Avaya IP phones dialing International calls by themselves.

[raist3001]

Kindly request some help in this matter. I have searched google looking for an answer as to why IP phones are dialing international calls by themselves. They go off hook and begin dialing without any human interaction. I would think something was hacked. I have been looking over the configuration but nothing seems to jump out at me. The only thing I do not recognize in the short codes is a RELAY OFF. My thoughts are to delete this short code?

The system is behind a firewall, and the digital phones do not display this behavior. This is only happening to the IP phones. The customer needs to be able to dial international calls. And the IPO is set up to allow such.

Any one ever experience this? If the system was hacked, would it only be the IP phones? Or would the IPO be the equipment hacked?

 

[spOmes]

What do your incoming call routes say are any of them different?

 

[Gunnaro]

You're assumption is correct, you've been hacked.
But that relay thing is not your problem here...someone has access to your system.

PhoneManager or One-X Portal is a popular choice for the hackers, so take a look at your internal network.
You can use those applications on any kind of phones, not only IP.

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[raist3001]

My call routes are all proper. No unusual destinations, and nothing new added.

I am looking into One-X Portal now. Just changed the password.

 

[joe2938]

change all of your passwords asap!

 

[Gunnaro]

Changing pwds is just going to hold off the intruders a short period of time.
If they can reach the IPO with PMP or One-X, they'll keep on digging.

Best guess - Infected company computer.

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[raist3001]

In my Users list for One-X Portal I see the following I do not recognize:

csta_provider_user
dsml_ipo_provider_user
dsml_ldap_provider_user
indoda_user
inyama_user
izwi_user

Roles are set to APPLICATION, but their creation date says 12/3/12, which is when I set up all the actual users.

 

[AACon]

Those are one-x portal provider users.
Is your system connected directly to the WAN for something like management or SIP Trunks?

-Austin
ACE: Implement IP Office

 

[raist3001]

The IPO is connected to an internal network behind a firewall. There are no SIP trunks.

 

[AACon]

Is the one-x portal accessible from the outside? Someone may have logged into it. Passwords are usually easy to guess.

-Austin
ACE: Implement IP Office

 

[raist3001]

One-X is only accessible from the inside. I have changed all passwords at the moment.

 

[Gunnaro]

And that's why you should take a good look around on your computer side.
A firewall may be useless if an invite/backdoor is initiated from the inside

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[jhengel]

Could you explain the purpose of the 8N short code from your screen shot? Do you have a quad-zero route in the IP route tab? (0.0.0.0 0.0.0.0) with a gateway of your local firewall/router?

 

[AACon]

^I was curious about that as well, that's why I asked about the SIP Trunks.

-Austin
ACE: Implement IP Office

 

[raist3001]

The 8N shortcode was used at one time to press 8 to grab SIP trunks.

 

[raist3001]

And that's why you should take a good look around on your computer side.
A firewall may be useless if an invite/backdoor is initiated from the inside

We are looking into a network breach as we speak. Wouldn't I see an unrecognized user in 1-X?

 

[Gunnaro]

Not if they sniffed out the login/pwd. A simple key-logger is enough.

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[raist3001]

Not if they sniffed out the login/pwd. A simple key-logger is enough.

Hmmmm...no one on site has the username and Password to log into 1-X. As a matter of fact, there is only one Server that is used to log into 1-X by our staff. I would wager this server has been compromised.

 

[Gunnaro]

Well, then you have something meaningful to attend

I would put in barring on all country codes not used (who needs to call everyone?)
Middle east, Balkans, Africa...

Kind regards

Gunnar
______________________________________
Mille viae ducunt homines per saecula Romam

 

[raist3001]

Indeed I do Gunnaro

Thank you kindly to all who have offered their time here in this thread with their help. I am very grateful.