In our office, we have a voip server(sipXecs) that is connected to a few phones and ATA boxes.
Recently, our VOIP system has been giving us problems. On first boot, it's fine, but then after a while, the devices would stop registering and calls could no longer be made.
Looking through the Call detail records, we noticed, that shortly before the system stopped working, it received a great deal of calls in a very short amount of time from an unknown caller and these calls were made to international phone numbers (normally only 1 or 2 different numbers, but with varying area codes).
Under the caller field, it just says "unknown". The calls all fail, whether they fail because the caller could not be authenticated, or because our voip data plan does not include international calling, I cannot say.
Unfortunately (or fortunately as the case may be), I think the server has a setting that makes it stop working if it receives a certain number of calls in a certain number of time (I believe it's 20 calls per 3 seconds). So, the server sees the massive attack by Mr.Unknown and turns off.
Now, am I correct in presuming that these unknown calls are most likely attempts to piggy back of our system?
If yes, then:
1) How do they get access to the system without a username or a password? Heck, I am surprised anyone can even find the system of a small office like ours.
2) What does it mean to get a call from unknown
? If a caller hides his number, then the system is meant to show Unavailable
in the From column.
3) How do I stop Mr.Unknown from making these calls?
Thanks for all your time.