I can try this tomorrow<br><div class="gmail_quote"><div dir="ltr">On Wed, Mar 1, 2017 at 1:06 AM Brian West <<a href="mailto:brian@freeswitch.org">brian@freeswitch.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="gmail_msg">I haven't seen it actually accomplish anything against my instances of FreeSWITCH, I just googled the string and its in the SQL Injection list, but what I'm wonder is if you're using PGSQL or MYSQL if that invite I put in my last message causes any issues.</div><div dir="ltr" class="gmail_msg"><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">/b</div><div class="gmail_msg"><br class="gmail_msg"></div></div><div class="gmail_extra gmail_msg"><br class="gmail_msg"><div class="gmail_quote gmail_msg">On Tue, Feb 28, 2017 at 6:01 PM, Russell Treleaven <span dir="ltr" class="gmail_msg"><<a href="mailto:rtreleaven@bunnykick.ca" class="gmail_msg" target="_blank">rtreleaven@bunnykick.ca</a>></span> wrote:<br class="gmail_msg"><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto" class="gmail_msg">I've been seeing for approximately a week.</div><div class="m_-229092966558873774HOEnZb gmail_msg"><div class="m_-229092966558873774h5 gmail_msg"><div class="gmail_extra gmail_msg"><br class="gmail_msg"><div class="gmail_quote gmail_msg">On Feb 28, 2017 6:59 PM, "Brian West" <<a href="mailto:brian@freeswitch.org" class="gmail_msg" target="_blank">brian@freeswitch.org</a>> wrote:<br type="attribution" class="gmail_msg"><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="gmail_msg">You can calm down, Do you have any proof you've been hacked? This appears to be an SQL Injection attempt, I started seeing this yesterday!<div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">Here is what I had in my logs and what the packet has in it:</div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><div class="gmail_msg">2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10</div><div class="gmail_msg">2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='<a href="mailto:x%27@190.102.98.246" class="gmail_msg" target="_blank">x'@190.102.98.246</a> [CS_NEW] [WRONG_CALL_STATE]</div><div class="gmail_msg">2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='<a href="mailto:x%27@190.102.98.246" class="gmail_msg" target="_blank">x'@190.102.98.246</a>) Ended</div><div class="gmail_msg">2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='<a href="mailto:x%27@190.102.98.246" class="gmail_msg" target="_blank">x'@190.102.98.246</a> [CS_DESTROY]</div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"> INVITE <a href="mailto:sip%3A1259360048825408632@190.102.98.246" class="gmail_msg" target="_blank">sip:1259360048825408632@190.102.98.246</a> SIP/2.0</div><div class="gmail_msg"> Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport</div><div class="gmail_msg"> Max-Forwards: 70</div><div class="gmail_msg"> Contact: <<a href="http://sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254" class="gmail_msg" target="_blank">sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254</a>>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>"</div><div class="gmail_msg"> To: <<a href="mailto:sip%3A1259360048825408632@190.102.98.246" class="gmail_msg" target="_blank">sip:1259360048825408632@190.102.98.246</a>></div><div class="gmail_msg"> From: <<a href="mailto:sip%3A%25e2%2580%2598hi%2527or%25e2%2580%2598x%25e2%2580%2599%253d%2527x%2527@190.102.98.246" class="gmail_msg" target="_blank">sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246</a>>;tag=UBAWADPX</div><div class="gmail_msg"> Call-ID: OIERRISLMMBKZCIIUGWESXQM</div><div class="gmail_msg"> CSeq: 1 INVITE</div><div class="gmail_msg"> Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO</div><div class="gmail_msg"> Content-Type: application/sdp</div><div class="gmail_msg"> Supported: replaces</div><div class="gmail_msg"> User-Agent: Cisco-SIPGateway/IOS-12.x</div><div class="gmail_msg"> Allow-Events: hold, talk, conference</div><div class="gmail_msg"> Content-Length: 0</div></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.</div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg">/b</div><div class="gmail_msg"><br class="gmail_msg"></div><div class="gmail_msg"><br class="gmail_msg"></div></div><div class="gmail_extra gmail_msg"><br class="gmail_msg"><div class="gmail_quote gmail_msg">On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <span dir="ltr" class="gmail_msg"><<a href="mailto:siju.irs@gmail.com" class="gmail_msg" target="_blank">siju.irs@gmail.com</a>></span> wrote:<br class="gmail_msg"><blockquote class="gmail_quote gmail_msg" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi team ,<br class="gmail_msg">
