Possible virus in new update/downloads

[Amphibian]

Hey Team,

Need to see if anyone else may be experiencing the same issues as I have been the last few days/weeks...

Approx one week ago, I noticed that even though I had not done a update - an update had occurred to my production server. I noticed this as I started having issues with calls, in and out, and also noticed that my root passwords for root and other users had all changed... thinking I have been hacked (even though I have csf installed) I went searching and haven't found where any possible access came from....but I'm no expert either....

At the same time, after correcting that server, I had downloaded a fresh copy of 4.0 to try on a test machine. This machine for the last few days has been a lunch getter. Since installing software onto a brand new machine, with a brand new HD, at random times extension information suddenly disappears, in/out bound routes disappear, and noticed today that all my root passwords have been changed (just like production server).....

Please note, this test server IS NOT attached to the outside world... it is attached to one Linksys router and one VOIP Desk phone and no other cables are in use and no wifi access....

Possible that new software downloaded has a bug/virus? Possible that updates have same issues of bug/virus? I have taken an older version of 2.4 I have and loaded it last night and all seem to work ok until I attached the test server to the net and did a update..... since then the above listed occurrences have started occurring again....

Can someone please advise if they are having the same issues or if there is a way to check the newest downloads.

Needless to say, I'm at my wits ends.... enough to make one want to throw it all in the trash and go home and forget about it.....

Thanks, let me know,

amphibian

 

[danardf]

Very strange William!
I wonder how is possible to change any pasowrds through malicious code with to be connected to the WAN.

If you have oly some sip phone. Try to upload the last firmware. If we think the malicious code could be in the SIP phone.
Try to leaving up the server without SIP and extension connected, just alone.

Don't forget to make the last Elastix update with Freepbx 2.11.0.25, Freepbx 0.24 being hackable by injection code.
If tje password has been change without SIP extensions connected then the malicious code is inside the package.

 

[Amphibian]

Sir Franck,

I did just that last night before leaving shop... I changed root password thru recovery method and left it (the server) running all night with nothing connected to the server....not even router.... I came in this morning at 5 and tried to sign onto server and passwords for both root, me and one other user name are not working..... changed passwd again thru rescue and then signed out, waited a few minutes and signed right back in with no problem. I then signed out, went and got breakfast, came back about and hour later and tried to sign in again and no luck.... not just root's passwd but the others too... maybe there is a problem within the shadow file?

Changed passwords on production machine last night and they too are not working as of this day.... Production is showing version 2.5.... and test is version the new 4.0.74 obtained 7/24/16..

I have tried to do the update after connecting test server to internet and install other centos items like wget, yum config manager, etc today but I get "failure: repodata/repomd.xml from LowayResearc: errno 256 No more mirrors to try.... http://yum.loway.ch/RPMS/repodata/repodata.xml: Errno curl#6 "Could not resolve host: yum.loway.ch; Unknown error"".... The same is occuring with production machine also....

Am going to remove 4.0 and install the last known good version I have which is 2.4.1 and then reload the same on production machine till I know that 4.0 is good to go again.....

Thank you Sir,

amphibian

 

[danardf]

Are you beside Salem? :lol:

So strange indeed

I've an Elx 4.0 and it works fine.

Did you tried to dowload another iso file from another mirror?
I've a doubt for an iso file corrupted for all. But why not.

Could you launch this problem in the Elastix bug report after these final tests please, including this thread (link)?

 

[Amphibian]

No I don't live next to Salem, but I think some of their folks are in town this week.....lol


I will put in bug report as soon as I can get this job completed...

Thanks Sir,

amphibian