Also make sure the phones dont have the default 456 password.? In some versions the sip credentials are not hashed out and in other versions even if it is hashed if you inspect the element you can see the pw. ________________________________ From: David Thompson <dthompson at esi-estech.com> To: PE <peeip989 at gmail.com>; voiceops at voiceops.org Sent: Friday, September 27, 2013 2:13 PM Subject: Re: [VoiceOps] Phone hack I have seen this before yes. Very low risk on Polycoms to my knowledge what they are attempting to do is see if this is an open or exploitable SIP proxy to commit toll fraud. Disable SIP ALG on the router and reboot the Polycoms if possible they are most likely getting port scanned and someone is seeing a device answering on 5060. If the SIP ALG cannot be disabled consider replacing the router with something that supports this functionality. Here is something that?s super useful in checking to see if something is there and answering to SIP requests. ? http://blog.sipvicious.org/ ? David Thompson Network Services Support Technician (O) 858.357.8794 (F) 858-225-1882 (E) dthompson at esi-estech.com (W)?www.esi-estech.com ? From:VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of PE Sent: Friday, September 27, 2013 10:46 AM To: voiceops at voiceops.org Subject: [VoiceOps] Phone hack ? Greetings! ? We have a customer whose users work from home over the local broadband carrier. They have 3 users who have complained of similar circumstances, where they are receiving multiple calls from caller ID such as "100(100)", "101(101)", ?and "1001(1001)". We show no record of these calls, either from CDR's, logs, or SIP captures, so it seems that there is an outside party sending SIP directly to the (Polycom) handsets. ? Anyone seen this? Any idea if there is a particular security hole being attempted? Assuming the users cannot control their broadband router, any suggestions on how to better lock this down? ? Thanks _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops