I've been seeing for approximately a week.

On Feb 28, 2017 6:59 PM, "Brian West" <brian@freeswitch.org> wrote:

You can calm down, Do you have any proof you've been hacked?  This appears to be an SQL Injection attempt, I started seeing this yesterday!

Here is what I had in my logs and what the packet has in it:

2017-02-27 18:40:20.451831 [WARNING] switch_core_state_machine.c:687 a7c86b62-4dbf-4609-8bc2-3b6a38e2686a sofia/internal/‘hi'or‘x’='x'@190.10

2.98.246 Abandoned2017-02-27 18:40:20.451831 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_NEW] [WRONG_CALL_STATE]

2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1730 Session 2 (sofia/internal/‘hi'or‘x’='x'@190.102.98.246) Ended

2017-02-27 18:40:20.451831 [NOTICE] switch_core_session.c:1734 Close Channel sofia/internal/‘hi'or‘x’='x'@190.102.98.246 [CS_DESTROY]

   INVITE sip:1259360048825408632@190.102.98.246 SIP/2.0

   Via: SIP/2.0/UDP 62.210.245.31:41254;branch=z9hG4bK-524287-1---321bda12cf15b137;rport

   Max-Forwards: 70

   Contact: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@62.210.245.31:41254>;+sip.instance="<urn:uuid:4c5f3dc8-9f8a-4470-9b43-bd04fcd1634d>"

   To: <sip:1259360048825408632@190.102.98.246>

   From: <sip:%e2%80%98hi%27or%e2%80%98x%e2%80%99%3d%27x%27@190.102.98.246>;tag=UBAWADPX

   Call-ID: OIERRISLMMBKZCIIUGWESXQM

   CSeq: 1 INVITE

   Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, REGISTER, SUBSCRIBE, INFO

   Content-Type: application/sdp

   Supported: replaces

   User-Agent: Cisco-SIPGateway/IOS-12.x

   Allow-Events: hold, talk, conference

   Content-Length: 0

I would like to dive deeper and see if anyone else has seen this, I had also seen it today in the FreeSWITCH hipchat channel.

/b

On Tue, Feb 28, 2017 at 2:38 PM, Siju Nair <siju.irs@gmail.com> wrote:

Hi team ,

Please help on below query

Sent from my iPhone

> On 28-Feb-2017, at 3:59 PM, Siju Nair <siju.irs@gmail.com> wrote:
>
> Hi Team
>
> my account got hacked and attacked using my DID number as caller id and making calls via my FS server.
>
> in logs i could notice this sofia/external/'hi'or'x'='x' ... what does this mean and how can they set my did as caller id and make calls... Urgent help needed.
>
> Thanks,
> Siju Nair

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

--

Brian West
brian@freeswitch.org

Twitter: @FreeSWITCH , @briankwest

http://www.freeswitchbook.com 
http://www.freeswitchcookbook.com

Allison prompts for FreeSWITCH:

https://www.gofundme.com/allison-prompts-for-freeswitch

Wish to schedule a meeting?

http://app.timebridge.com/#/meet/freeswitch

Got Bugs? Report them here! | Reddit: /r/freeswitch

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378)
Skype:briankwest

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org