Sponsor: VoiceMeUp - Corporate & Wholesale VoIP Services

VoIP Mailing List Archives
Mailing list archives for the VoIP community
 SearchSearch 

[asterisk-users] Tricking asterisk to think the call has ended, but it was continuing on the other side


 
Post new topic   Reply to topic    VoIP Mailing List Archives Forum Index -> Asterisk Users
View previous topic :: View next topic  
Author Message
ldardini at gmail.com
Guest





PostPosted: Thu Sep 15, 2016 11:07 am    Post subject: [asterisk-users] Tricking asterisk to think the call has end Reply with quote

I am banging my head over a simple asterisk trick I was seeing on one asterisk server.

An extension dials an international premium number, the called number answers, then the extension hangups, but the call continue to run on the international number side, generating an high profit for the premium number company and a big loss for the asterisk owner.


I think some sort of "transfer" takes place, but I can't identify how they do it and most important, how to prevent it.


Here the relevant logs:


[2016-09-08 21:00:25] VERBOSE[18771][C-0000066c] pbx.c: Executing [0021628990XXX@dialoutbound:595] Dial("SIP/201-boxoffice-00000f66", "SIP/0021628990XXX@SBC002_VirginMedia,60,T") in new stack

[2016-09-08 21:00:25] VERBOSE[18771][C-0000066c] app_dial.c: Called SIP/0021628990XXX@SBC002_VirginMedia

[2016-09-08 21:00:27] VERBOSE[18771][C-0000066c] app_dial.c: SIP/SBC002_VirginMedia-00000f67 answered SIP/201-boxoffice-00000f66

[2016-09-08 21:00:27] VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:27] VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:28] VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:28] VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>



Any idea?


Leandro
Back to top
dovid at telecurve.com
Guest





PostPosted: Thu Sep 15, 2016 11:15 am    Post subject: [asterisk-users] Tricking asterisk to think the call has end Reply with quote

The best is to get a PCAP so you can see exactly what is going on. Look into voipmonitor.org or homersip to capture all of your traffic. There are many ways that people commit fraud. If you are thinking about transfers what they do is the call the fraudulent number then they send a 302  to another number so they are now calling twice and the call is not on your network. 

On Thu, Sep 15, 2016 at 12:06 PM, Leandro Dardini <ldardini@gmail.com (ldardini@gmail.com)> wrote:
Quote:
I am banging my head over a simple asterisk trick I was seeing on one asterisk server.

An extension dials an international premium number, the called number answers, then the extension hangups, but the call continue to run on the international number side, generating an high profit for the premium number company and a big loss for the asterisk owner.


I think some sort of "transfer" takes place, but I can't identify how they do it and most important, how to prevent it.


Here the relevant logs:


[2016-09-08 21:00:25] VERBOSE[18771][C-0000066c] pbx.c: Executing [0021628990XXX@dialoutbound:595] Dial("SIP/201-boxoffice-00000f66", "SIP/0021628990XXX@SBC002_VirginMedia,60,T") in new stack

[2016-09-08 21:00:25] VERBOSE[18771][C-0000066c] app_dial.c: Called SIP/0021628990XXX@SBC002_VirginMedia

[2016-09-08 21:00:27] VERBOSE[18771][C-0000066c] app_dial.c: SIP/SBC002_VirginMedia-00000f67 answered SIP/201-boxoffice-00000f66

[2016-09-08 21:00:27] VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:27] VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:28] VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
[2016-09-08 21:00:28] VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>



Any idea?


Leandro






--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

Join the Asterisk Community at the 13th AstriCon, September 27-29, 2016
      http://www.asterisk.org/community/astricon-user-conference

New to Asterisk? Start here:
      https://wiki.asterisk.org/wiki/display/AST/Getting+Started

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users
Back to top
ldardini at gmail.com
Guest





PostPosted: Thu Sep 15, 2016 2:22 pm    Post subject: [asterisk-users] Tricking asterisk to think the call has end Reply with quote

No, there is no Music On Hold starting and the bad thing is the call duration reported by asterisk was just few seconds while the call duration reported by the provider was few thousand seconds, the max allowed. So they will be able to terminate the call on the asterisk side and have it run on the provider side.

Leandro


2016-09-15 19:18 GMT+02:00 Max Grobecker <max.grobecker@ml.grobecker.info (max.grobecker@ml.grobecker.info)>:
Quote:
Maybe the client just put the call on hold.
So the call technically has not ended AND the client does not need to send or handle any RTP data.
Is there any mention of "music on hold" for this channel?

Greetings
 Max


----- Nachricht von Leandro Dardini <ldardini@gmail.com (ldardini@gmail.com)> ---------
     Datum: Thu, 15 Sep 2016 18:06:14 +0200
       Von: Leandro Dardini <ldardini@gmail.com (ldardini@gmail.com)>
Antwort an: Asterisk Users Mailing List - Non-Commercial Discussion <asterisk-users@lists.digium.com (asterisk-users@lists.digium.com)>
   Betreff: [asterisk-users] Tricking asterisk to think the call has ended, but it was continuing on the other side
        An: Asterisk Users Mailing List - Non-Commercial Discussion <asterisk-users@lists.digium.com (asterisk-users@lists.digium.com)>


Quote:
I am banging my head over a simple asterisk trick I was seeing on one
asterisk server.

An extension dials an international premium number, the called number
answers, then the extension hangups, but the call continue to run on the
international number side, generating an high profit for the premium number
company and a big loss for the asterisk owner.

I think some sort of "transfer" takes place, but I can't identify how they
do it and most important, how to prevent it.

----- Ende der Nachricht von Leandro Dardini <ldardini@gmail.com (ldardini@gmail.com)> -----



--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

Join the Asterisk Community at the 13th AstriCon, September 27-29, 2016
      http://www.asterisk.org/community/astricon-user-conference

New to Asterisk? Start here:
      https://wiki.asterisk.org/wiki/display/AST/Getting+Started

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users
Back to top
ldardini at gmail.com
Guest





PostPosted: Mon Sep 19, 2016 8:57 am    Post subject: [asterisk-users] Tricking asterisk to think the call has end Reply with quote

Unfortunately the only log messages regarding that channel are the "joined" and the "left" for both legs.

VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 joined 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
VERBOSE[18771][C-0000066c] bridge_channel.c: Channel SIP/201-boxoffice-00000f66 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>
VERBOSE[18779][C-0000066c] bridge_channel.c: Channel SIP/SBC002_VirginMedia-00000f67 left 'simple_bridge' basic-bridge <00bd58c3-3bce-4f1b-9d79-11eb96f37260>




2016-09-17 0:39 GMT+02:00 Max Grobecker <max.grobecker@ml.grobecker.info (max.grobecker@ml.grobecker.info)>:
Quote:
Hi,

OK, then it looks like the client transferred the call anywhere else.
Do you see an entry in your log that refers to the bridge ID 00bd58c3-3bce-4f1b-9d79-11eb96f37260 ?
If there was a transfer, the call *may* have been bridged with the transfer destination. Also, the destination might be external,
so you may see a second call starting at the time where the client left the bridge.

Max


--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

Join the Asterisk Community at the 13th AstriCon, September 27-29, 2016
      http://www.asterisk.org/community/astricon-user-conference

New to Asterisk? Start here:
      https://wiki.asterisk.org/wiki/display/AST/Getting+Started

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users
Back to top
Display posts from previous:   
Post new topic   Reply to topic    VoIP Mailing List Archives Forum Index -> Asterisk Users All times are GMT - 5 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © 2001, 2005 phpBB Group

VoiceMeUp - Corporate & Wholesale VoIP Services