Severe Security Flaw?
Submitted by lcasey on Fri, 06/25/2010 - 4:47am.
Hello,
Recently our system was hacked. Someone called into our Voicemail pressed a few buttons and was able to obtain an outside line. They generated thousands of dollars in fraudulant charges. I worked with Fonality support but even they could not figure out how they performed this hack. Does anyone know what the key combination is they are using? Here is a piece of the Log:
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Set("Zap/7-1", "EXTENSION=5555") in new stack Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing AGI("Zap/7-1", "fon://localhost:4574") in new stack Jun 20 22:26:36 VERBOSE[2905] logger.c: -- AGI Script fon://localhost:4574 completed, returning 0 Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "/dev/null|20|r") in new stack Jun 20 22:26:36 WARNING[2905] channel.c: No channel type registered for ''
Jun 20 22:26:36 NOTICE[2905] app_dial.c: Unable to create channel of type '' (cause 66 - Channel not implemented) Jun 20 22:26:36 VERBOSE[2905] logger.c: == Everyone is busy/congested at this time (1:0/0/1) Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "s-CHANUNAVAIL|1") in new stack Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s-CHANUNAVAIL,1) Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "s|11") in new stack Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s,11) Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing VoiceMail("Zap/7-1", "u5555") in new stack Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Playing '/var/spool/asterisk/voicemail/default/5555/unavail' (language 'en') Jun 20 22:26:38 VERBOSE[2905] logger.c: -- Playing 'beep' (language 'en') Jun 20 22:26:38 VERBOSE[2905] logger.c: -- Recording the message Jun 20 22:26:38 VERBOSE[2905] logger.c: -- x=0, open writing: /var/spool/asterisk/voicemail/default/5555/tmp/yKnmQ3 format: wav, 0x87e7888 Jun 20 22:26:39 VERBOSE[2905] logger.c: -- User ended message by pressing # Jun 20 22:26:39 VERBOSE[2905] logger.c: -- Playing 'auth-thankyou' (language 'en') Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Recording was 1 seconds long but needs to be at least 3 - abandoning Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "130") in new stack Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s,130) Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Executing WaitExten("Zap/7-1", "1") in new stack Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Timeout on Zap/7-1, continuing...
Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Executing BackGround("Zap/7-1", "vm_message_sent") in new stack Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Playing 'vm_message_sent' (language 'en') Jun 20 22:26:50 VERBOSE[2905] logger.c: == CDR updated on Zap/7-1 Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing GotoIf("Zap/7-1", "0?20") in new stack Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Set("Zap/7-1", "EXTENSION=4232297200") in new stack Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing AGI("Zap/7-1", "fon://localhost:4574") in new stack Jun 20 22:26:50 VERBOSE[2905] logger.c: -- AGI Script fon://localhost:4574 completed, returning 0 Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "Zap/g2/0115352690560") in new stack Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Requested transfer capability: 0x00 - SPEECH Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Called g2/0115352690560 Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/2-1 is proceeding passing it to Zap/7-1 Jun 20 22:26:50 VERBOSE[9097] logger.c: -- Channel 0/2, span 1 got hangup request Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/2-1 is circuit-busy Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Hungup 'Zap/2-1'
Jun 20 22:26:50 VERBOSE[2905] logger.c: == Everyone is busy/congested at this time (1:0/1/0) Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "Zap/g3/0115352690560") in new stack Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Requested transfer capability: 0x00 - SPEECH Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Called g3/0115352690560 Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/26-1 is proceeding passing it to Zap/7-1 Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Zap/26-1 is ringing Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Zap/26-1 answered Zap/7-1 Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Attempting native bridge of Zap/7-1 and Zap/26-1
Corrected Logs
Fri, 06/25/2010 - 12:17pm
This was a PBXtra system bought from Fonality. No Disas or Pin options are available in that version. The company paid a significant amount of money for the PBX and now I route all outbound calls through a Trixbox CE with Pinsets on International calling.
This means there are thousands of vulnarable systems out there. I would like to find out the key combination they used to exploit this.
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Set("Zap/7-1", "EXTENSION=5555") in new stack
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing AGI("Zap/7-1", "fon://localhost:4574") in new stack
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- AGI Script fon://localhost:4574 completed, returning 0
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "/dev/null|20|r") in new stack
Jun 20 22:26:36 WARNING[2905] channel.c: No channel type registered for ''
Jun 20 22:26:36 NOTICE[2905] app_dial.c: Unable to create channel of type '' (cause 66 - Channel not implemented)
Jun 20 22:26:36 VERBOSE[2905] logger.c: == Everyone is busy/congested at this time (1:0/0/1)
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "s-CHANUNAVAIL|1") in new stack
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s-CHANUNAVAIL,1)
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "s|11") in new stack
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s,11)
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Executing VoiceMail("Zap/7-1", "u5555") in new stack
Jun 20 22:26:36 VERBOSE[2905] logger.c: -- Playing '/var/spool/asterisk/voicemail/default/5555/unavail' (language 'en')
Jun 20 22:26:38 VERBOSE[2905] logger.c: -- Playing 'beep' (language 'en') Jun 20 22:26:38 VERBOSE[2905] logger.c: -- Recording the message
Jun 20 22:26:38 VERBOSE[2905] logger.c: -- x=0, open writing: /var/spool/asterisk/voicemail/default/5555/tmp/yKnmQ3 format: wav, 0x87e7888
Jun 20 22:26:39 VERBOSE[2905] logger.c: -- User ended message by pressing #
Jun 20 22:26:39 VERBOSE[2905] logger.c: -- Playing 'auth-thankyou' (language 'en')
Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Recording was 1 seconds long but needs to be at least 3 - abandoning
Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Executing Goto("Zap/7-1", "130") in new stack
Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Goto (macro-stdexten,s,130)
Jun 20 22:26:40 VERBOSE[2905] logger.c: -- Executing WaitExten("Zap/7-1", "1") in new stack
Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Timeout on Zap/7-1, continuing...
Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Executing BackGround("Zap/7-1", "vm_message_sent") in new stack
Jun 20 22:26:41 VERBOSE[2905] logger.c: -- Playing 'vm_message_sent' (language 'en')
Jun 20 22:26:50 VERBOSE[2905] logger.c: == CDR updated on Zap/7-1
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing GotoIf("Zap/7-1", "0?20") in new stack
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Set("Zap/7-1", "EXTENSION=4232297200") in new stack
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing AGI("Zap/7-1", "fon://localhost:4574") in new stack
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- AGI Script fon://localhost:4574 completed, returning 0
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "Zap/g2/0115352690560") in new stack
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Requested transfer capability: 0x00 - SPEECH
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Called g2/0115352690560
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/2-1 is proceeding passing it to Zap/7-1
Jun 20 22:26:50 VERBOSE[9097] logger.c: -- Channel 0/2, span 1 got hangup request
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/2-1 is circuit-busy
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Hungup 'Zap/2-1'
Jun 20 22:26:50 VERBOSE[2905] logger.c: == Everyone is busy/congested at this time (1:0/1/0)
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Executing Dial("Zap/7-1", "Zap/g3/0115352690560") in new stack
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Requested transfer capability: 0x00 - SPEECH
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Called g3/0115352690560
Jun 20 22:26:50 VERBOSE[2905] logger.c: -- Zap/26-1 is proceeding passing it to Zap/7-1 Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Zap/26-1 is ringing
Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Zap/26-1 answered Zap/7-1
Jun 20 22:28:13 VERBOSE[2905] logger.c: -- Attempting native bridge of Zap/7-1 and Zap/26-1
Looking at the logs when in
Fri, 06/25/2010 - 4:15pm
Looking at the logs when in the voicemail for extension 5555 they pressed #
Jun 20 22:26:39 VERBOSE[2905] logger.c: -- User ended message by pressing #
this then dropped them into the std extension macro that was waiting for an extension to be entered rather than hanging up the call
they then dialled the number they required and got connected
so I think at the unavailiable greeting of 5555 they dialed # 0115352690560
I FOUND IT!!!!
Sat, 06/26/2010 - 2:37am
Hey, I was able to replicate this!!!!!
1. On our fonality hosted PBXtra system, simply dial the companies number.
2. get to any voicemail box and press # You will here a beep indicating ready for voicemail
3. then hit # again
4. You will hear "Thank You"
5. Imidiatly after the thank you dial 9 + the number you want to dial
6. The system dials the number. It is sort of hit and miss here as you really have to be quick after the thank you.
Scott
Sat, 06/26/2010 - 2:43am
This is a system hosted by fonality. Basically its a trixbox Call Center edition that sits in our server room. However Fonality has a VPN connection into our box. They Overwrite our configs from thier servers whenever a change is made. To administer the server you have to goto http://cp.fonality.com to make changes which then overwrite all the files in the asterisk directory.
I was unable to find a general config, but here is a list of the .conf files
key
asterisk.adsi
telcordia-1.adsi
zapata.conf.bak
adsi.conf
adtranvofr.conf
agents.conf
alerts.conf
alsa.conf
asterisk.conf
astwatch.conf
cdr_odbc.conf
cdr_pgsql.conf
enum.conf
extensions.conf
festival.conf
FONmon.conf
iax.conf
indications.conf
internal.conf
logger.conf
manager.conf
meetme.conf
mgcp.conf
modem.conf
modprobe.conf
modules.conf
musiconhold.conf
oss.conf
parking.conf
pbxtra.conf
phone.conf
privacy.conf
queues.conf
rpt.conf
rtp.conf
sip.conf
skinny.conf
smg_bri.conf
voicemail.conf
vpb.conf
woot.conf
zapata.conf
zaptel.conf
sip.conf.default
modules.conf.bak.FONmon
.astwatch.co.swp
permissions.xml
user_recordings.xml
users.xml
FYI:i tried to replicate on
Sat, 06/26/2010 - 6:15am
FYI:i tried to replicate on my server, and all attempts failed ( call hangup or or back to IVR). So there must be some settings on yrs that causes this.
