CS1K Hacking !!

[Kotar0]

Hi,
I was just cheking calls for debuging when i saw that !
Is there is any way to stop that ?
It's checking all the route..
it's weird..usually there is a caller, but here no...

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:30:11
CALLED #:3727117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:30:11
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:30:33
CALLED #:3827117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:30:33
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:30:57
CALLED #:3927117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:30:57
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:31:21
CALLED #:4027117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:31:21
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:31:45
CALLED #:4127117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:31:45
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:32:07
CALLED #:4227117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:32:07
CAUSE :UNASSIGNED NUMBER
DIAG: 171

DCH 0 IMSG SETUP REF 00008181 CH 248 0 0 30 TOD 14:32:31
CALLED #:4327117149111 NUM PLAN: NUM UNKNOWN/UNKNOWN (UNKNOWN)

DCH 0 OMSG REL COMP REF 00008181 CH 248 0 0 30 TOD 14:32:31
CAUSE :UNASSIGNED NUMBER
DIAG: 171

 

[bignose21]

Where are the calls originating from if there is no Caller information then it won't display it. All the incomming calls above are on the same channel 248 0 0 30 (not all of the route), and all of them reporting Unassigned number. What sort of route is it TIE DID? How are you dealing with the incoming calls (or not dealing at the moment)?

 

[bignose21]

Also opening a post of "CS1k Hacking" is not going to get many people looking at this because it would look like some one trying to ask a question on how to Hack CS1ks which nobody will answer.

Would suggest a subject like "help with DCH traces" or "Problem with incoming calls"

 

[Tman45]

Personally I like the title but bignose21 probably has a point

I would call my carrier immediately and see if they have any originating number info based on your times your CS1k provided to you. They may be able to 'block' them and if not then you can open a case with your local law enforcement and then the carrier will be forced to block it The problem is that the 'hacker' is likely using a program and they will just manipulate their CLID to something else and you will have to keep blocking - someone needs to figure out a way to prevent it for good

 

[Kotar0]

Thanx for you help. but We decieded to stop it. And put a firewall.


It's a virtual route. trought a SIp trunk.

 

[Arriero]

If it is a SIP Trunk you can do a SIPCallTrace in the Signalling Server and you will have some more info on that call.

 

[Kotar0]

the Channel 248 0 0 30 is a H323 route.

The call is coming form it and try to find the numebring plan checking all numbers.

on the AC1 en AC2 is 9 and 0. so each time there is a 0 or 9 it's trying to call out side. through the SIP trunk.

I will have more detail. a specialist is working on it.