There are some new scripts out in the wild that are attacking Asterisk-based systems. These scripts attempt to authenticate to your SIP extensions. If you have configured your extensions with the secret being the same as the extension number and you have SIP or IAX2 exposed to the internet, then your system is vulnerable.
What happens is that the scripts connect and find extensions that they can log in as, then calls start getting made through your system. This can seriously rack up your phone charges.
Although we have not seen this with IAX2 extensions, its just a matter of time before the hackers start going after that as well.
It is mandatory that everyone go through their extensions immediately and make sure you change your secrets from being the same as the extensions to preferably some strong password.
Member Since:
2006-05-31