Interesting ??

[AllenMiller]

FYI - I just thought this was a little interesting

Last night I happened be looking at the 3CX management console of my system and observed an outbound call take place at a time when I knew there was no one in the building that would be making such a call.  The call lasted a short amount of time and then I saw it happen a couple additional times, each time to the same destination telephone number which happened to be a local number.  I was concerned that I might have some security flaw.  I actually had enough time to start a Wireshark capture, however the wireshark only showed me this outgoing call - it didn't show anything close in time that might be related.  In my system I have several IP phones plus a group of legacy phones all connected in parallel with a grandstream HT287.  The originating extension for the mystery calls was this analog adapter.

Using the 3CX Call Reporter and generating a report for the latest month I saw that these calls had happened on other occasions.  Next I reran the report but started it at the first of the year and ended with the current date.  I saw that these calls have been going on for the entire year - and I'm guessing that they probably would have been found earlier if I looked.  While looking at the dates I saw a pattern.  These calls only happened on Friday evenings and pretty much during a single hour time slot.

I finally figured out what was going on.  This was not evidence of a security breach.  Our building has a security system that is connected to a monitoring service.  This system 'phones home' periodically to test itself with the monitoring service.  This system is connected the the group of analog phones that are all handled by this single analog adapter.  So it was caused by our security system - not a security breach.

Case closed.

Regards,

Allen