Hacking

[Thegoldenaxe]

Greetings

I Have a client whith a huge phone bill. This is due to call made to +88 destinations. However this destination is blocked in the allowed country codes section.
In the call logs i can see the extentions who made those calls. the problem is that the office off the client was empty at the time the calls were made.
I serched in the audit logs and in the days prior to the days the calls were made there were no chages to the extention in question (phones registred, logins etc)

Can someone explain me how this is possible and how can i prevent this from appen again??

Thank you

 

[Pierre_3CX]

Hello,
Sorry to hear of this incident,
you should check if this extension misused had strong credentials (see in particular Authentication Password and Webclient Password) and out of precaution regenerate them all as a first step. The credentials may have been brute-forced if very weak or may have been exposed in the first place externally to the system e.g leaked welcome email, compromised user device, etc...

About the +88 numbers dialed whilst destination was blocked, I suppose they haven't been dialed in a valid international format if the PBX let them through.
The PBX blocks destinations based on the Allowed country codes if it identifies them as international, meaning that the number dialed needs to start with the International Dial Code configured in your Settings / E164 Processing (typically 00 or 011 depending country of installation) or with +. You can confirm that by generating a Call Report Any to Any on that period.
In effect if they were interpreted as local numbers and if there was a lose outbound rule matching such numbers, they went to the voip provider directly which can sometimes connect such numbers or reformat them to ease dialing on their end. You may look also on the provider level if destinations can be restricted so you block the same as in 3cx.

I would recommend reviewing the below blog posts where we listed good practices to secure further your system:
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-1/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-2/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-3/
https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-4/

 

[Thegoldenaxe]

There is the call repport in question
If i dial the same number i get the block prompt message from the 3CX, no metter in witch format (+,00, etc
)

 

[Pierre_3CX]

So based on this it wasn't dialed in international format as it didn't have a leading international dial code (no 00).
Did you dial it in the same way and from same extension? was there no changes to the outbound rules or extension configuration since the incident?

 

[Thegoldenaxe]

So based on this it wasn't dialed in international format as it didn't have a leading international dial code (no 00).
Did you dial it in the same way and from same extension? was there no changes to the outbound rules or extension configuration since the incident?

I tried every format possible, and i was blocked in every attempt. if any one as an clue.