I received an email from my 3CX PBX that the IP address for my SIP provider had been blacklisted. When this happens my phone system becomes an island. No calls from outside world come in, and no calls to the outside world go out.
This has happened once or twice a year for the last few years. Bad people come in from the SIP provider's network and attempt to create an extension on my phone system. The registration fails because the bad people don't know any of the user names and passwords for existing extensions. I delete the blacklisted IP, we're reconnected with the outside world, and things are ok again.
This time however, my event log is chuck full of 10029 Provisioning file for MAC <<MAC address of an extension on my system>> of user <<extension #>> requested by <<IP address of some other extension on my network>>.
This is more than a little bit terrifying because if the bad guys obtain a provisioning file, I think they'll have pretty much everything they need to setup a rogue extension, and start doing who knows what with it.
I deleted the blacklisted IP, and the event log immediately started filling up with these 10029 events again. I disconnected the network cable from the SIP provider for about 30 minutes, reconnected it, and I'm now watching the event log. No 10029 events have shown up yet, but I'm sure it's only a matter of time before the robotic program circles back to my IP or the bad people get back from lunch or whatever and continue their nefarious hacking.
My question to all my forum friends out there is: How can I stop this? Is there anything I can do? Are the bad guys getting the provisioning files of all my extensions and I'm just doomed or what?
This has happened once or twice a year for the last few years. Bad people come in from the SIP provider's network and attempt to create an extension on my phone system. The registration fails because the bad people don't know any of the user names and passwords for existing extensions. I delete the blacklisted IP, we're reconnected with the outside world, and things are ok again.
This time however, my event log is chuck full of 10029 Provisioning file for MAC <<MAC address of an extension on my system>> of user <<extension #>> requested by <<IP address of some other extension on my network>>.
This is more than a little bit terrifying because if the bad guys obtain a provisioning file, I think they'll have pretty much everything they need to setup a rogue extension, and start doing who knows what with it.
I deleted the blacklisted IP, and the event log immediately started filling up with these 10029 events again. I disconnected the network cable from the SIP provider for about 30 minutes, reconnected it, and I'm now watching the event log. No 10029 events have shown up yet, but I'm sure it's only a matter of time before the robotic program circles back to my IP or the bad people get back from lunch or whatever and continue their nefarious hacking.
My question to all my forum friends out there is: How can I stop this? Is there anything I can do? Are the bad guys getting the provisioning files of all my extensions and I'm just doomed or what?
