I-TELEX being hacked?

VK1DSH · #1

Hello Folk,

A couple of times recently my machine has started up and received a few characters, then nothing. However early this morning (around 4 am) there were multiple attempts and some text which indicates that someone is trying to access something at my end. They were quite persistent and tried 11 times over about 10 minutes. The biggest chunk of text that printed out is:

OPTIONS SIP: NM SIP/2.0
VIA: SIP/2.0/TCP NMBRANCH;FOO
FROM: (.SIP:NMNM.)TAG;ROOT
TO: (.SIP:NM2NM2.)
CALL-ID: 50000
CSEQ: 42 OPTIONS
MAX-FORWARD: 70
CONTENT-LENGTH: 0
CONTACT: (.SIP:NMNM.)
ACCEPT: APPLICATION/SDP

etc. further down there is what appears to be an IP address 223.75.123.71 and attempts to get information and maybe even download a file.

A bit digging reveals that SIP is the Session Initiation Protocol which is commonly used for internet telephony and some multimedia applications. The IP number above is pingable and is owned by China Mobile Communications Group in Wuhan. So it looks like someone in China is trying to access something through the open I-TELEX port.

- Are these access attempts a security issue for other computers on my home LAN or for the I-TELEX hardware at my station?

- Has anyone else experienced the same sort of thing?

- Any other advice or information I should be aware of?

Regards

Dale
I-TELEX: 570418

#2

Seems like someone tried to use the Open Port, found some Ping and tried to make free phonecalls....

#3

-First deactivate ASCII mode on the Ethernet card.
-Then delete your primariy number for incoming calls on the card.
-Let me know the internal extension number for your incoming calls.
I will put that number to the subscriber server.

Now, no annoying calls anymore, hopefully.