<br class="gmail_msg">
Please help on below query<br class="gmail_msg">
<br class="gmail_msg">
Sent from my iPhone<br class="gmail_msg">
<div class="gmail_msg"><div class="m_-229092966558873774m_-8684350194490835166m_954797812800596183h5 gmail_msg"><br class="gmail_msg">
> On 28-Feb-2017, at 3:59 PM, Siju Nair <<a href="mailto:siju.irs@gmail.com" class="gmail_msg" target="_blank">siju.irs@gmail.com</a>> wrote:<br class="gmail_msg">
><br class="gmail_msg">
> Hi Team<br class="gmail_msg">
><br class="gmail_msg">
> my account got hacked and attacked using my DID number as caller id and making calls via my FS server.<br class="gmail_msg">
><br class="gmail_msg">
> in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.<br class="gmail_msg">
><br class="gmail_msg">
> Thanks,<br class="gmail_msg">
> Siju Nair<br class="gmail_msg">
<br class="gmail_msg">
</div></div>_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
</blockquote></div><br class="gmail_msg"><br clear="all" class="gmail_msg"><div class="gmail_msg"><br class="gmail_msg"></div>-- <br class="gmail_msg"><div class="m_-229092966558873774m_-8684350194490835166m_954797812800596183gmail_signature gmail_msg" data-smartmail="gmail_signature"><div dir="ltr" class="gmail_msg"><div class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg">
<p class="gmail_msg"><font face="courier new, monospace" class="gmail_msg"><b class="gmail_msg"><i class="gmail_msg"><font size="4" class="gmail_msg">Brian West</font></i></b><br class="gmail_msg"><span style="font-size:x-small" class="gmail_msg"><a href="mailto:brian@freeswitch.org" class="gmail_msg" target="_blank">brian@freeswitch.org</a></span></font></p><p class="gmail_msg"><b style="font-family:monospace,monospace;font-size:small" class="gmail_msg"><i class="gmail_msg">Twitter: @FreeSWITCH , @briankwest</i></b></p><p class="gmail_msg"><font size="2" face="monospace, monospace" class="gmail_msg"><a href="http://www.freeswitchbook.com" class="gmail_msg" target="_blank">http://www.freeswitchbook.com</a> <br class="gmail_msg"><a href="http://www.freeswitchcookbook.com" class="gmail_msg" target="_blank">http://www.freeswitchcookbook.com</a><br class="gmail_msg"><br class="gmail_msg">Allison prompts for FreeSWITCH:</font></p><table cellspacing="0" cellpadding="0" style="font-size:12.8px" class="gmail_msg"><tbody class="gmail_msg"><tr class="gmail_msg"><td valign="baseline" class="gmail_msg"><p class="gmail_msg"><span class="gmail_msg"><a href="https://www.gofundme.com/allison-prompts-for-freeswitch" class="gmail_msg" target="_blank"><b class="gmail_msg">https://www.gofundme.com/allison-prompts-for-freeswitch</b></a></span></p></td></tr></tbody></table><table cellspacing="0" cellpadding="0" class="gmail_msg"><tbody class="gmail_msg">
</tbody>
</table><p class="gmail_msg"><span class="gmail_msg"><font face="monospace, monospace" size="2" class="gmail_msg">Wish to schedule a meeting?</font></span></p><p class="gmail_msg"><span class="gmail_msg"><a href="http://app.timebridge.com/#/meet/freeswitch" class="gmail_msg" target="_blank"><font face="monospace, monospace" size="2" class="gmail_msg">http://app.timebridge.com/#/meet/freeswitch</font></a></span></p><p class="gmail_msg"><font face="monospace, monospace" class="gmail_msg">Got Bugs? Report them <a href="https://freeswitch.org/jira" class="gmail_msg" target="_blank">here</a>! | Reddit: <a href="https://www.reddit.com/r/freeswitch" class="gmail_msg" target="_blank">/r/freeswitch</a></font></p>
<p class="gmail_msg"><font size="2" face="monospace, monospace" class="gmail_msg"><b class="gmail_msg">T:</b><a href="tel:(918)%20420-9001" value="+19184209001" class="gmail_msg" target="_blank">+19184209001</a> | <b class="gmail_msg">F:</b><a href="tel:(918)%20420-9002" value="+19184209002" class="gmail_msg" target="_blank">+19184209002</a> | <b class="gmail_msg">M:</b>+1918424WEST (9378)<br class="gmail_msg"><b class="gmail_msg">Skype:</b>briankwest</font></p></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br class="gmail_msg">_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg"></blockquote></div></div>
