PIAF makes hundreds of calls by itself

[didopido]

I just found out looking at my call report that my PIAF at home have had made hundreds of calls on the "domestic long distance" trunk to numbers starting with the same area code but with different last four digits. All the calls are initiated from one of my extentions using ATA and working like a house phone. I have the phone with me and still see the calls being made. Any ideas where to look and what can be the reason for this .

 

[jeremywillden]

Wow-never heard of that. As a first line of defense (in case this is an attack on your system), change all of your extensions to NAT=never in freepbx. If the calls are originating from outside your network, this will cut it off.
Secondly, in either case, save a copy of your full asterisk log for analysis (cp /var/log/asterisk/full ~/) and repeat with some of the rotated logs (full.1, full.2, and so on). Then use grep to see what IP address the calls originate from (grep -B10 -A10 9735551234 ~/full) replacing the number with one of the real calls, looking at the output will give you some clues.

 

[didopido]

Thank you for your prompt answer. I've looked at the asterisk log files and before the first call starting the whole line of calls I see this:

[Aug 28 21:05:38] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:05:38] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:11:10] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:11:10] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:14:56] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:14:56] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:16:45] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:16:45] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:18:38] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:18:38] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:20:26] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:20:26] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:20:26] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:22:12] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:22:12] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:24:01] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:24:01] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:24:01] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:25:49] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:25:49] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:29:35] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:29:35] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:31:28] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:31:28] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:31:28] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:31:28] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:36:58] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:42:26] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:44:14] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:46:03] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:47:52] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:47:52] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:49:43] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:49:43] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:53:23] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:55:10] DEBUG[2293] sched.c: Request to schedule in the past?!?!
[Aug 28 21:55:10] WARNING[2293] chan_sip.c: Got 200 OK on REGISTER that isn't a register
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Executing [15745984266@from-internal:1] Macro("SIP/xxx-0950ea68", "dialout-trunk|3|15745984266||") in new stack
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Executing [s@macro-dialout-trunk:1] Set("SIP/xxx-0950ea68", "DIAL_TRUNK=3") in new stack
[Aug 28 21:58:09] DEBUG[20815] app_macro.c: Executed application: Set
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Executing [s@macro-dialout-trunk:2] Set("SIP/xxx-0950ea68", "DIAL_NUMBER=15745984266") in new stack
[Aug 28 21:58:09] DEBUG[20815] app_macro.c: Executed application: Set
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Executing [s@macro-dialout-trunk:3] Set("SIP/xxx-0950ea68", "ROUTE_PASSWD=") in new stack
[Aug 28 21:58:09] DEBUG[20815] app_macro.c: Executed application: Set
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Executing [s@macro-dialout-trunk:4] GotoIf("SIP/xxx-0950ea68", "1?noauth") in new stack
[Aug 28 21:58:09] VERBOSE[20815] logger.c: -- Goto (macro-dialout-trunk,s,6)

etc.


Is this normal? I will follow your recommendations and hopefully this will fix the problem, but I'm curious what exactly happened.

 

[tshif]

So - What turned out to be the issue here? Its very interesting -

 

[wardmundy]

Please PM all the information you have to anonymous on this forum. Don't destroy anything! This may be what we've been looking for. Thanks.

 

[GregKeys]

Ward,
Your reply hints that you have seen or heard of something like this before..... something we should know??

Greg Keys

 

[mmodahl]

Ward,
Your reply hints that you have seen or heard of something like this before..... something we should know??

I'm guessing this could be a result of the FreePBX security problem Ward has been discussing for the last week.

http://pbxinaflash.com/community/threads/urgent-security-alert-all-systems.2215/?t=2215