Toggle sidebar Toggle sidebar

FAX outgoing rule 3CX PBX v.10

Status
Not open for further replies.

Sergiy

Joined
Dec 12, 2011
Messages
15
Reaction score
0
Hi all!
Today I became a victim of external bot attack.
History: I moved two weeks before my 3CX Server to virtual machine with two network interfaces (LAN, WAN). When I loaded settings to the new server I noticed that passwords weren't recovered, so I had generated new passwords and it seemed all OK, but I forgot about FAX extension (8888) which password was blank.
At this morning my phone provider called to me and said that very intensive international traffic was detected from my account. Fax service had passed over outgoing rules (which allows only specified numbers international outgoing access with prefix "00") and did calls directly. Does the FAX obey on outgoing rules?
 
Without outbound rules there would be no way that calls would know where to route, so yes, FAX calls will use outbound rules. Place a call from the FAX line, then have a look at the 3CX logs.

Besides a password change, you could require a prefix several digits in length (that is then stripped in the rules), for international calls. This rule could be made to apply to all extensions, or just the FAX number.
 
I have just one outgoing rule for international calls and it doesn't contain the FAX number in the allowed numbers list.
So, FAX number passes outgoing rules for routing only, but stepping over permission part?
 
In your case, the 8888, is this the 3CX fax server that is built-in to the system, or an extension that you created and have setup with an analog fax?

The reason I ask, is that the built-in fax server is a receive only intended function. I do not know of a way to initiate a call from within 3CX through the server extension. However, I also do not know that it is not possible to connect a phone using that extension number and authentication and thereby be able to connect and make calls. I have never tried it.

Also, keep in mind that if 8888 is indeed the built-in fax server, then this is not a normal extension but a system extension and therefore not subject to the rules as again, it was designed for inbound only.
 
Sorry, the way I have FAX set-up is by using an actual extension (I think it's 889) rather than using the internal FAX server for both incoming an outgoing calls. So, in my case, the fax extension (or any outbound call) will use the appropriate outbound rule.
 
Can we look at INVITEs used to call outside using Fax number? So we can better understand the way it was hacked and improve.
 
Sorry for late answer.
There is in Windows logs one of such messages:
Call to 6230037190991221@(Ln.10005@LDK100) has failed. [ V4 192.168.1.130:5060 UDP target domain=unspecified mFlowKey=820 ] replied: 486 Busy Here; from IP:192.168.1.130:5060

LDK100 - LG NORTEL ipLDK100 connected with 3CX as VOIP-provider (it has added hardware SIP extension module).

Where I can see an old invite?
 
You should look in your logs/backup files for the INVITE that has Fax extension number in Contact header and addressed to outside number. If you know the numbers dialled by hackers you can just look up for that number(s).
 
All numbers that start with 00371 (Latvia) - made by FAX
IP-addresses from were made calls over FAX are Palestine, Portugal, Germany from. So I think it were infected desktops and I participate as gateway to flood some organization(s).