</div></div><br class="gmail_msg">_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg"></blockquote></div><br class="gmail_msg"><br clear="all" class="gmail_msg"><div class="gmail_msg"><br class="gmail_msg"></div>-- <br class="gmail_msg"><div class="m_-229092966558873774gmail_signature gmail_msg" data-smartmail="gmail_signature"><div dir="ltr" class="gmail_msg"><div class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg"><div dir="ltr" class="gmail_msg">
<p class="gmail_msg"><font face="courier new, monospace" class="gmail_msg"><b class="gmail_msg"><i class="gmail_msg"><font size="4" class="gmail_msg">Brian West</font></i></b><br class="gmail_msg"><span style="font-size:x-small" class="gmail_msg"><a href="mailto:brian@freeswitch.org" class="gmail_msg" target="_blank">brian@freeswitch.org</a></span></font></p><p class="gmail_msg"><b style="font-family:monospace,monospace;font-size:small" class="gmail_msg"><i class="gmail_msg">Twitter: @FreeSWITCH , @briankwest</i></b></p><p class="gmail_msg"><font size="2" face="monospace, monospace" class="gmail_msg"><a href="http://www.freeswitchbook.com" class="gmail_msg" target="_blank">http://www.freeswitchbook.com</a> <br class="gmail_msg"><a href="http://www.freeswitchcookbook.com" class="gmail_msg" target="_blank">http://www.freeswitchcookbook.com</a><br class="gmail_msg"><br class="gmail_msg">Allison prompts for FreeSWITCH:</font></p><table cellspacing="0" cellpadding="0" style="font-size:12.8px" class="gmail_msg"><tbody class="gmail_msg"><tr class="gmail_msg"><td valign="baseline" class="gmail_msg"><p class="gmail_msg"><span class="gmail_msg"><a href="https://www.gofundme.com/allison-prompts-for-freeswitch" class="gmail_msg" target="_blank"><b class="gmail_msg">https://www.gofundme.com/allison-prompts-for-freeswitch</b></a></span></p></td></tr></tbody></table><table cellspacing="0" cellpadding="0" class="gmail_msg"><tbody class="gmail_msg">
</tbody>
</table><p class="gmail_msg"><span class="gmail_msg"><font face="monospace, monospace" size="2" class="gmail_msg">Wish to schedule a meeting?</font></span></p><p class="gmail_msg"><span class="gmail_msg"><a href="http://app.timebridge.com/#/meet/freeswitch" class="gmail_msg" target="_blank"><font face="monospace, monospace" size="2" class="gmail_msg">http://app.timebridge.com/#/meet/freeswitch</font></a></span></p><p class="gmail_msg"><font face="monospace, monospace" class="gmail_msg">Got Bugs? Report them <a href="https://freeswitch.org/jira" class="gmail_msg" target="_blank">here</a>! | Reddit: <a href="https://www.reddit.com/r/freeswitch" class="gmail_msg" target="_blank">/r/freeswitch</a></font></p>
<p class="gmail_msg"><font size="2" face="monospace, monospace" class="gmail_msg"><b class="gmail_msg">T:</b>+19184209001 | <b class="gmail_msg">F:</b>+19184209002 | <b class="gmail_msg">M:</b>+1918424WEST (9378)<br class="gmail_msg"><b class="gmail_msg">Skype:</b>briankwest</font></p></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
_________________________________________________________________________<br class="gmail_msg">
Professional FreeSWITCH Consulting Services:<br class="gmail_msg">
<a href="mailto:consulting@freeswitch.org" class="gmail_msg" target="_blank">consulting@freeswitch.org</a><br class="gmail_msg">
<a href="http://www.freeswitchsolutions.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitchsolutions.com</a><br class="gmail_msg">
<br class="gmail_msg">
Official FreeSWITCH Sites<br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a><br class="gmail_msg">
<a href="http://confluence.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://confluence.freeswitch.org</a><br class="gmail_msg">
<a href="http://www.cluecon.com" rel="noreferrer" class="gmail_msg" target="_blank">http://www.cluecon.com</a><br class="gmail_msg">
<br class="gmail_msg">
FreeSWITCH-users mailing list<br class="gmail_msg">
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org" class="gmail_msg" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br class="gmail_msg">
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br class="gmail_msg">
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" rel="noreferrer" class="gmail_msg" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br class="gmail_msg">
<a href="http://www.freeswitch.org" rel="noreferrer" class="gmail_msg" target="_blank">http://www.freeswitch.org</a></blockquote></div>