PBX Hacked and Scheduling when calls are allowed

[PitzKey (Itzik)]

@ashcortech

I know the extension from which the calls were made. It’s a softphone extension used on the owner’s cell phone. How do I go about tracking down how this happened?

Three possibilities.

1. The password is a unsecure password.
2. The SIP credentials were emailed to the user and their email account got hacked.
3. The password was stored in a unsecure place, or it is in EPM and is exposed publicly.

However, IMO: blocking outbound calls is a fat band-aid. You should first change the password, allow SIP access from trusted sources and then try to figure out how they gained access.

A while ago, I discussed on the #OpenSourceLounge how you can use an existing tool in FreePBX to implement a sort of 2FA on every outgoing call.

I was planning on presenting this at AstriCon as well as other techniques how to detect and get notified when there’s possible malicious activity on your PBX. But unfortunately, the AstriCon dates do not align well with the Jewish holiday of Sukkot. So maybe next year…