3CXDialer (cut):
Code: 
14.01.30 00:55:40.223|200002| Trc|75|0006|: Del: Call(641) [Connected] DN=10005 IP=(null) EP=62300448009879077
14.01.30 00:55:43.018|200002| Trc|75|0006|: Ins: Call(642) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.045|200002| Trc|75|0006|: Ins: Call(643) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.068|200002| Trc|75|0006|: Ins: Call(644) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.129|200002| Trc|75|0006|: Ins: Call(645) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.222|200002| Trc|75|0006|: Ins: Call(646) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.313|200002| Trc|75|0006|: Del: Call(646) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.405|200002| Trc|75|0006|: Ins: Call(647) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:43.526|200002| Trc|75|0006|: Del: Call(647) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:55:53.375|200002| Trc|75|0006|: Ins: Call(642) [Ringing] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.393|200002| Trc|75|0006|: Upd: Call(642) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:55:53.410|200002| Trc|75|0006|: Upd: Call(642) [Connected] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.429|200002| Trc|75|0006|: Ins: Call(643) [Ringing] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.445|200002| Trc|75|0006|: Upd: Call(643) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:55:53.461|200002| Trc|75|0006|: Upd: Call(643) [Connected] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.481|200002| Trc|75|0006|: Ins: Call(644) [Ringing] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.492|200002| Trc|75|0006|: Upd: Call(644) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:55:53.509|200002| Trc|75|0006|: Upd: Call(644) [Connected] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.529|200002| Trc|75|0006|: Ins: Call(645) [Ringing] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:55:53.546|200002| Trc|75|0006|: Upd: Call(645) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:55:53.564|200002| Trc|75|0006|: Upd: Call(645) [Connected] DN=10005 IP=8888 EP=62300448009879077
14.01.30 00:56:05.948|200002| Trc|75|0006|: Del: Call(643) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:56:05.954|200002| Trc|75|0006|: Del: Call(643) [Connected] DN=10005 IP=(null) EP=62300448009879077
14.01.30 00:56:07.644|200002| Trc|75|0006|: Del: Call(644) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:56:07.650|200002| Trc|75|0006|: Del: Call(644) [Connected] DN=10005 IP=(null) EP=62300448009879077
14.01.30 00:56:09.008|200002| Trc|75|0006|: Del: Call(645) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:56:09.016|200002| Trc|75|0006|: Del: Call(645) [Connected] DN=10005 IP=(null) EP=62300448009879077
14.01.30 00:56:10.259|200002| Trc|75|0006|: Del: Call(642) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:56:10.264|200002| Trc|75|0006|: Del: Call(642) [Connected] DN=10005 IP=(null) EP=62300448009879077
14.01.30 00:56:18.552|200002| Trc|75|0006|: Ins: Call(648) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:56:28.973|200002| Trc|75|0006|: Ins: Call(648) [Ringing] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:56:28.984|200002| Trc|75|0006|: Upd: Call(648) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:56:29.013|200002| Trc|75|0006|: Upd: Call(648) [Connected] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:57:03.780|200002| Trc|75|0006|: Del: Call(648) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:57:03.786|200002| Trc|75|0006|: Del: Call(648) [Connected] DN=10005 IP=(null) EP=6230037190991221
14.01.30 00:57:05.544|200002| Trc|75|0006|: Ins: Call(649) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:57:15.927|200002| Trc|75|0006|: Ins: Call(649) [Ringing] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:57:15.938|200002| Trc|75|0006|: Upd: Call(649) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:57:15.944|200002| Trc|75|0006|: Upd: Call(649) [Connected] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:57:34.922|200002| Trc|75|0006|: Ins: Call(650) [Dialing] DN=8888 IP=(null) EP=8888
14.01.30 00:57:45.322|200002| Trc|75|0006|: Ins: Call(650) [Ringing] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:57:45.344|200002| Trc|75|0006|: Upd: Call(650) [Connected] DN=8888 IP=10005 EP=8888
14.01.30 00:57:45.353|200002| Trc|75|0006|: Upd: Call(650) [Connected] DN=10005 IP=8888 EP=6230037190991221
14.01.30 00:58:08.372|200002| Trc|75|0006|: Ins: Call(650) [Ringing] DN=10005 IP=8888 EP=6230037190991221

