country code security issue

[Clément Rousseau]

Hello,

do you know how the forbidden country code really works ?
we recently had a security issue, seems like someone has got a leaked password, probably from access to email box of a user.
It was a commun extension, no voicemail, no admin access to 3CX, only access to webclient.
Despite outbound rules exatcly as 3cx recommmand and restrictions in countries prefix code outside of Europa, seems like he was able to call Nicaragua !(code 505).
Do you know how this can happens ? any ideas ?

We are still looking at what happens. We created a ticket but 3cx support just answer they refuse to look at it! they answer 3cx don't manage security issue!
thx, regards,

 

[Pierre_3CX]

Hi,
In regards to numbers dialed towards countries that are blocked, looking at the calls logs you provided in ticket I can see that they were not dialed with an international prefix (e.g "5058601xxxx" is seen in your call logs along with many others starting with same prefix).

The anti-hacking / Allowed country codes feature filters out numbers dialed in a valid format as per ITU standards, meaning those starting with a "+" or with the international prefix "00" (which is defined under Settings / E164 Processing). Anything else is interpreted as a local number and sent to the outbound rules without a country check.

If a match is found then it makes it out to the VoIP provider, who is in turn supposed to also do some validation/filtering on their end. Here it seems they interpreted those numbers as their international counterparts and connected them successfully. I would recommend checking if the provider control panel allows to disable some destinations and restrict countries identically to 3cx configuration and also see if you can disable such reformating of numbers.

 

[Clément Rousseau]

hi, its just because the licence I was taking too don't show up when posting this thread. I will pm it for you.

 

[Clément Rousseau]

no other idea ?

 

[Clément Rousseau]

ok we finally found what is wrong in 3cx allowed countries method : 3cx only block not allowed countries if caller made a +XXXxxx or 00XXXxxx, not if someone just try to call number XXXxxx.
Yes you read it well, 3cx allowed countries security option doesn't work for everything! Its a big security issue if you are not aware!

we then have to add, in outbound rule, prefix for outside + explicitly for local.
exemple for France : instead of allowing prefix 0-9 for every extension, now we have to allow prefix : "+,00,01,02,03,04,05,06,07,08,09" then it works as intended and countries that are not allowed in security option can't be called.

 

[Pierre_3CX]

Hello,
Well that's what I mentioned earlier but it seems you didn't understand it back then...

This is caused by a misconfiguration of the outbound rules that were too loose and of the voip provider that allowed such dialing or reformatted the numbers on their end to ease customers.
The country blocking feature in 3cx cannot block numbers that aren't in correct international format because it would conflict with some national dial plans, for example lets say you block France, so +33xxx is blocked and 0033xxx as well, but not 33xxx because its a valid prefix for a local area in many countries for example US which has 7 area codes starting with 33.

The outbound rule that you mention works in your case but that's only for countries where there is a leading zero in the national dial plan, it isn't a universal solution and so needs to be adjusted accordingly.
It would be even better to have separate rules for national and international numbers so you have different criteria of length and groups/extension lists for one and another.

 

[Clément Rousseau]

yes your first explaniation wasn't clear for me. still 3CX doesn't say it explicitly in admin formation then I am sure lot of 3cx admins are not aware of this.
+ 3cx could have fix this by putting an option to choose location or national dial plan and deny others except if proper format. or restrict it on eachy trunk setting. lot of way of fixing this issue, but sadly 3cx choose none of them.

ofc the exemple of solution I have post is only for France, I knew and wrote it explicitly.

 

[bitn2]

If you had used correct outbound rules, it works fine. Thats not a 3CX problem.

 

[Clément Rousseau]

If you had used correct outbound rules, it works fine. Thats not a 3CX problem.

nope, the previous rule was 100% correct, the problem is the way 3cx let us think 3cx handle allowed countries in security option without blocking them entirely!

on the page of theses settings, its written :
"Select the region or country to which calls are allowed"
if doesn't say anything about blocking only the corresponding format (+XX or 00XX)!

furthemore, it isn't explained in 3cx advanced training or guides

Its surely something not clear on 3CX side.

 

[bitn2]

Sure its not correct. If you dont use ure numbers in the correct international format its not the problem of 3cx. If you use it correct (outbound rules) than its working just fine.

 

[leejor]

If your provider allows international calls without an international prefix, of some sort, then the responsibility is on you to check (test) that forbidden calls, do not pass through your outbound rules. The rules are read from top to bottom, so the order can make a big difference in what calls route where, or are able to be passed to a provider.

Testing to see that that calls go where you expect them to, (and certain types of calls do not go though, if that is a concern), is simply a part of any new PBX install.

 

[Clément Rousseau]

@bitn2
I explain that 3cx does not explain or mention how the proposed countries blocking option works and you repeat once again that this is how it works and not otherwise...really good intervention!!

@leejor
yes indeed that is my responsability no doubt on this. Thanks for your comment pointing the fact that this is linked to trunk provider way of doing too.
I am just pointing the lack of explanation about 3cx way of blocking countries wich can easely lead to huge security mistakes wich will deserve 3CX goal to become a reference used by more and more company.
Not mentionning the way the security options of the system works and, more important, what it doesn't do, is part of the security.
A simple way of doing more clear, as I proposed before, is an option inside 3cx or even better inside each trunk concerning the format of the number.
Another simpler way is at least to write that it only block number respecting this format in the page where you can autorize countries.

 

[bitn2]

You have to use the correct number format. Thats all. Please check how to format telephone numbers correctly. Thats not 3cx to do, its yours. https://en.wikipedia.org/wiki/National_conventions_for_writing_telephone_numbers