Crontab entry: has my PBX been hacked?

[Stewart1 (Stewart)]

Yes, your system has been hacked. Don’t try to clean it up. Reinstall a clean .iso and restore from a backup taken before the attack. Most likely, the cause is

SECURITY ISSUE - Potential Rest Phone Apps RCE

On the afternoon of December 21, 2021 Sangoma received a report of malicious activity in progress on a fully up to date FreePBX 15 system. Technical details followed very quickly, and engineering was able to act within minutes of the report. Investigation revealed that the vulnerability to be in the FreePBX and PBXact Phone Apps (restapps) module, in published versions 16.0.18.40, 16.0.18.41, 15.0.19.87 and 15.0.19.88. Other major FreePBX or PBXact versions are not affected. The affected module …

See also this discussion:

0 Day FreePBX Exploit?

I was made aware of a new zero-day FreePBX exploit today - apparently it affects Phone Apps, even if you’re not using Phone Apps in a licensed capacity. Does anyone have any information on this? Apparently, and earlier post on the subject was pulled down? Do we have any sort of statement from Sangoma or an ETA for a security fix? Should we be closing down the public facing Phone Apps port for all customers? -Chris

If your system had been updated to one of the vulnerable versions, it is almost certain that this is what happened.

To reduce the chance of similar incidents in the future, ensure that any kind of web access to the PBX (admin, UCP, REST, etc.) is restricted to whitelisted IP addresses.