Somebody hacked asterisk, please help


#1

Somebody hacked me with the way below. Caller makes call with channel A, then hold it or conference, ( I don’t know ), then wait channel B to be created and end channel A and at the same time get the channel B and put echo test on it which he got 20 minutes call. However asterisk only got one call record from channel A to channel B which only lasts 2 seconds. the 20 minutes call is not billed at all. I lost money because of this. Is it because direct media = yes ? How can I stop it completely ? People can use this way to get call without being billed. please help. Asterisk 1.6.20. 1.1.1.1 is hacker’s IP and 2.2.2.2 is carrier’s IP. Michael

[Oct 14 03:01:00] VERBOSE[21505] pbx.c: – Executing [23222280461@a2billing:1] AGI(“SIP/1122334455-0000051e”, “a2billing.php”) in new stack
[Oct 14 03:01:00] VERBOSE[21505] res_agi.c: – Launched AGI Script /var/lib/asterisk/agi-bin/a2billing.php
[Oct 14 03:01:00] VERBOSE[21505] res_agi.c: – AGI Script Executing Application: (DIAL) Options: (SIP/MyTrunk/23222280461,60,HRL(487000:61000:30000))
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: – Limit Data for this call:
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > timelimit = 487000
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > play_warning = 61000
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > play_to_caller = yes
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > play_to_callee = no
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > warning_freq = 30000
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > start_sound =
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > warning_sound = timeleft
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: > end_sound =
[Oct 14 03:01:00] VERBOSE[21505] netsock.c: == Using SIP RTP CoS mark 5
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: – Called MyTrunk/23222280461
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: – SIP/1122334455-0000051e requested special control 16, passing it to SIP/MyTrunk-0000051f
[Oct 14 03:01:00] VERBOSE[21505] channel.c: – Music class default requested but no musiconhold loaded.
[Oct 14 03:01:00] VERBOSE[21505] app_dial.c: – SIP/1122334455-0000051e requested special control 20, passing it to SIP/MyTrunk-0000051f
[Oct 14 03:01:01] VERBOSE[21505] app_dial.c: – SIP/MyTrunk-0000051f answered SIP/1122334455-0000051e
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:1] NoOp(“SIP/1122334455-0000051e”, ““extended CDR””) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:2] Set(“SIP/1122334455-0000051e”, “CDR(hangupcause)=16”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:3] Set(“SIP/1122334455-0000051e”, “CDR(peerip)=1.1.1.1”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:4] Set(“SIP/1122334455-0000051e”, “CDR(recvip)=1.1.1.1”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:5] Set(“SIP/1122334455-0000051e”, “CDR(from)=sip:1122334455@xxx.sip.com”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:6] Set(“SIP/1122334455-0000051e”, “CDR(uri)=sip:1122334455@1.1.1.1:26976”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:7] Set(“SIP/1122334455-0000051e”, “CDR(useragent)=eyeBeam release 1100l stamp 46320”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:8] Set(“SIP/1122334455-0000051e”, “CDR(codec1)=ulaw”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:9] Set(“SIP/1122334455-0000051e”, “CDR(codec2)=ulaw”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:10] Set(“SIP/1122334455-0000051e”, “CDR(llp)=0”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:11] Set(“SIP/1122334455-0000051e”, “CDR(rlp)=5730650”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:12] Set(“SIP/1122334455-0000051e”, “CDR(ljitt)=3”) in new stack
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: – Executing [h@a2billing:13] Set(“SIP/1122334455-0000051e”, “CDR(rjitt)=16961196”) in new stack
[Oct 14 03:01:02] VERBOSE[21512] pbx.c: – Executing [*5@a2billing:1] Answer(“SIP/MyTrunk-0000051f”, “1”) in new stack
[Oct 14 03:01:02] VERBOSE[21512] pbx.c: – Executing [*5@a2billing:2] Playback(“SIP/MyTrunk-0000051f”, “demo-echotest”) in new stack
[Oct 14 03:01:02] VERBOSE[21512] file.c: – <SIP/MyTrunk-0000051f> Playing ‘demo-echotest.slin’ (language ‘en’)
[Oct 14 03:01:02] VERBOSE[21505] res_agi.c: – <SIP/1122334455-0000051e>AGI Script a2billing.php completed, returning 4
[Oct 14 03:01:02] VERBOSE[21505] pbx.c: == Spawn extension (a2billing, 23222280461, 1) exited non-zero on ‘SIP/1122334455-0000051e’
[Oct 14 03:01:21] VERBOSE[21512] pbx.c: – Executing [*5@a2billing:3] Echo(“SIP/MyTrunk-0000051f”, “”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: == Spawn extension (a2billing, *5, 3) exited non-zero on ‘SIP/MyTrunk-0000051f’
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:1] NoOp(“SIP/MyTrunk-0000051f”, ““extended CDR””) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:2] Set(“SIP/MyTrunk-0000051f”, “CDR(hangupcause)=0”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:3] Set(“SIP/MyTrunk-0000051f”, “CDR(peerip)=2.2.2.2”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:4] Set(“SIP/MyTrunk-0000051f”, “CDR(recvip)=2.2.2.2”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:5] Set(“SIP/MyTrunk-0000051f”, “CDR(from)=”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:6] Set(“SIP/MyTrunk-0000051f”, “CDR(uri)=sip:23222280461@2.2.2.2:5060”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:7] Set(“SIP/MyTrunk-0000051f”, “CDR(useragent)=Cisco-SIPGateway/IOS-12.x”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:8] Set(“SIP/MyTrunk-0000051f”, “CDR(codec1)=g729”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:9] Set(“SIP/MyTrunk-0000051f”, “CDR(codec2)=g729”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:10] Set(“SIP/MyTrunk-0000051f”, “CDR(llp)=0”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:11] Set(“SIP/MyTrunk-0000051f”, “CDR(rlp)=0”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:12] Set(“SIP/MyTrunk-0000051f”, “CDR(ljitt)=3”) in new stack
[Oct 14 03:19:49] VERBOSE[21512] pbx.c: – Executing [h@a2billing:13] Set(“SIP/MyTrunk-0000051f”, “CDR(rjitt)=3”) in new stack


#2

CDRs cannot cope with complex cases well, you need to use channel even logging (new in 1.8 ).


#3

David. thanks for your reply. CEL should improve the situation. I installed 1.8 with CEL enabled and billing is basically based on AGI dial and get answertime from AGI. Does billing need to be changed to catch more events from CEL or no need to change anything from 1.6 to 1.8 ?