3CXQueueManager (cut):
Code: 
4.01.30 00:55:13.236|100034| Trc|75|0007|: Call update(Insert): cid=641, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:23.647|100034| Trc|75|0007|: Call update(Insert): cid=641, dn=10005, internal=8888, external=62300448009879077, ac_stat=Ringing
14.01.30 00:55:23.649|100034| Trc|75|0007|: Call update(Update): cid=641, dn=8888, internal=10005, external=8888, ac_stat=Connected
14.01.30 00:55:23.653|100034| Trc|75|0007|: Call update(Update): cid=641, dn=10005, internal=8888, external=62300448009879077, ac_stat=Connected
14.01.30 00:55:32.703|100039| Trc|75|0007|: Agent's 1006 phone is registered
14.01.30 00:55:40.224|100034| Trc|75|0007|: Call update(Delete): cid=641, dn=8888, internal=(none), external=8888, ac_stat=Connected
14.01.30 00:55:40.228|100034| Trc|75|0007|: Call update(Delete): cid=641, dn=10005, internal=(none), external=62300448009879077, ac_stat=Connected
14.01.30 00:55:43.022|100005| Inf|30|0007|: Call(642) has been started
14.01.30 00:55:43.022|100034| Trc|75|0007|: Call update(Insert): cid=642, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.045|100005| Inf|30|0007|: Call(643) has been started
14.01.30 00:55:43.045|100034| Trc|75|0007|: Call update(Insert): cid=643, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.068|100005| Inf|30|0007|: Call(644) has been started
14.01.30 00:55:43.068|100034| Trc|75|0007|: Call update(Insert): cid=644, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.129|100005| Inf|30|0007|: Call(645) has been started
14.01.30 00:55:43.129|100034| Trc|75|0007|: Call update(Insert): cid=645, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.225|100005| Inf|30|0007|: Call(646) has been started
14.01.30 00:55:43.225|100034| Trc|75|0007|: Call update(Insert): cid=646, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.313|100034| Trc|75|0007|: Call update(Delete): cid=646, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.408|100005| Inf|30|0007|: Call(647) has been started
14.01.30 00:55:43.408|100034| Trc|75|0007|: Call update(Insert): cid=647, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:43.526|100034| Trc|75|0007|: Call update(Delete): cid=647, dn=8888, internal=(none), external=8888, ac_stat=Dialing
14.01.30 00:55:53.388|100034| Trc|75|0007|: Call update(Insert): cid=642, dn=10005, internal=8888, external=62300448009879077, ac_stat=Ringing
14.01.30 00:55:53.394|100034| Trc|75|0007|: Call update(Update): cid=642, dn=8888, internal=10005, external=8888, ac_stat=Connected
14.01.30 00:55:53.410|100034| Trc|75|0007|: Call update(Update): cid=642, dn=10005, internal=8888, external=62300448009879077, ac_stat=Connected
14.01.30 00:55:53.444|100034| Trc|75|0007|: Call update(Insert): cid=643, dn=10005, internal=8888, external=62300448009879077, ac_stat=Ringing
14.01.30 00:55:53.453|100034| Trc|75|0007|: Call update(Update): cid=643, dn=8888, internal=10005, external=8888, ac_stat=Connected
14.01.30 00:55:53.463|100034| Trc|75|0007|: Call update(Update): cid=643, dn=10005, internal=8888, external=62300448009879077, ac_stat=Connected
14.01.30 00:55:53.490|100034| Trc|75|0007|: Call update(Insert): cid=644, dn=10005, internal=8888, external=62300448009879077, ac_stat=Ringing
14.01.30 00:55:53.498|100034| Trc|75|0007|: Call update(Update): cid=644, dn=8888, internal=10005, external=8888, ac_stat=Connected
14.01.30 00:55:53.510|100034| Trc|75|0007|: Call update(Update): cid=644, dn=10005, internal=8888, external=62300448009879077, ac_stat=Connected
14.01.30 00:55:53.545|100034| Trc|75|0007|: Call update(Insert): cid=645, dn=10005, internal=8888, external=62300448009879077, ac_stat=Ringing
14.01.30 00:55:53.551|100034| Trc|75|0007|: Call update(Update): cid=645, dn=8888, internal=10005, external=8888, ac_stat=Connected
14.01.30 00:55:53.564|100034| Trc|75|0007|: Call update(Update): cid=645, dn=10005, internal=8888, external=62300448009879077, ac_stat=Connected
14.01.30 00:56:05.956|100034| Trc|75|0007|: Call update(Delete): cid=643, dn=8888, internal=(none), external=8888, ac_stat=Connected
14.01.30 00:56:05.960|100034| Trc|75|0007|: Call update(Delete): cid=643, dn=10005, internal=(none), external=62300448009879077, ac_stat=Connected
14.01.30 00:56:07.653|100034| Trc|75|0007|: Call update(Delete): cid=644, dn=8888, internal=(none), external=8888, ac_stat=Connected
14.01.30 00:56:07.656|100034| Trc|75|0007|: Call update(Delete): cid=644, dn=10005, internal=(none), external=62300448009879077, ac_stat=Connected
 
In addition:
14:13:02.925 [CM503008]: Call(88): Call is terminated
14:12:58.587 Currently active calls - 1: [88]
14:12:57.812 Session 3919 of leg C:88.1 is confirmed
14:12:57.610 [CM503007]: Call(88): Device joined: sip:[email protected]:5062
14:12:57.607 [CM503007]: Call(88): Device joined: sip:[email protected]:50836;rinstance=46c51e1666255b17
14:12:57.606 [MS210007] C:88.1:Answer provided. Connection(by pass mode): 192.168.1.81:11780(11781)
14:12:57.604 [MS210001] C:88.2:Answer received. RTP connection[unsecure]: 192.168.1.81:11780(11781)
14:12:57.603 Remote SDP is set for legC:88.2
14:12:55.544 [CM505001]: Ext.1004: Device info: Device Identified: [Man: Yealink;Mod: T20;Rev: General] Capabilities:[reinvite, no-replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T20P 9.60.14.24] PBX contact: [sip:[email protected]:5060]
14:12:55.544 [CM503002]: Call(88): Alerting sip:[email protected]:5062
14:12:55.306 [CM503025]: Call(88): Calling Ext:Ext.1004@[Dev:sip:[email protected]:5062]
14:12:55.301 [MS210006] C:88.2:Offer provided. Connection(by pass mode): 192.168.1.195:40006(40007)
14:12:55.256 [CM503004]: Call(88): Route 1: Ext:Ext.1004@[Dev:sip:[email protected]:5062]
14:12:55.255 [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:12:55.255 [MS210000] C:88.1:Offer received. RTP connection: 192.168.1.195:40006(40007)
14:12:55.254 Remote SDP is set for legC:88.1
14:12:55.249 [CM503001]: Call(88): Incoming call from Fax.8888 to <sip:[email protected]:5060>
14:12:55.245 [CM500002]: Info on incoming INVITE:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.195:50836;branch=z9hG4bK-d8754z-15445b57b3293126-1---d8754z-;rport=50836
Max-Forwards: 70
Contact: <sip:[email protected]:50836;rinstance=46c51e1666255b17>
To: <sip:[email protected]:5060>
From: "8888"<sip:[email protected]:5060>;tag=556ae363
Call-ID: ZWE0ZTc2N2ZlOTFlMzI4MWMwODJhNDI0YTc2YTQ2NGE.
CSeq: 2 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Proxy-Authorization: Digest username="8888",realm="3CXPhoneSystem",nonce="414d535c09016a4760:00541ced7e8f13e3a98b63693cbcdfe0",uri="sip:[email protected]:5060",response="8cb18f1f49edfbcdd20c305c5f32922a",algorithm=MD5
Supported: replaces
User-Agent: 3CXPhone 6.0.26523.0
Content-Length: 0

