- VoiceOps - lists.voiceops.org

NOTICE: To all providers using the Grandstream HT502/HT503
by ryandelgrosso＠gmail.com Feb. 6, 2013

Feb. 6, 2013

All, Over the last few months we have uncovered a vulnerability in the HT502 that allows for theft of credentials from customer devices. I am sending this out since the issue has now been resolved in a new release of firmware BUT Grandstream have NOT sent out any kind of pro-active notifications nor included this fix in their release notes for this build. After conferring with some other sizable providers also using this device at scale, they were able to "connect the dots" on their up-tick in fraud based on our discovery. First some history: We currently have over 50,000 deployed HT502's in active customer service. Beginning in December we saw an immediate and sizable up-tick in fraud by easily an order of magnitude. Statistical analysis of the fraud showed the ONLY linking factor to be the fact that the compromised accounts were ALL using the HT502 device AND had WAN port access enabled to the device, and we as the provider were locked out (admin password changed, no longer provisioning from us on scheduled interval) After some digging and conferring with Grandstream technical gurus it was confirmed there was a buffer overflow vulnerability that would allow a remote attacker to change the admin password WITHOUT rebooting the device or otherwise having any administrative access to it. Once the password was changed the attacker could log in with the new password and complete control. On all versions prior to 1.0.5.10 the SIP credentials could be extracted from the admin website with the "Download config" option. On versions up to 1.0.8.4 the sip credentials were STILL extractable from the telnet interface if the provisioning values were known by the attacker. All of these vulnerabilities are fixed in version 1.0.9.1. I encourage you to test and deploy this version ASAP. I am sending this out in a purely advisory capacity in the hopes that education will prevent further monetary damages. Please feel free to contact me on or off list if you want to know more about this issue. -Ryan

2 2

SIP-to-TDM gateway appliance
by nathana＠fsr.com Feb. 6, 2013

Feb. 6, 2013

I know this has been a topic of conversation in the past, but things might have changed since the last discussion and I'm wondering what the market is currently like for such devices. We deliver voice strictly via SIP/RTP, but naturally there are some potential customers out there that still have an older, non-IP-aware PBX that they're not ready to throw out yet. What are the best and most cost-effective gateway options out there at this time? We are specifically looking for one that has a single T1 interface that can operate in either CAS or PRI modes. Special requirements: 1) We need to be able to do DID manipulation between T1 and SIP; I presume this is a rather standard feature in most gateways given that most SIP trunk providers will send at least 10-digit DNIS (in the INVITE and "To" fields) but DNIS on PRI is often only the last 3 or 4 digits of the TN. 2) There may be certain situation where we want to leave the PBX configuration as untouched/unchanged as possible (drop-in replacement service), and where there is no correllation between target DID and the telephone number (e.g., 212-555-1212 is called, PBX is sent 4001). We'd like a gateway where static mappings like that for DID manipulation are possible, rather than just a general rule that says "strip the first 6 digits off before sending to the PRI". 3) For outgoing calls, the device needs to put the calling DID (the desired Caller-ID/ANI) in the PAI header, and also needs to be able to be configured to override "From" with a static alphanumeric value (so "From" and PAI should not match; "From" will not contain the desired ANI). 4) In T1 CAS singalling modes such as E&M Wink where it is possible to transmit CLID and target DID information via DTMF to the PBX, different PBXes potentially have different formats that they want to see this information in; for example, a Nortel Norstar would expect to see *CALLERID*DNIS* (e.g., *2125550001*1212* where the caller is 212-555-0001 and the destination is 212-555-1212). Are there any gateways that support this? 5) It needs to have a T.38 gateway mode that can recognize a fax call, either send or accept a re-INVITE with a T.38 SDP as appropriate, and perform the "transcoding" from/to T.38 between the T1 channel and the RTP session. Just resorting to G.711 for fax passthrough is not desireable...any gateway can do that. 6) If in T1 CAS mode, and the PBX takes a channel "off-hook" to place an outbound call, the gateway should generate an audible dialtone. ...and, of course, it would be nice if we could find such a device < $1,000. :-P I know I could build one myself with a mini PC and a single-span T1 card that was running Asterisk 10 and easily hit that price point, but I'd rather find a supported, off-the-shelf solution to sell to our customers, if possible. There are the "usual suspects", of course: AdTran, MediaTrix, AudioCodes, and so forth. AdTran seems to get talked about a lot here. Let's say price was no object for a second. Does anyone know if there is a model amongst any of the ones these manufacturers produce that fulfills the above list of requirements? Does anybody have any experience with Digium's relatively new line of gateways (G100/G200)? I think it would support some of these scenarios (#1 and #3) but I'm not sure about the remaining ones. Unfortunately, although it most certainly runs on an Asterisk core, that core is only exposed to you through a clever but still-limited GUI; with direct access to the dialing plan (extensions.conf) I could accomplish all of these things myself. The price is certainly right, though. If only somebody made a reasonably-priced single-board-computer that ran raw, embedded Asterisk and had a single-span T1 interface on it. Oh wait, somebody does!: http://switchvoice.com/index.php?page=shop.product_details&flypage=flypage-… http://www.odints.com/pages/prod/completesolutions/alvis-pbx/alvisfs.htm Only problem is that the first company doesn't have a U.S. distributor, and the second doesn't have a distributor that sells in single-unit quantities. Would love to hear y'all's thoughts on this subject. Thanks, -- Nathan Anderson First Step Internet, LLC nathana at fsr.com

3 2

Old Morotola ATAs
by nathana＠fsr.com Feb. 4, 2013

Feb. 4, 2013

Does anybody out there either have/know a good source for old-stock Motorola ATAs (VT1000 series) at a reasonable price, or perhaps have a bunch that they want to get rid of? VT1003 or VT1005, new or used (as long as the used are in relatively good physical condition and in good working order), locked or unlocked, branded to Vonage/Speakeasy/whoever or unbranded...doesn't matter. If so, feel free to hit me off-list. Thanks! -- Nathan Anderson First Step Internet, LLC nathana at fsr.com

1 0

Problems with long connect times / PDD to "New Cingular Wireless PCS"
by d＠d-man.org Feb. 3, 2013

Feb. 3, 2013

Hi folks, We're seeing long long connect times across all our VoIP termination carriers when calling numbers whose LNP is coming back as New Cingular Wireless. Can't figure out a rhyme or reason. Anyone else have any suggestions on what to do here? At first we thought it was our upstream provider but we've been able to recreate this with about six different folks now. Thanks much, Darren

2 2

Broadworks on VMWare/Linux
by peeip989＠gmail.com Jan. 31, 2013

Jan. 31, 2013

Is anyone running production Broadworks on virtual (VMWare/Red Hat Linux) servers? Have you had any issues related to it being a virtual machine? I know it is now supported and we have tested in a lab environment without issue but have not yet clobbered it with any serious volumes of traffic and are curious if Broadworks behaves any differently on physical versus virtual servers. Any experience you can share is welcome. Thanks

5 4

Customer with offshore office - best practice?
by jay＠west.net Jan. 29, 2013

Jan. 29, 2013

On 1/29/13 12:19 PM, Shripal Daphtary wrote: > Jay, we do this today with an Edgemarc for local proxy for the phones > and an Adtran that terminates a PRI in the local country. when the > caller calls out to a local number, the calls trunk from the EM to the > adtran via dial plan and then exit the PRI. likewise in inbound. If > the caller calls internally they dial 3/4 digits and use dial plan for > group dialing. > > i'm busy at the moment,but i can give you a more detailed answer with > some config help later. > > just wanted to let you know it works :) Yes, in fact we have done something similar with just an Adtran TA900 (or similar 240-volt Adtran Netvanta - warning to others that the TA900 is 120 volts only - don't ask how we know). It indeed mostly works. The problem is that if the customer now wants to conference or transfer that call to someone on the hosted system they're stuck due to the local routing to the PRI. Basic calling works well but hosted features are a problem. "Please get Bob from next door on the phone and transfer him to me", as an example. All of the solutions we have come up with do date have some element of ugly-hackishness to them. That may be the nature of the beast, just wondering what others may have come up with that works. Alex, so far New Zealand and Ecuador are the countries of concern. I'm more interested in a solid technical solution that is scalable if one exists than dealing with individual national regulation yet. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

