Generate random extensions

[FIKRAT]

Hi,

We have a VoIP client that connects to 3cx to establish a video and audio call. This is .Net application that we need to provide for our internal clients that will establish connects from a public networks using ACE, TURNs etc. In spite of that our application is obfuscated (multiple times) we don't want to reveal extensions in case of reverse engineering.

What we would like to know of there any possibility to generate random extension number (4 digits) for 3cx extension based on time period or per request? Is there any way to hide extension and provide temporary ID that can be changed then automatically based on some rules?

Thanks for any help.

 

[leejor]

The vast majority of 3CX users create extensions (specific numbers) based on need. I can't recall seeing a request for a random extension creation option previously. I'm not certain it is something that has been considered.

I'm not certain how reverse engineering of an extension number is going to present a security issue. On many PBX's extension numbers are known (so outside callers can dial direct through an IVR). Even with this information, to register a set, would still require the password, which , hopefully, is random, and long enough to guess.

Perhaps you can explain your concerns as to what might happen.

 

[FIKRAT]

Hi,

Thank you for your feedback. Let me try to explain what is requirement here.

It is not about reverse engineering of extension. The party (A) is an android app, the party (B) is an android app too. Party (A) use some public services where at the end it needs to contact with some service agent (which is party B). Exact service agent provides to party (A) by the backend from pool of agents. Means, that party (A) doesn't know who is going to be a agent and what it's extension. Communication between party (A) and backend is done via HTTPS. However, when backend provides extension of service agent, it can be revealed by some hack tricks. Having a real extension of service agent, party (A) may use it to make some calls using external VoIP clients as an example for a fun.

Having temporary extension doesn't leave any chance to call to the same service agent outside of the application because this extension will be available only during this process after which is will be renewed by the system (by backend or by 3cx or by other system).

Hope it is clear now.

Thank you once again.

 

[Evolute IT]

The vast majority of 3CX users create extensions (specific numbers) based on need. I can recall seeing a request for a random extension creation option previously. I'm not certain it is something that has been considered.

I'm not certain how reverse engineering of an extension number is going to present a security issue. On many PBX's extension numbers are known (so outside callers can dial direct through an IVR). Even with this information, to register a set, would still require the password, which , hopefully, is random, and long enough to guess.

Perhaps you can explain your concerns as to what might happen.

Generating random extensions is also useful for a lab instance or demo instance where you want a lot of extensions without having to really name them.

 

[leejor]

In my original reply, I had put "can recall", where it should be "can't recall" seeing a request for this... corrected now.
I'm still a bit fuzzy about exactly what you are trying to accomplish, however, normally and extension, 3CX Android App or otherwise is not normally assigned to a device that doesn't belong to a (relatively) trustworthy employee of the organization. If that person were found to be "hacking" the App for nefarious purposes, it would be expected that they would be reprimanded.

Having a real extension of service agent, party (A) may use it to make some calls using external VoIP clients as an example for a fun.

This can be prevented by blocking outside calls, to the extensions assigned.

From the sounds of it, you are attempting (doing) something beyond the scope of the current version of 3CX. There may be an Add-on that could be created (may be available now), that will do what you desire. You will have to await additional responses from forum members, or 3CX staff.