the incident to the police to document what happened.

I'm left with a few questions...
1) How can I verify that fail2ban is working? I followed an install guide, but I didn't see how to check it. I'm not sure how to attempt a breaking to my own system from a friends system to see if they get locked out. My PIAF server shows that fail2ban is online and I'm using version 0.6.1.
2) What do I need to check to ensure that my system isn't still compromised? Is the hacker limited to making phone calls by spoofing one of my extensions or could their be bigger problems on my system?
3) Is it safe to force a PIN for any non-local calls? Can that be spoofed as well?


I using PIAF 1.3 running Asterisk 1.4.21.2

Thanks.

 

[wardmundy]

Read the thread below and follow the instructions as outlined:
http://pbxinaflash.com/community/threads/upgrade-fail2ban-now-see-page-3-of-this-thread.2379/
http://pbxinaflash.com/community/threads/upgrade-fail2ban-now-see-page-3-of-this-thread.2379/

While you're at it, review the other stickies in the Bug Reporting & Fixes thread. Any known security issues are posted in stickies.

 

[rolfbeethoven]

Thanks Ward. I did follow that thread. Apparently not closely enough. I'll reread.

 

[wardmundy]

Sorry you got hacked. Could have been MUCH worse! :2gunsb:

 

[rolfbeethoven]

Thanks. I reread the thread and figured out what I needed to do. The only lurking question is whether the hacker would have been able to do more to my system than make free phone calls? If this was listed in the postings, I missed it.

For anyone else watching with the same issue, look for Ward's posting of steps to update fail2ban (or follow this link: http://pbxinaflash.com/community/th...-page-3-of-this-thread.2379/page-2#post-14281)

I also changed the email in the file:
to match the email I want to receive notices on. This was suggested by telOp in the posting: http://pbxinaflash.com/community/th...-page-3-of-this-thread.2379/page-2#post-14284

I have been successfully banned on two different machines.

 

[rolfbeethoven]

Summary: read this if you've been hacked by someone who made calls on your system.

Someone was able to hack into my system because I had the extension passwords equal to the extension numbers themselves. (bad idea despite all the guides that use this convention) First, change all your passwords/secrets to something different that the extensions. Use at least seven characters and don't make them easy to guess.

Ward was kind enough to respond to my request for help and pointed me to a very long thread. During the middle of it, Ward posts directions on how to fix the problem. Basically your system will monitor system logins. If you chose decent passwords a hacker will not be able to guess it in a few tries. As soon as your system detects five incorrect login attempts (ssh, asterisk extensions...) it will ban the IP address making the log in requests for 30 minutes and send you an email letting you know about it.

Rather than having you read the thread from the top (it is long), I've posted a link directly to Ward's instructions. I also followed the suggestion in the next post to get the emails sent to a different email than root@localhost.

Here's Ward's instructions:
http://pbxinaflash.com/community/th...-page-3-of-this-thread.2379/page-2#post-14281)


I also changed the email references in the file [/etc/fail2ban/jail.conf] to match the email through which I want to receive notices. This was suggested by telOp in the posting: http://pbxinaflash.com/community/th...-page-3-of-this-thread.2379/page-2#post-14284

I have been successfully banned on two different machines.


Good luck!

 

[tshif]

I would like to be able to change the content of the emails sent by the system to include some way for me to tell which PBX is sending the notices. I have tried making changes to the files I can find, bu the email content never changes. Has anyone else done this?

 

[merlyn]

hey I assumed you could change the jail.conf file (sender info ) to whatever you wanted to change the email from ... but i tried it and guess what it doesn't change it ...

But i noticed that my banned and etc emails don't come from the default pbx.dyndns.org even though that is what i changed them back to. in this case {fail2ban} etc etc ...

It is coming into my email with a from email that is a gmail account that i created. i changed it when i was setting up my outgoing emails thru gmail. I have no idea what specific section of what file i changed that caused me to get a different "from" email name but ....
if you take a look at this article it must have been something i changed while i was trying to get my email to be sent out. (it was too long ago for me to remember)
http://nerdvittles.com/index.php?p=216

so at least this way you could create a different account for each pbx so you would know the difference since it would have a different from email address

Merlyn

 

[jroper]

Hi

We seen a few hacks appear of late on this forum in respect to stealing phone calls.

When you have a PBX even on a fairly lowly peice of hardware, it can make 1000's of calls an hour, depending on how much broadband or channels you have, and there are lots of interesting ways to make money out of phone calls.

I know of a company, a few years ago now, that lost £69,000 between a Thursday afternnoon, and a Friday morning.

Please therefore make sure that:

1. Don't open up the system to the outside world unless you absolutely have to, keep everything behind your external firewall, and if you have to administer remotely, use Hamachi, non standard SSH ports, or a VPN firewall like a Draytek.

2. Use fail2ban, and watch the security advisories posted here.

3. Try and use a pre-paid provider, so you have a firebreak if some one does get in. You only lose your credit, not your house.


Joe