Calls to non-allowed country codes

[proping]

Similar to thread here: https://www.3cx.com/community/threads/country-code-not-blocking.76388/

I have cloud hosted instances and few of them (or phones) were compromised. Calls were made to countries that are not allowed.

IP blacklist is set to only allow IP connections from customers site, management site and SIP trunk endpoint so it isn't possible that "agent" came outside of these IPs, autenticate to extension (if credentials were stolen) and place a call.

Extension have strong passwords. Trunk is authorized by IP.

How is it possible that extension places a call through 3CX if settings are not allowing such call?

 

[ChrisC_3CX]

That is weird indeed, how have you determined that these calls did indeed through 3CX? If they did you will also see them in the call log, do you?

 

[proping]

Yes, of course - calls were logged both on SIP provider side and 3CX call log.

 

[ChrisC_3CX]

What extensions do you see making the calls. Is it the same extension for every instance of this? Are they extensions that already exists and are provisioned somewhere? If yes, where are they provisioned, on Local/STUN or SBC IP Phones, 3CX Apps, etc?

Is the PBX in verbose logging? You can check in "Dashboard >> Activity Log >> Settings". If yes, and the calls were recent enough ,it might be worth looking at the logs (Activity Log) for more info such as what IP the call came in from, etc.

Since you can see the number that was dialed, have you tried dialing it to see if the PBX does in fact allow such calls?

 

[proping]

What extensions do you see making the calls. Is it the same extension for every instance of this?

Not the same extension, random: 101, 103, 108, 136, 922

Are they extensions that already exists and are provisioned somewhere? If yes, where are they provisioned, on Local/STUN or SBC IP Phones, 3CX Apps, etc?

Existing extension provisioned on STUN. Grandstream phones behind those extensions.

Is the PBX in verbose logging? You can check in "Dashboard >> Activity Log >> Settings". If yes, and the calls were recent enough ,it might be worth looking at the logs (Activity Log) for more info such as what IP the call came in from, etc.

No it isn't verbose, it's default: Low. Set to Medium now.

Since you can see the number that was dialed, have you tried dialing it to see if the PBX does in fact allow such calls?

No I didn't. I would have to ask customer to do that, but this isn't an option at the moment.

 

[ChrisC_3CX]

Existing extension provisioned on STUN. Grandstream phones behind those extensions.

What exact Grandstream devices are you using? Can you make sure they are running the latest supported firmware: https://www.3cx.com/support/phone-firmwares/

Also, what 3CX version are you running, is it v18 U2?

 

[leejor]

If you have Activity Logs of the originating calls, then the log should show the originating IP. Is it a local IP? It should also show, if a "new" set, using the originating extension, recently registered on the PBX.

I'm assuming hat the sets are using strong, randon, passwords, and not something that could be guessed.

Were the calls made to numbers in the same country, or seemingly random?

I would ask the customer to verify that calls, to the same country code, are not blocked by 3CX.

 

[proping]

What exact Grandstream devices are you using? Can you make sure they are running the latest supported firmware: https://www.3cx.com/support/phone-firmwares/

Also, what 3CX version are you running, is it v18 U2?

Grandstream GXP1610

Phones on one instance were running "Not supported 1.0.7.3", the other one had "supported" firmware 1.0.7.13
Calls were made both on 3CX v16 version and v18U2 (upgrade was made in the meantime).

 

[ChrisC_3CX]

In that case, first thing I'd recommend is upgrading all firmware to the latest versions if not done so already. Then, go into "Dashboard >> Activity Log >> Settings and enable Verbose Logging with backup logs for at least one day or more if you have available disk space. Monitor calls for a bit to see if it happens again and if it does, note down the exact time, extension number making the call and the called number and generate the Support Info from "Updates(upper-right corner) >> Generate Support Info" so that you capture the logs that contain the call.