Solved Yealink phones w/3CX firmware attempting OUTBOUND traffic to blacklisted IP's

[CAJAY]

Hello,

We've noticed some unauthorized traffic from our Yealink T42g phones using latest 3CX partnered firmware (ver 29.83.0.130).

The IP address in question is:

23.129.64.157 attempting to go out over port 123

The desitnation ip address is listed in the Talos blacklist:

https://www.talosintelligence.com/feeds/ip-filter.blf

Also listed:
23.129.64.158
23.129.64.159

Does someone involved with 3CX / Yealink know what this IP address is used for and if it is authorized/safe?

Thanks.

 

[Saqqara]

Port 123 is NTP

What are your settings - https://www.3cx.com/community/threads/change-default-ntp-servers.57269/ , default should be pool.ntp.org

If you have custom templates you may have the settings entered in the template

 

[CAJAY]

Apparently the IP is an active TOR relay... so obviously not something that the VOIP phones should be attempting to reach:

https://metrics.torproject.org/rs.html#details/183C8C6727E2137AF278B3850AD5D9C2304B98C9

 

[CAJAY]

Port 123 is NTP

What are your settings - https://www.3cx.com/community/threads/change-default-ntp-servers.57269/ , default should be pool.ntp.org

If you have custom templates you may have the settings entered in the template

Unchanged from default: pool.ntp.org

For additional info, we have server setup on AWS (3CX bundle) and we have a local 3CX SBC.

Is it possible the code (3CX or yealink firmware for T42g) has been compromised?

 

[Saqqara]

You can also check the settings within the phone gui - Settings - Time & Date

 

[CAJAY]

You can also check the settings within the phone gui - Settings - Time & Date

pool.ntp.org there as well.

 

[CAJAY]

I guess I'll drop all phones firmware down to the latest Yealink official version 29.83.0.120 (if possible) instead of the custom 3cx ".130" version and see if that eliminates this traffic. At least we can try to isolate where the issue is.

If someone from 3CX has any ideas of what has happened here feel free to chime in.

 

[CAJAY]

Update: I can now confirm the unauthorized traffic still atempts to get out from Yealink phones while running the Yealink latest .120 firmware. So whatever it is, it is present in both firmware editions.

 

[cobaltit]

So your assumption is it's based on the firmware, but it may just be a rogue NTP server. I'd try manually changing the NTP server to something else (I like time.cloudflare.com) and see if that same traffic persists.

 

[CAJAY]

it may just be a rogue NTP server.

Ah you're right! I bet that's it. Someone with a blacklisted IP in pool.ntp.org

I guess that's the value of an Advanced Certified Platinum Partner!

Thanks!

 

[cobaltit]

You're welcome. I tell people I'm good at what I do because I can make mistakes 10x faster than the other guys and experience is a great teacher!

 

[JohnS_3CX]

Ah you're right! I bet that's it. Someone with a blacklisted IP in pool.ntp.org

I guess that's the value of an Advanced Certified Platinum Partner!

Thanks!

Glad you figured it out. Not a 3CX, Yealink or Talos issue. I guess that IP ended up in the blacklist for some reason or another and will eventually expire. The phone will not fail either, it will resolve more than a single IP from pool.ntp.org and eventually move on to the next IP down the line of time servers