Suspicious outbound call initiated somehow

[Voiponaught2024]

We have noticed a strange/suspicious activity from a VVX 400 phone (on a public network) running latest firmwaver version 5.9.8.5760.

There are several  outbound international calls that seem to be initiated from the phone (with noone actually dialing/pressing any button or being even near the phone) going towards our SBC/PBX.

We do have in the config ghost call prevention parameters:

Spoiler

<voIpProt.SIP.requestValidation voIpProt.SIP.requestValidation.1.method="source" voIpProt.SIP.requestValidation.1.request="INVITE" />

Note  we haven't added the other parameter

voIpProt.SIP.strictUserValidation="1"

Thus we don't see incoming sipvicious calls on that phone (log show one of such inbound calls blocked with 400 Bad Request, as expected)

I've checked logs on our PBX (Broadsoft), calls are not initiated by some call forwarding or other features. Unfortunately   

it's the first time I've seen outbound INVITE with no clear reason to initiate.

Logs form the phone show

Spoiler

URL call. Dialed String (phone's WAN IP)
[CInvite]: szDest - sip:00...@WANIP
...

app1 |2|00|[AppCallC::Call] desType[1] Des=[sip:00...@WANIP] Display=[sip:00@WANIP], DialPlan=0, dialSource=12

I've also noticed REFER messages from public that seem to be applying forwarding

REFER sip:00..@WANIP or REFER sip:011...@WANIP

Do you have any suggestion how that outbound  URL call could have been initiated? Perhaps some other sipvicious tool?

And how could we prevent those calls?

Thank you!

[M_Salman]

HI @Voiponaught2024 , Welcome to Poly HP Support Community.
 

It looks like this may need direct support from our technical team. I encourage you to contact HP Support, where our engineers can take a closer look and help sort it out. You’ll find the contact link below.
https://support.hp.com/us-en/poly
 

If you would like to thank us for our efforts to help you, go to the public post and give us a virtual high-five by clicking on "Yes" for the question "Was this reply helpful?" below my message, followed by clicking on the "Accept as solution" on my public post.

Regards,

Salman

[Voiponaught2024]

Thank you for quick response!

I will try to open the ticket, however if it's a known issue/vulnerability for VVX phones, community would benefit from knowing about it and a solution.

[SteffenBaierUK]

Hello @Voiponaught2024 ,

Welcome back to the HP Poly community.

I doubt you will receive support on a VVX 400 as it is end of sales and end of support.

The VoIP FAQ has:

Oct 24 2014 Question: How can I prevent Ghost calls or tools like sipvicious or nuisance Cisco calls ringing my phone?

Resolution: Please check => here <= or Security Center: Security Bulletin Relating to Worldwide Botnet Dialing H.323-Capable Systems

Best Regards

Steffen Baier

[Voiponaught2024]

Hi, Steffen!

Thank you for response! I've read the article about inbound sipvicious/ghost calls (and we have one of the parameters that actually prevent inbound calls), the challenge/confusion is outbound calls somehow initiated by this phone (it's actually VVX401 which is newer, also another phone on similar public connection has experienced similar bahaviour at the same time). I'm wondering if you have experience anything like outbound ghost calls from a VVX (or a newer) phone?

The 2nd article is helpful for general knowledge, but seems to be about H323.