Now FAX service is down, but when I connect to 3CX with 8888 credentials, the system number 8888 becomes green :) I think the FAX number doesn't depend on FAX service...
 
I do not understand one thing:
You've said you have the only outbound rule which starts with prefix '00'. They dialled '6230037190991221' and this number has been dialled outside. How could it be? Why all numbers they dial starts with '62300'? Does it have some meaning in your setup?
 
623 - access code for LDK that adds in outgoing rule automatically. Without it LDK doesn't pass any outgoing call.
 
Ok, now's clear. So we see translated number.

Still, I would like to see original INVITE. Please, try to find backup of PBX log for 30-jan. You can zip (or rar) them all and send to me: arthur at 3cx dot com , for me to analyze.
 
If you have 3CX v10 you can connect with 8888 credentials and make any call passing any rule just with destination criteria.

Here log of my call with 3CX softphone just 5 minutes ago:
15:52:01.812 [CM503008]: Call(160): Call is terminated
15:52:01.492 [CM102001]: Authentication failed for SipReq: REGISTER sip.sova.lan tid=ac1026263781 cseq=REGISTER [email protected] / 424 from(wire); Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings
15:51:55.292 Session 9416 of leg C:160.1 is confirmed
15:51:55.104 [CM503007]: Call(160): Device joined: sip:[email protected]:5060
15:51:55.097 [CM503007]: Call(160): Device joined: sip:[email protected]:49446;rinstance=5476c729f1372993
15:51:55.097 [MS210007] C:160.1:Answer provided. Connection(by pass mode): 192.168.1.130:2048(2049)
15:51:55.095 [MS210001] C:160.2:Answer received. RTP connection[unsecure]: 192.168.1.130:2048(2049)
15:51:55.093 Remote SDP is set for legC:160.2
15:51:55.093 [CM505003]: Provider:[LDK100] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [] PBX contact: [sip:[email protected]:5060]
15:51:55.093 [CM503002]: Call(160): Alerting sip:[email protected]:5060
15:51:46.751 [CM503025]: Call(160): Calling VoIPline:62300371758286@(Ln.10005@LDK100)@[Dev:sip:[email protected]:5060]
15:51:46.748 [MS210006] C:160.2:Offer provided. Connection(by pass mode): 192.168.1.195:40006(40007)
15:51:46.702 [CM503004]: Call(160): Route 1: VoIPline:62300371758286@(Ln.10005@LDK100)@[Dev:sip:[email protected]:5060]
15:51:46.701 [CM503010]: Making route(s) to <sip:[email protected]:5060>
15:51:46.701 [MS210000] C:160.1:Offer received. RTP connection: 192.168.1.195:40006(40007)
15:51:46.700 Remote SDP is set for legC:160.1
15:51:46.695 [CM503001]: Call(160): Incoming call from Fax.8888 to <sip:[email protected]:5060>
15:51:46.691 [CM500002]: Info on incoming INVITE:
INVITE sip:[email protected]:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.195:49446;branch=z9hG4bK-d8754z-414e737103607d7a-1---d8754z-;rport=49446
Max-Forwards: 70
Contact: <sip:[email protected]:49446;rinstance=5476c729f1372993>
To: <sip:[email protected]:5060>
From: "8888"<sip:[email protected]:5060>;tag=1c573250
Call-ID: NzNiMTdlZWIwNDNhNDM2Zjk5MzA1NTdhOWQwMDVmMmI.
CSeq: 2 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Proxy-Authorization: Digest username="8888",realm="3CXPhoneSystem",nonce="414d535c0901817223:f3636fa8a829d03b663317410ac992cf",uri="sip:[email protected]:5060",response="86ddc1d7cb75c4dcfa043092a47ba09f",algorithm=MD5
Supported: replaces
User-Agent: 3CXPhone 6.0.26523.0
Content-Length: 0

If you still want full log, please provide filename.
 
Status
Not open for further replies.

Latest Posts

Members Online Now

Total: 318 (members: 1, guests: 317)

Forum statistics

Threads
111,835
Messages
589,289
Members
164,665
Latest member
dominik.pepel
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom