[Freeswitch-users] spa8000 hack

[Gabe Shepard]

I don't see the full syslog here, but check to see if there's a call
forward number set in the SPA8000?  We recently saw an instance where
someone set a call forward on an SPA3102, dialed into the 3102 via a
different number, and then it was forwarded back out.

-Gabe


On Mon, Sep 30, 2013 at 1:18 AM, fs <fs at voice2net.ca> wrote:

> I do not know if anyone has seen this.  I use spa8000 ata's to provide sip
> trunking to a freeswitch an onwards.  Over the past three days I have had
> someone hacking into the spa8000 and relaying international calls back out.
> I have no ideal how they do it and cannot find any info in the traces that
> indicates where the call came from.  I have seen a note on cisco's web site
> about someone else complaining about this but no resolution.
>
> My syslog from the spa8000 starts like so.
>
> Syslog LOCAL2.DEBUG: M0: Calling:01137744616847 at sample.switch.ca:0\n
> Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n
> Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n
> Syslog INVITE sip:01137744616847 at sample.switch.ca SIP/2.0 {etc}
>
> Any thoughts or ideas would be REALLY appreciated.
>
> Darcy Primrose
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130930/dea41a35/attachment.html