Call fraud

[DjordjeV]

6 days ago my provider blocked international calls from my PSTN number. They registered call to South America that was 6900 seconds long.There were around 2 to 3 ,3 to 4 blackisted IP's per day, especially last 3 weeks.I am using analog gateway with 3cx as SIP Trunk and only have one PSTN number (NO SIP), port 5001(provisioning and remote acces) and 5090 where opened on firewall because of 3cx Apps ,now they are closed. I can't find that praticular call under call logs on the specified date that call occured, it is free version also i do not have call reports. Activity logs are set on verbose mode but can't trace them 10 days back from now , can i even get that call log that occured 10 days ago? I changed admin pass ,regenerated all extension passwords, closed ports (5060.5001,5090), allowed only Europe in allowed countries, disallow use of extensions outside LAN, access to managment console enabled only from private network (specific) . Any other suggestions? Anyway to track this call even if i can not find it in my log?

 

[Evolute IT]

3CX security is pretty solid. I would check with the provider that the calls really came from the 3CX IP and not from someone who hacked the trunk directly.

 

[cobaltit]

3CX security is pretty solid. I would check with the provider that the calls really came from the 3CX IP and not from someone who hacked the trunk directly.

Provided you stuck with the defaults as far as the extension id's and passwords

 

[leejor]

.I am using analog gateway with 3cx as SIP Trunk and only have one PSTN number (NO SIP), port 5001(provisioning and remote acces) and 5090 where opened on firewall because of 3cx Apps ,now they are closed. I can't find that praticular call under call logs on the specified date that call occured,

The fact that you are unable to find a log of the call in 3CX (check Activity Log), would suggest that the call did not originate from the PBX. Since you are using a PSTN gateway (local to the PBX?), it suggests that either the gateway was directly hacked (not something I have heard of before), or, someone tapped the phone line, at some point, and placed the calls.

Sorry...just re-read and saw that you were unable to retrieve the Activity Logs back 10 days.

Was this a one-time event?

 

[DjordjeV]

The fact that you are unable to find a log of the call in 3CX (check Activity Log), would suggest that the call did not originate from the PBX. Since you are using a PSTN gateway (local to the PBX?), it suggests that either the gateway was directly hacked (not something I have heard of before), or, someone tapped the phone line, at some point, and placed the calls.

Sorry...just re-read and saw that you were unable to retrieve the Activity Logs back 10 days.

Was this a one-time event?

Is it even possible to find activity log 10 days back , does activity log clear itself every day by default?

 

[Evolute IT]

Is it even possible to find activity log 10 days back , does activity log clear itself every day by default?

Check the Call Log, not Activity Log. You should be able to see even more than 10 days back if it was in the PBX at least.

 

[leejor]

Doing a search suggests that the logs may be retained for 90 days, but many posts are dealing with older versions of 3CX, and things change. This article does show a retention option.
https://www.3cx.com/docs/collecting-logs-for-3cx-support/

Unless you used an insecure password, for one of the extensions, which someone guessed , or it was an "inside job", I doubt that the call came through the PBX. 3CX is very good at blocking hack attempts. Do you have 3CX set to email you everytime an IP is blacklisted for blocked registration attempts?

 

[DjordjeV]

Check the Call Log, not Activity Log. You should be able to see even more than 10 days back if it was in the PBX at least.

I've already done that and can't find any call made from any ext. on that day , it was sunday a day off btw so no one could have called from office (desktop ip phones)

 

[Evolute IT]

Then it doesn't come from the PBX.

 

[DjordjeV]

Then it doesn't come from the PBX.

So you think no one hacked pbx? I mean logged in management console and placed call ,there is no way do delete call from log?

 

[Evolute IT]

So you think no one hacked pbx? I mean logged in management console and placed call ,there is no way do delete call from log?

Nope, the only way to delete an entry from the log, is to clear the log completely. As suggested above, I would verify the PSTN gateway and your firewall. If someone hacked, it wasn't via 3CX or you would see it somewhere.

 

[florink]

Also make sure you have "Log in to 3CX Management Console" + "Call to a blocked country" email notifications enabled.

 

[JohnS_3CX]

As stated above the two ways the call can be made is either from the PSTN Gateway itself (by directly connecting to it via its IP) or from the PBX that registers there.

If the logs did not show any calls at that moment, then the call most likely did not pass via the PBX.

You might want to see if there is any logging on the gateway, perhaps it may keep some rudimentary records that can at least show the IP which logged the call (although not very hopeful on this).

If that IP is found, and it belongs to another machine on the network, then that machine may have been compromised.

The final option is if someone literally plugged a phone into the PSTN line or worse, they hooked into the copper line from elsewhere (like the lines cabinet?). Perhaps you have a 2nd line sharing the same number?

I would advice to ensure you are on V16U4 and enable your global blacklist in the security settings in case not already enabled. Also make sure the extensions tab does not show any red exclamation marks next to any extension. You can regenerate credentials from the button above in that case.