QUESTION Phone ringing-has phone/router been hacked?

[rchalk]

I have a couple of phones connected to a remote PBX, via a Netgear NightHawk router at home. One of the phones keeps ringing, with the inbound appearing to be the extension number of that particular phone. My first thought was that someone had gained access to the PBX, but there is nothing in the logs corresponding to these calls. I then tried shutting down the PBX, and the calls kept coming, which leads me to believe that someone has found a way to connect backwards through the router, and directly into the phone.

If I pick up the phone and listen, I hear a faint beep, about every 15-20 seconds, but no other sounds.

This is annoying, even though I doubt there is any actual risk. Does anyone have any idea how to deal with this?

Thanks

 

[billsimon]

Netgear NightHawk router

This router is probably improperly letting SIP traffic from around the internet back to your phone, allowing SIP scanners to send invites and make your phone ring.

https://wiki.voip.ms/article/Sip_Scanner_Ghost_Calls has some ideas.

 

[phinphan]

I had this problem and could never figure out why. No phone logs, no actual calls. Sometimes each line would ring at the same time. I was able to stop it by changing each phone from port 5060 to another port.

 

[atsak]

Not hacked per se but someone is trying. Most phones have a setting to disable IP calling or perhaps only accept calls from registered servers (Obi calls it something like this) - toggle those settings on the phone. Or disable uPNP.

 

[krzykat]

I'd almost guarantee @atsak is correct. Both his recommendations should be followed - disable IP calling and if an option, allow from registered only.

 

[Tidder]

Had the same issue with a remote user's home office. As @atsak suggested, Disabling uPNP was the ticket for me.