SL1100 Hacked - perhaps my fault but like more info

[Bignose_2]

Hi,

Got hacked the last 2 nights & lost £91 (thankfully no more, my account top's up & stopped after 3 quick £20's, not sure why but pleased)

Sipgate Trunk but don't think their fault but not 100% sure

First night got email from sipgate - call blocked to high value overseas. no lost money.

I was actually locked out of the pbx (unless in my panic somehow got the pw wrong but 99% sure did not)
I use PC Pro but web is enabled, I will look into see if can turn this off.
Factory reset, uploaded saved config.

I realised I have been testing a new router and left the IP port fully open just that 1 night. Actually, stupidly did not worry as this router does not have SIP ALG and I CANNOT call out anyway so figured OK. Was going to lock once got working or knew not helping.

Closed port, change SL1100 log in PW but NOT the profile sipgate PW credentials!!
2nd night
£91 taken. this time hundreds of low value calls to Egypt & other places, even locally to the UK 0116-4400011, so guess not picked up by sipgate.
In a matter of seconds I think a few thousand calls, how does that work!

What I am trying to work out is what happened & how can I stop it.
Did they just steal the credentials and use elsewhere or perhaps that night try & fail but keep the login info.
2nd night use on a different system or access the pbx again. I was NOT locked out this time.

If used the pbx again my concern is how do they get past firewall & NAT. Port was definitely shut this time. I do not have any port forwarding as seems to work without & thought if not set up is more secure without PF.

I guess hackers are pretty good at what they do but I could not see the admin password on 90-02, only the Dots have to re-type over.
I think can assume they can get past those hidden PW's in the config & but surprised at the ease can access the pbx at all with a different login, to be honest only had a 4 digit code (though random - was still "tech" user!!), guess a brute force attack would take seconds if the system allows rapid incorrect attempts.

Still surprised just in just 1 night they found the open port on the pbx & got past the password, time to open 10-36 the authentication pw (also hidden).

I hope with 10-36 changed & no ports open should be secure & guess as not many mentioned on here the NEC generally OK.

What is annoying most of the calls were made on a 2nd Sipgate trunk (On the same account) which I do not use & does NOT have a number assigned. I would have thought this would have failed anyway if no number assigned.

Also disappointed Sipgate did not detect this very off behaviour, hundreds of call to the same number, I think about 80 or more a second?
I cannot think of any of this being considered normal behaviour.

Still waiting to migrate my main ISDN account & huge relief I did not as can disconnect from LAN completely when worried.

I read a lot where people say set it up to prevent certain call etc but if they can actually access the pbx they can turn off any barring anyway

Also if they can get past the main login means only NAT protecting and whilst I think pretty secure I do not think this is its purpose & to be 100% relied upon. unless my "tech" & only 4 digit pw simply made it too easy.

Any advise on what you think happened & how to protect or should I be OK now.
Any pw's & code now are full length & have others characters where allowed.

(never used or set up voicemail, no inmail software or licence, do I need to do anymore, could someone turn on something, have 2 mlt, one on voip)

 

[belevedere]

If you have allowed log in through the internet/router, change the default ports 80 and 8000. Set up a firewall to allow only the ports you want to get through to the system.
Change the default password and log in. There is a hidden manufacturer password and log in, so if they know it and you left the ports at default, they can get in. If you change the ports, then remember that when you log in locally.
Usually they get in through the InMail, however you don't have one, so it's through the log ins or the SIP trunk provider. If you have an Inmail, then delete all unused mail boxes, and require passwords for those that use it. In the US, software version 7.15 will not allow remoter log in without a password.

 

[Bignose_2]

Hi,

Many thanks for that information,

I don't need or want programming from the internet/router, just locally but was not sure If I could do that.
I can/will change the ports but could I also remove two? Anyway to have purely local?

If I remove both 90-54-01 & 90-54-03 i.e. delete so blank, will that prevent DIRECT internet access or will leaving 90-54-02 still allow this (I will change the port anyway)

90-54

90-54-01 80 - remove?
90-54-02 8000
90-54-03 443 https - remove ?

If only 90-54-02 8000 (or whatever) enabled & needing to use PCPro I imagine much harder for a bot to keep trying or is that wrong assumption.

I did have a different pass code (NOT default 12345678) so was alarmed they got round that, perhaps they did have the installer one!
7.01 firmware

Thanks again.

 

[belevedere]

If you remove the port you will not be able to log in at all. Just change them to a non typical port number.

 

[Bignose_2]

Thanks again,

I had already removed ports 80 & 443 but left the PcPro port but changed from the 8000.

This allows PCPro access as long as I change the port number each time I try to connect & all OK

and as far as I can tell now does not allow web pro access, "this site cannot be reached"
so does look like removed one way to log in, it might be hackers can still rapidly access the PcPro port but do wonder if they would have targeted web prob ones more, just a guess.


Just for ref also Sipgate (uk) were very helpful, even though unlikely to be their fault, good will gesture of refund half the lost money.
Also quite reassuring that it was their systems that automatically blocked the credits, if more that 3 in unusually quick succession it locks the account.
Whilst I would have much preferred that it detected 100 calls to the same number within a few seconds & stopped them, at least worst case can only loose max £80. A reason to keep the credit setup to a minimum. I think it can be £120 a time so £360 & and other credit gone in seconds.