unauthorized register

[mhmmdreza1977]

Dear Forum

This day our system log full with unknown call to unknown destination.
It seem someone already registered with fake user and make that call.

This are output from the call log.
===================================================
01/09/2017 8:48:13 AM (@(Ln.20000@JAKARTA HQ)) 0101722063047451 Not Answered
01/09/2017 8:48:08 AM (@(Ln.20000@JAKARTA HQ)) 9007972592317313 Not Answered
01/09/2017 8:47:08 AM (@(Ln.20000@JAKARTA HQ)) 0101722063733292 Not Answered
01/09/2017 8:47:04 AM (@(Ln.20000@JAKARTA HQ)) 007972599979917 Not Answered
01/09/2017 8:46:53 AM (@(Ln.20000@JAKARTA HQ)) 0101722063733292 Not Answered
01/09/2017 8:46:43 AM (@(Ln.20000@JAKARTA HQ)) 0101722063733292 Not Answered
01/09/2017 8:46:39 AM (@(Ln.20000@JAKARTA HQ)) 0101722063733292 Not Answered
01/09/2017 8:44:00 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:01:22
01/09/2017 8:41:28 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:03:57
01/09/2017 8:35:37 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:09:43
01/09/2017 8:28:36 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:12:06
01/09/2017 8:27:54 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:15:25
01/09/2017 8:27:54 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:17:24
01/09/2017 8:26:01 AM (@(Ln.20000@JAKARTA HQ)) 90101722063733292 00:09:29
01/09/2017 8:25:51 AM (@(Ln.20000@JAKARTA HQ)) 010170101722063733292 Not Answered
=========================================================================
And this is are some suspicious log from event log
==========================================================================
SIP Server/Call Manager ID: 4101
Extension 32202 is unregistered, removed contact: sip:[email protected]:50195;transport=TCP;rinstance=1-9r88maescugl8lxcr7ras5y29d6y0brk;ob;inst="3f55ae51"

SIP Server/Call Manager ID: 4101
Extension 32202 is registered, contact: sip:[email protected]:50195;transport=TCP;rinstance=1-9r88maescugl8lxcr7ras5y29d6y0brk;ob;inst="3f55ae51"

=======================================================================
In order to mitigate this, i block outbound call from Ln.20000@JAKARTA HQ and blacklisted some suspicious IP address

Can someone help us to hardening this system ?

regards
Reza

 

[cobaltit]

The best way to harden the system is to undo all the things you might have done to weaken the system. 3CX is pretty secure out of the box. All extensions are disallowed connection from outside the LAN, international calls are disabled, complex passwords are set. So if you changed any of those settings I would change them back. 99% of toll fraud is due to either vendor defaults or poor system administration. And since toll fraud is almost always over SIP, you can block SIP traffic at the firewall where not needed.

 

[mhmmdreza1977]

Dear Cobalit

Noted with thank's
Not much configuration tuning in our system
We just simply add user, add trunk and external address book.
Yes, we publish the extension to Internet for our mobile internet user's

 

[GiannosC_3CX]

Hi there,

The best resource to find out how to make your system more secure will be to refer to the following links:
http://www.3cx.com/blog/voip-howto/voip-security/
http://www.3cx.com/3cxacademy/videos/advanced/security-with-3cx-phone-system/
The 3CX Phone system by default is secured.

 

[leejor]

The only way that extensions can register is if they have the correct password. So...the password has been obtained somehow, or was easy enough to guess, given the extension number. I would, perhaps, review your passwords.