Hacked, rogue PJSIP extension created

[spammie]

Hi all,

My 13.0.195.4 was hacked yesterday. The hackers created a PJSIP account that I can’t seem to delete from the GUI. I was able to change the password, and of course, I’ve updated all the modules.

What might cause an extension to be un-deletable?

I’ve got backups of the evening prior to the hack, and last night after the hack, but before the framework/module upgrades. Any idea how to identify how they got in?

Thanks.

Spammie

[arielgrin]

Are you sure it is not the default anonymous pjsip entity?

[tm1000 (Andrew Nagy)]

@spammie

I’ve got backups of the evening prior to the hack, and last night after the hack, but before the framework/module upgrades. Any idea how to identify how they got in?

Send the backups to [email protected]
Anything else is pure speculation.