Prevent Rogue Extension Registration?

[BusySignal]

I have a plain vanilla on-prem 3CX PBX. My SIP trunk provider gave me an ESG device. One port is assigned an IP address that's on my local LAN, for my PBX to connect to, and another port connects to the SIP trunk provider.

The other day I suddenly have a number of people in my office complaining that they can't make or receive calls with the outside world. After some quick troubleshooting, I discover that the IP address for the SIP trunk ESG device has been blacklisted. I removed the IP from the blacklist, and inbound and outbound calling was immediately restored.

I reviewed the activity log, and discovered that there were numerous attempts to register a non-existent extension on my system. After some number of failed attempts, the phone system must automatically blacklist the IP where these rogue registration attempts are coming from. I noted the originating SIP telephone number, did some Internet searching, and found that the number is associated with nuisance telemarketing and robocalling. This suddenly started to make sense to me. The bad people that are doing the robocalls somehow get an extension on my phone system, and then start making a huge, huge number of calls, that look like they’re coming from my company. We eventually get a reputation for being an unwanted telemarketer/robocaller, and PSTN service providers start blocking our outbound calls. We’re left with trying to restore our reputation, and getting our number unblocked, while the bad people simply delete their extension from our system, and move on to victimize some other unsuspecting company to make their robocalls.

My question is, how do I prevent these extension registration attempts that originate from the SIP trunk provider's IP address? I only have phones inside the building, and don't need to support any external extensions, so I would think that there would be an easy way for me to do this, but I can't really find anything in the documentation, or this forum, that definitively answers this question.

I'm hoping there's a 3CX expert out here that can point me in the right direction. Thanks.

 

[YiannisH_3CX]

Hello @BusySignal

So these attempts look like they are coming through the ESG device that connects directly to the provider? If so your provider might be able to do something about this.
Generally if you follow basic security best practices then you should be safe from attacks. Use strong passwords, don't allow extension to register outside your LAN and fortify your outbound rules so its not easy to call out.

Other than that, if the attempts all come through the same IP then your provider should block these before reaching you.

 

[BusySignal]

Yes, the registration attempts are coming through the ESG device.

I reached out to my provider the day that this happened. The tech support person I talked to had no idea what I was even talking about, and created a ticket that would supposedly be sent to a higher echelon of technical support. I can see the status of my ticket online, but there has been no activity on it whatsoever.

It's been a few days, so I am not optimistic that my provider will be assisting me with this problem.

I need to figure out where I need to go in the configuration of my 3CX phone system to prevent extension registration from outside my LAN.

 

[leejor]

If you haven't weakened your extension passwords, then it would be extremely difficult for a hacker to guess both the extension number and the extension password, and they would require both, to be able to place outbound calls. Check the activity Log to see if some of these attempts are Direct SIP calls.

If 3CX is seeing, and blacklisting these registration attempts (after a set number of attempts), and for some reason the blacklisted IP is that of your trunk device, and not the hackers originating IP, then that is a different issue.

Is this ESG device the only Internet connection to 3CX?

 

[BusySignal]

The hacker was attempting to register an extension that doesn't exist on my system. The credentials are all long jumbles of number and letters. All the registration attempts failed, so I'm safe that way, but the numerous attempts caused the IP address of the ESG device to be blacklisted, which took my phone system out of commission. This is the real problem I'm trying to solve.

I don't know the originating IP address of the registrations. With the ESG device, everything from the outside world is NAT'ed, so all traffic looks like it's coming from the internal LAN IP of the ESG device.

My Internet connection is completely separate from the ESG/SIP trunk provider connection. The Internet firewall prevents anything from directly getting to the phone system from the Internet.

I need to figure out where I need to go in the configuration of my 3CX phone system to prevent extension registration from the ESG device's IP address.

 

[leejor]

If the registrations are shown as coming from the ESG, then your provider is going to have to deal with this as you have no way of differentiating between a hack attempt and legitimate traffic. The firewall is going to have to be on the outside of the ESG as the hackers are targeting a public IP of your provider.

I find it hard to believe that this is the first time they have had to deal with this sort of thing, so they should have some sort of a solution to put forward, otherwise consider dumping them.

The only thing you can do, is to whitelist the ESG IP to prevent it from being blacklisted, and that is not going to be a good solution.

 

[YiannisH_3CX]

I agree with @leejor, you can whitelist the ESG IP address and that will prevent it from being blacklisted but that will decrease the PBX's ability to defend its self.
The best solution is for your provider to deal with this.

 

[BusySignal]

Both of you are correct, I don't want to whitelist the IP of the ESG device. If there's a robot attack that is repeatedly trying to create a rogue extension, I guess I'd rather have the IP blacklisted and the phone system lose its connection to the SIP provider, instead of just letting the attack continue relentlessly.

I received a status update from my ticket at the SIP provider. It basically said that this is not their problem, and that I should have a nice day.

Even though I was more than a little annoyed by their response, I sent back a polite reply and told them that I have no need for external extension registration, and asked if they would be able to limit the traffic to my ESG device to only their own IP addresses. I'll have to wait and see what they say. Again, I'm not optimistic that they are going to be assisting me with this problem.

Like @leejor said, I find it hard to believe this is the first time they have had to deal with this sort of thing. My SIP provider is an enormous nationally well-known provider of cable TV, Internet, and telephone service. You would think they would have a solution readily available.

I have couple years left on my service contract with them, so if this keeps happening, and they won't do anything about it, I will have to start shopping their competitors when it comes time to renew.

Thanks to both of you for helping me with my troubles.

 

[YiannisH_3CX]

Hopefully they will be willing to help you and solve your issue. Let us know how it goes.