2 1

Customer with offshore office - best practice?
by jay＠west.net Jan. 29, 2013

Jan. 29, 2013

We are a US-based hosted VoIP provider, Broadsoft-based. We have a number of clients who are US-based but have one or more satellite offices outside of the country. These customers are looking for an integrated solution where the remote office(s) can be integrated into the hosted system with full features while maintaining local in-country functionality. We know we can use something like Voxbone in a number of cases to bring inbound calls local to the host country into the system. This allows local inbound calling but when our customer tries to call their neighbor it routes through the US, by default with a US dial plan and associated expense. We can also install a local IP-PBX with local lines and set up the phones with two line appearances. This allows local calls in both directions but features, voice mail, transfers, etc become messy. We have toyed with the idea of a reverse-ATA type of arrangement to bring two-way local calling back to the hosted system. In-country emergency calling (9-1-1 or local equivalent number) and local regulatory issues are of concern. Two phones on the desk is also messy and obviously won't allow transfer or conference, short of activating speakerphone on both. This actually works better than one might expect, believe it or not! All of the solutions so far seem to have elements of an ugly hack. Does anyone on the list have a more elegant solution? Is it something we need to figure out country-by-country? -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

1 0

Request for asterisk support
by shripald＠gmail.com Jan. 29, 2013

Jan. 29, 2013

Hello all, I'm looking for a company that can support and maintain a large asterisk (don't know the flavor of asterisk) in NYC. The only requirement is that it needs to be a company that specializes in asterisk as part of their product offerings, not a single consultant. If anyone has a recommendation in the NYC area please let me know. The site has two locations, one retail, one warehouse. Thanks in advance. Shri Sent from my mobile device.

1 0

the "microsoft scam calls". Do you have some statistics for us?
by sjur＠usken.no Jan. 28, 2013

Jan. 28, 2013

Hi, You are probably familiar with the Microsoft scam calls. I am part of the Honeynet Project and we are actively tracking these guys. If you have any information about it, please let me know. It would be great if you could give us some statistics on the following Number of calls with CallerID 3581256789999 (probably fake, but they use the same..) Approx number of numbers you have in your range (and geographical location) Number which answered and the length of the calls (if you can provide this as well) Here are some statistics about the MS scam calls so far from another provider: They had 10396 tries, where 9363 the phone rang (was online) in 7 days of those 5853 did not answer (called for 60 seconds) 3510 answered the call (approx 35% !!) 92% had less than 1 min call duration 96% had less than 2 min call duration 98% had less than 3 min call duration High talkers (seconds): 1127 1257 1406 1489 1620 2005 2473 2661 3661 3954 4296 5201 5813 6033 which means that probably 8-9 customers got frauded... in one week... -- Regards Sjur Eivind Usken +47 96999902

2 1

Issues with the "new" SPA1x2 models
by RDawson＠alliedtelecom.net Jan. 24, 2013

Jan. 24, 2013

Anyone having good luck with these? Anyone with a substantial number deployed. They seem to be very flaky . . . just want to see if that experience is unique. [Description: cid:image001.png at 01CC5068.C9623860] Robert Dawson Voice Systems Engineer (o) 202-349-0477 | (f) 202-541-9050 rdawson at alliedtelecom.net<mailto:rdawson at alliedtelecom.net> | www.alliedtelecom.net<http://www.alliedtelecom.net/> follow us: [Description: cid:image002.png at 01CC5068.C9623860] facebook<http://www.facebook.com/alliedtelecom> | [Description: cid:image003.png at 01CC5068.C9623860] LinkedIn<http://www.linkedin.com/company/allied-telecom-group> | [Description: cid:image004.png at 01CC5068.C9623860] twitter<http://twitter.com/#!/allied_telecom> 1120 20th Street, NW, Suite 500-South, Washington, DC 20036

5 8