----------------------
IT/VOIP consultancy, VOIP eStore, Support Forum
Bao Nguyen IT Co., Ltd.
http://www.baonguyen.vn
WE MAKE IT
Since this is the trixbox CE
Sat, 06/26/2010 - 9:42am
Since this is the trixbox CE forum I did not consider pro or PBextra.
Since you paid for those systems I suggest you work with Fonality to resolve the issue. The folks in this forum have no connection to Fonality other than Andrew.
There is also a Pro forum, it was to support the Free version of Pro that does not exist anymore.
--
Scott
aka "Skyking"
Can someone post detailed
Sat, 06/26/2010 - 5:16pm
Asterisk dialout option
Mon, 06/28/2010 - 7:19am
Not a big user of Fonality software, but...
It looks like Fonality has implemented a really obscure backdoor DISA option in their voicemail system that wasn't documented. If you want to see how it works in the FreePBX world with any of the Asterisk aggregations, do the following:
Edit one of your extensions that has voicemail enabled and add dialout=from-internal in the VM Options field. Outbound DISA calls can then be placed from within the voicemail system by dialing 4 then 3 while retrieving your messages. No additional password is required so you're at the mercy of your VM password. If you don't have a voicemail password on an extension or if have a really insecure password with this "feature" enabled, then you have the makings for a $100,000 phone bill.
Hope this helps.
Even without knowing the VM password
Mon, 06/28/2010 - 9:07am
I just read this topic and
Tue, 06/29/2010 - 6:54am
I just read this topic and tried for myself. I can replicate the exact same issue with our Trixbox Pro system. Internally if I phone a voicemail box, press # twice and dial an external line, it connects no problem. Even worse, the call is not logged in Trixbox! I've done a report on all types of calls and the call I just made to the VM box and dialled the external line doesn't show up!
Externally, if I get through to a VM box and press # twice, as soon as I press 9 it says it doesn't allow the extension. However, keep dialling the number despite the voice recording saying it's not allowed and it'll connect regardless!! Once again the call I'm making from the mailbox isn't logged, and the originating number is the default CLI (our office number). So this means anyone can exploit our system (and office number) just by getting through to the mailbox and pressing certain buttons.
Not good.....!!
Guys - I am trying to
Thu, 07/01/2010 - 1:39pm
Guys - I am trying to replicate this issue, but thus far have been unable to with my test trixbox Pro system (v4.1.2-p13). When I hit ## and then start dialing 9+number from a voicemail box, it always redirects me back to the main greeting, or to a blast group I have set up (I'm assuming these are the escape digits from VM).
I'm not saying this is not an issue - but I need a better test. If this is *not* allowed on mine, but *is* allowed on the other systems who have tried it, we need to figure out what configuration is allowing this to happen.
Therefore, for anyone affected by this problem, and who is willing to volunteer to put their server up for testing (I will test outside of normal business hours for your time zone), please PM me the following:
Your server ID:
An inbound phone number that rings to your AutoAttendant:
Your office hours:
The exact steps you have taken to replicate the issue:
Also, as a side-note, we do have the ability to enable 'CallOut' per extension in the voicemail settings (akin to DISA in CE). For my test, CallOut was ENABLED, and yet I was still unable to replicate the problem. It is considered a best practice (and a good security measure) to DISABLE CallOut for anyone who does not have a need for it, and ensure that you have strong VM passwords on those extensions who do have a need for it (not 1234 or the extension number for instance).
As soon as I receive an affected server or two to test with, I will update this thread with my findings.
Chris Sherwood
FtOCC Admin and Tech Certified
Fonality Sales Engineer
This is Verified By Fonality!
Thu, 07/01/2010 - 2:55pm
[ticket.fonality.com #1488432] Server ID 6652: Software - Receiving Abusive or SPAM Calls
Dear Larry Casey:
Thank you for your recent contact with the Fonality Support Team (Ticket ID: 1488432). Our records indicate that further action/response is needed on your part before we can proceed with the resolution of this service request.
Below, you will find the last correspondence from Fonality Support sent on 2010-06-30.
-----LAST MESSAGE BELOW-----
Larry;
My apologies for the delay.
It appears that our engineering has already been aware of this, and have resolved the issue on our next release (I was able to confirm that).
We are slated to release this in July (hopefully).
If you would still like to go over the information you found, let me know.
I would also like to mention that you may be receiving a survey from us regarding your experience with this issue. This survey reflects back on my performance and we appreciate any feedback you can give us.
Thank you for your time,
Garth Nysschens
Fonality Support
866-FONALITY
PBXtra Press 1
Trixbox Press 2
Have you seen our knowledge base lately?
http://help.pbxtra.com/
http://help.trixbox.com/
http://learn.fonality.com/
The Fonality Team
Fonality, Inc.
We are already rolling out
Fri, 07/02/2010 - 9:52am
We are already rolling out PBXtra version 5 to customers. If you would like to be put on the upgrade list (PBXtra only at this time), please PM me your server ID and I will submit the request for your server.
Moving this thread over to the trixbox Pro forums as it is more appropriate there.
Thanks,
Member Since:
2009-05-19