Crypto Hacking Attempts going on now!!

B

bdmonsey

Member
Jul 23, 2019
157
7
18
45
I know I am not the only one suffering from this now, being that I spoke to 3 ppl that work in the VOIP industry,

What happens is that somehow the hackers thru brute force install a script on your vvoip server coming in thru port 5060 and it starts running cryptomining software (I hope I am repeating it correctly, Just copying Claude's report) the server ends up crashing being that these services use up all your CPU usage.

If anyone else is effected by this, and has found a cure to this issue, please post here.
 
We have had this as well , although I don’t think it’s 5060 it’s the web server as these crypto miners run under www-data , I have been unable to stop them so far we have lost 8 systems so far
 
They are likely sending an api chat command, you will see something like this api+system SIP Message. Do this:

Disabling SIP chat on every profile with enable-chat=false and setting auth-messages=true. Disabling chat was the main mitigation for the observed SIP MESSAGE attack.

I made that change after restoring a backup and I see them trying to attack again every night unsuccessfully. If you run freeswitch 1.10.7 or later you are safe.
 
How do I disable the chat exactly m8 ? Where do I change that ?
My main server is on 1.10.11 are those options not there any more ?
 
Here is output from chatGPT, it's the same instruction set I followed and it worked great:

This is the procedure for your FusionPBX installation. We already applied and verified it on your recovered production server.
  1. Back up the configuration.
    Have a current database backup or recovery snapshot before changing settings.
  2. Open Advanced → SIP Profiles.
    Edit every profile, including internal, external, internal-ipv6, external-ipv6, and any custom profiles. FusionPBX documentation
  3. Add or update these two settings in each profile.
    SettingValueEnabled
    enable-chatfalsetrue
    auth-messagestruetrue
    Both setting rows must be enabled. The value false disables chat. Leave the SIP profile itself enabled, and edit existing entries rather than creating duplicates.
    auth-messages=true also addresses the older unauthenticated messaging default. FreeSWITCH advisory
  4. Save every profile.
    Make these changes through FusionPBX so they are stored in its database.
  5. Refresh the cached configuration and restart FreeSWITCH during a maintenance window.
    Restarting interrupts active calls.     On your installation, we confirmed file caching under /var/cache/fusionpbx. This command preserves the existing Sofia cache files before restarting:
    Code: 
    sudo bash <<'SH'
set -eu
chat_cache_backup=$(mktemp -d /root/fusionpbx-sofia-cache-before-chat.XXXXXX)
printf 'Cache backup: %s\n' "$chat_cache_backup"

find /var/cache/fusionpbx -maxdepth 1 -type f \
  -name 'configuration.sofia.conf.*' \
  -exec mv -t "$chat_cache_backup" -- {} +

systemctl restart freeswitch
systemctl is-active freeswitch
SH
  6. Verify the configuration after the restart.
    This command reads the generated configuration and prints only the two relevant settings:
    Code: 
    fs_cli -H 127.0.0.1 -x \
  'xml_locate configuration configuration name sofia.conf' |
python3 -c '
import sys
import xml.etree.ElementTree as ET

try:
    root = ET.fromstring(sys.stdin.read())
except ET.ParseError:
    sys.exit("Invalid XML: settings not verified.")

profiles = list(root.iter("profile"))
if not profiles:
    sys.exit("No profiles returned: settings not verified.")

for profile in profiles:
    for name in ("enable-chat", "auth-messages"):
        values = [
            p.get("value", "")
            for p in profile.findall("./settings/param")
            if p.get("name") == name
        ]
        print("%s | %s = %s" % (
            profile.get("name", "?"), name,
            ", ".join(values) if values else "NOT PRESENT"
        ))
' | cat -v
    Every profile should show exactly one enable-chat = false and one auth-messages = true. Missing or conflicting values need correcting.
  7. Confirm phones reconnect and test calls and BLFs.
    Test an inbound call, an outbound call, two-way audio and a BLF lamp. SIP instant messaging will be disabled.
This mitigates the observed SIP MESSAGE attack path; it does not replace upgrading the old FreeSWITCH software.
 
Ok .l, that’s amazing so I only need to fix 5 servers then and I can take time and upgrade the rest to latest fusionpbx , what a bunch of hits hackers are
 
  • Like
Reactions: gflow
You must log in or register to reply here.
Top Bottom