strange calls in my CDR, is this an attempted hack?

[paulnye]

Last two days I saw 30 calls in the built in freepbx call log. It happened 3 times over 2 days. It looks more like a bug than a hack, but can anyone help me to determine why this happens?

 

[atsak]

It's an attempted hack.

Do you deny anonymous SIP calls? If so, nothing to worry about. I see these all the time.

Blacklist the IP they came from in IPTables if you like, or use the whitelisting in Incredible PBX or setup your own . . .

 

[paulnye]

It's an attempted hack.

Do you deny anonymous SIP calls? If so, nothing to worry about. I see these all the time.

Blacklist the IP they came from in IPTables if you like, or use the whitelisting in Incredible PBX or setup your own . . .

I 'allow' anonymous SIP calls as I read multiple places to allow them, but never really knew why.
So, perhaps I should 'deny' them. Is there a downside?

 

[atsak]

Lots of people have differing opinions on that. I personally allow them but make sure my system has good passwords on it.

If you deny it and you haven't registered inbound trunks properly your inbound calls will break.

I prefer to allow them in case someone wants to make sip to sip calls to my systems. But you'll find plenty of people who say not to.

Do a search in the forums for "anonymous" for some other opinions. I'm sure others will chime in as well on this thread.

 

[Stewart]

Normally I see a whole host of different ip addresses and assume its a group or botnet. It's a little surprising to me to see it come from just one location. I try to have fun and see where it comes from and what services they have open I can check out. Sometimes I get lucky and hit a router with default passwords or Apache.