In our office, we have a voip server(sipXecs) that is connected to a few phones and ATA boxes.

Recently, our VOIP system has been giving us problems. On first boot, it's fine, but then after a while, the devices would stop registering and calls could no longer be made.

Looking through the Call detail records, we noticed, that shortly before the system stopped working, it received a great deal of calls in a very short amount of time from an unknown caller and these calls were made to international phone numbers (normally only 1 or 2 different numbers, but with varying area codes).

Under the caller field, it just says "unknown". The calls all fail, whether they fail because the caller could not be authenticated, or because our voip data plan does not include international calling, I cannot say.

Unfortunately (or fortunately as the case may be), I think the server has a setting that makes it stop working if it receives a certain number of calls in a certain number of time (I believe it's 20 calls per 3 seconds). So, the server sees the massive attack by Mr.Unknown and turns off.

Now, am I correct in presuming that these unknown calls are most likely attempts to piggy back of our system?

If yes, then:

1) How do they get access to the system without a username or a password? Heck, I am surprised anyone can even find the system of a small office like ours.

2) What does it mean to get a call from unknown? If a caller hides his number, then the system is meant to show Unavailable in the From column.

3) How do I stop Mr.Unknown from making these calls?

Thanks for all your time.

  1. They're not - they have brute-forced (or just guessed) the password to one of your SIP accounts and they're using that to make calls. Either that, or you have a gaping hole in your phone switch allowing endpoints to register and make calls without a password.
  2. Who knows - perhaps he's setting "Unknown" as his CallerID name.
  3. Ensure that all of your SIP accounts require a password, then go through all the accounts and change the passwords to something long (12+ characters) and randomly-generated.

Recommendation: Install something like fail2ban that watches your sipX logs for failed authentications and firewalls off offending IPs.

  • Thanks for the response! We shall look into it as best we can. Also, thanks for fail2ban. – zermy Dec 12 '11 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.