Calls from sipvicious on one users iPhone

[ArtR]

Hi All,
We have one user that is getting sipvicious calls on their iPhone at random times. I can't see anything in our PBX logs (on maximum logging now) to say they have come via that, nor does the users 3CX client show these calls in their recent calls list.

I'm working with the user to isolate the issue to see if it persists when he's using the browser client only.

Is there anything else we can check to see where these calls are originating from?
My user is in another country so I need to talk them through the steps.

Also, we don't have any other issues with other users be it mobile/browser from within office or on the road.

I did see this from SIP Vicious author, and it seems like this is what is happening (rings but no one on other end) but on a mobile network, just wonder if a mobile network doesn't isolate its users.. https://blog.sipvicious.com/2012/12/if-sipvicious-gives-you-ring/

 

[eddv123]

I would say Wireshark, however with an App on smartphone that will use 3CX tunnel and thus mask alot of the traffic, perhaps run it from the PBX and then open Wireshark go to Telephony >> VoIP Calls and you will see "SIP Viscous" in the calls - if you filter this then you can see the IP it is coming from and can blacklist: https://www.3cx.com/docs/capture-network-traffic/

Also consider that hackers use multiple Public IP addresses so blacklisting one could result in more attempts from another IP.

 

[JohnS_3CX]

Hi ArtR

What version is your PBX?
What version is the mobile app?
Is the tunnel enabled yet?

 

[eddv123]

@JohnS_3CX please confirm - the only way I could think this would of occurred is if some had hijacked the extension on 3CX (cracked the username and password).

@ArtR Perhaps try the "regenerate" key in 3CX for this extension and reprovision the phone. This will possibly solve the smaller issue, the bigger picture is that your PBX could be breached.

 

[JohnS_3CX]

@eddv123 can't assume anything at all at this point, not even sure if it is the 3CX client that is ringing or something else on the phone that may have been polled by anyone running an INVITE scan on their network IP range..

 

[ArtR]

Hi All,
Sorry, busy for a few days there.

PBX is still on v.15.5.15502 as we're thinking of using some of the VoipTools addons which don't seem to support v16 at this stage. In saying that, we've gone almost a year without the addons so maybe best to just upgrade and workout addons later.

Will check what version the app is, but as it's working with v15 it's probably the last 15.5.18, i'll check tomorrow.

User was getting these calls today, so at that point I did actually do the regenerate, sent email with new details and ask them to update account. Again they got the calls soon after.

During this time I'm looking at the Activity log which is currently on Verbose but nothing too odd there except one entry, but not sure if that is it setting up the account again and registering:-

20/11/2019 14:17:08 - Updating device Dev(16***557):[sip:[email protected]:5483;rinstance=ed437ce*0e / 6502] by message: DevUpd Recv Req REGISTER from 127.0.0.1:5483 tid=e46**ef30 Call-ID=3cFo*mjw..: REGISTER sip:127.0.0.1:5060 SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5483;branch=z9*bK-5**287-1---e***eb77ef30;rport=5483 Max-Forwards: 70 Contact: <sip:[email protected]:5483;rinstance=e*7690e> To: "Mobile-6502"<sip:[email protected]:5060> From: "Mobile-02"<sip:[email protected]:5060>;tag=0361c352 Call-ID: 3cFo****mjw.. CSeq: 10 REGISTER Expires: 300 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE Proxy-Authorization: Digest username="*",realm="3CXPhoneSystem",nonce="4***418:8**a7b053a19b832d7fe7e86",uri="sip:127.0.0.1:5060",response="b6c01f***422cce6e26",algorithm=MD5 Supported: replaces User-Agent: 3CX Mobile Client Content-Length: 0

So last thing I asked user to do was to turn OFF his mobile data and leave his Wifi ON. He did that and I could call him via 3CX.
He left it this way for another hour and no SIP Viscous calls, even though he was getting multiple earlier.
We're going to check this tomorrow too, see if turning ON mobile data sees the calls come back.


Could it be that the mobile network provider doesn't have isolation for their mobile users...?!?!

Art

 

[JohnS_3CX]

I can't rule it out but if you can consistently show it happens only on mobile data and never on WiFi it would be evidence supporting that hypothesis. The mobile device could also be compromised in some way (potentially).

This is especially if the calls are not coming via the PBX (which would generate a log). The PBX rejects "sipvicious" as a user agent altogether, so it would not reach the mobile client nor the deskphones.

Confirm the versions and lets see, but make sure tunnel is on and the app reprovisioned after enabling it.

 

[ArtR]

Confirm the versions and lets see, but make sure tunnel is on and the app reprovisioned after enabling it.

iPhone app - Version 16.0.2.107

And do you mean tunnel as in settings for the user, under phone provisioning, as it is set to use the tunnel for the 3CX app.

I know the app can send some logs, but from my limited testing on my Android phone it didn't seem to show much for call logs, can it record more to capture more on the iPhone app?

thanks

Art

 

[JohnS_3CX]

Hi Art

No logs that would show those specific calls i'm afraid. And yes, enable the tunnel from the provisioning under 3CX app and reprovision the device.