Question on call log and possible security breach

Asterisk Asterisk General
1

Noob with Asterisk 1.2 and freepbx. I started receiving a rash of calls with no caller ID and no response from the other end when I picked up. After I hang up, they immediately dialed back 30 or 40 times. I checked the Freepbx call log and in one one line there is what appears to be an attempt to dial out to an international number (Malaysia). See the snipit below (notice the third line):

I’m mainly trying to understand the call log. So help with any of the following questions would be appreciated:

  1. If there is a phone number in the “Dst” column, does that absolutely mean that the caller was able to get a dial tone and asterisk initiated an outgoing call?
  2. If yes to question #1, how was he able to get a dial tone when I don’t have DISA enabled?
  3. If no to question #1, what other circumstances allow the number to be recorded in the call log? In other words, is it possible for the call log to record numbers pressed in certain circumstances even if there was no dial tone and outgoing channel available?
  4. Even if he guessed my voicemail password and gained access to voicemail admin, there is no option to obtain an outgoing line as far as I can tell - is this correct?

Help with any of the above or other insight on potential paths for security problems would be helpful. Thanks in advance.

2

Few things.

If you are not accepting incoming calls from unknown IP’s (Non Peers) turn off guest access.
allowguest=no in sip.conf

If you need to allow unknown IP’s, make sure the context specified in the [general] section does not allow external calls either directly, or indirectly through includes. If it does, you are in for some toll fraud.

Here are the rejection notices I see when someone tries to use my server to call a destination not located locally:

[Jun 19 21:50:41] NOTICE[3601] chan_sip.c: Call from '' to extension '011448458680736' rejected because extension not found. [Jun 19 21:51:52] NOTICE[3601] chan_sip.c: Call from '' to extension '00448458680736' rejected because extension not found. [Jun 19 21:53:02] NOTICE[3601] chan_sip.c: Call from '' to extension '900448458680736' rejected because extension not found. [Jun 19 21:54:13] NOTICE[3601] chan_sip.c: Call from '' to extension '9011448458680736' rejected because extension not found. [Jun 19 21:55:24] NOTICE[3601] chan_sip.c: Call from '' to extension '448458680736' rejected because extension not found.