We then noticed that old RPM versions of the software in Issabel repositories were installed with insecure/default credentials. This does not happen if installing according to the installation guide using the command line install scripts instead of yum/rpm, as the command line installation prompts for the administrator password at install time. So we decided to pull those old .rpm versions from Issabel repositories.

Even if its only exploitable by authenticated users, it is still a serious security vulnerability. We already patched the software and urge you to upgrade to the latest version (2.3.11) available since today.

One way to find out if your server could have been compromised is to look for .php files in the /var/www/html/stats/uploads directory:

find /var/www/html/stats/uploads -name \*.php

If this command returns any files, those are most probably malicious and your system is compromised.

If you cannot upgrade, a quick fix is to edit the file /var/www/html/stats/admin-language.php, search for 'allow_import' and change it to false, like this:

$grid->allow_import(false);

The forum we were using was constantly being spammed by bots for new user registrations, in a rate that made it impossible for us to keep it clean. I was making some modifications on the forum code to try to clean this bots/spam atack, and tried to clean up the thousands of pending member aprovals (that I had to turn on because of the forum spam).

So, finally I got tired and decided to try a different Forum software, and did so with the only one I found that seemed reasonable modern/updated, with some spam/bot preventions built in and that could import the old forum data: VanillaForum.

I have no idea was this will turn up, maybe I will have to revert to the previous incarnation. I hope existing/validated accounts got imported correctly, I did some work to not lose old links from google searches. I still need to learn a bit about this and possible tweak permissions and configurations a bit.

New user registration does not require aproval any longer, and hopefully it will prevent bots from registering.

Please let me know how it works, if you have issues, etc. I hope to have a bit more time now for answering things instead of dealing with bots/spams.

Nico

In case you have the FOP2 interface exposed to the internet and as an urgent measure we suggest you perform the following actions until we can confirm the problem and provide definitive measures to avoid the problem.

Log into your FOP2 Manager dashboard at https://your.server/fop2/admin
You should see the new 1.2.4 version available. Upgrade directly from there. Once done, your server won't be vulnerable any longer.

To find out if your server was already compromised you can check for the existence of the following files that are not part of FOP2 but are injected by attackers to download and run a cryptocurrency mining script:

ls -la /var/www/html/fop2/lang/index.php
ls -la /var/www/html/fop2/lang/ko.php

If you have any of these two files, your computer was compromised, you should delete these files immediately.

"No way"

"You do not have permissions to access this resource"

; Enable memcache extension module
;extension=memcache.so

; Options for the memcache module

; Whether to transparently failover to other servers on errors
;memcache.allow_failover=1
; Defines how many servers to try when setting and getting data.
;memcache.max_failover_attempts=20
; Data will be transferred in chunks of this size
;memcache.chunk_size=8192
; The default TCP port number to use when connecting to the memcached server 
;memcache.default_port=11211
; Hash function {crc32, fnv}
;memcache.hash_function=crc32
; Hash strategy {standard, consistent}
;memcache.hash_strategy=standard

; Options to use the memcache session handler

; Use memcache as a session handler
;session.save_handler=memcache
; Defines a comma separated of server urls to use for session storage
;session.save_path="tcp://localhost:11211?persistent=1&weight=1&timeout=1&retry_interval=15"

wget -O - http://download.fop2.com/install_fop2.sh | bash

#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.

touch /var/lock/subsys/local
/usr/local/sbin/motd.sh > /etc/motd
/usr/sbin/fxotune -s
#/usr/sbin/amportal start_fop

#!/usr/bin/env sh
exit
. /etc/amportal.conf

while true; do
$FOPWEBROOT/op_server.pl
sleep 4
done

[fop2]
secret = fop222
deny = 0.0.0.0/0.0.0.0
permit = 127.0.0.1/255.255.255.0
read = all
write = all
writetimeout = 1000
eventfilter=!Event: RTCP*
eventfilter=!Event: VarSet
eventfilter=!Event: Cdr
eventfilter=!Event: DTMF
eventfilter=!Event: AGIExec
eventfilter=!Event: ExtensionStatus
eventfilter=!Event: ChannelUpdate
eventfilter=!Event: ChallengeSent
eventfilter=!Event: SuccessfulAuth

manager_user=fop2
manager_secret=fop222

[fop2]
secret = fop333
deny = 0.0.0.0/0.0.0.0
permit = 127.0.0.1/255.255.255.0
read = all
write = all
writetimeout = 1000
eventfilter=!Event: RTCP*
eventfilter=!Event: VarSet
eventfilter=!Event: Cdr
eventfilter=!Event: DTMF
eventfilter=!Event: AGIExec
eventfilter=!Event: ExtensionStatus
eventfilter=!Event: ChannelUpdate
eventfilter=!Event: ChallengeSent
eventfilter=!Event: SuccessfulAuth

manager_user=fop2
manager_secret=fop333

voicemail_path=dbi:ODBC:asterisk1!voicemail_messages

$DBHOST="localhost";
$DBUSER="root";
$DBPASS="passw0rd";
$DBNAME=“asterisk";
$ENGINE="mirtapbx";

$ADMINUSER = "fop2admin";
$ADMINPWD  = "fop2admin";

DROP TRIGGER IF EXISTS AddNines;
DELIMITER $$
CREATE TRIGGER AddNines
BEFORE INSERT ON fop2buttons
FOR EACH ROW
BEGIN
IF(new.Device like '%/%' AND new.Device not like '%/999%' AND new.type='extension')
    then 
            set new.`Channel` = REPLACE( new.Device, '/', '/999');
END IF;
END;
$$
DELIMITER ;

mysql -EB -u $DBUSER $DBPASS -h $DBHOST $DBNAME -e \
    "SET NAMES utf8; SELECT device AS channel,type,if(type<>'trunk',exten,'') AS extension,\
    label, mailbox, context, privacy,\`group\`,IF(type='trunk',IF(email<>'',concat('splitme-',email),''),email) as email, \
    channel as extrachannel, $FINAL_FIELDS FROM fop2buttons \
    WHERE exclude=0 \
    ORDER BY $ORDER" | sed '/\*\*/d' | sed 's/: /=/g' | sed '/.*=$/d' | while read LINEA

mysql -EB -u $DBUSER $DBPASS -h $DBHOST $DBNAME -e \
    "SET NAMES utf8; SELECT IF(type='extension' AND channel<>'',channel,device) AS channel,type,if(type<>'trunk',exten,'') AS extension,\
    label, mailbox, context, privacy,\`group\`,IF(type='trunk',IF(email<>'',concat('splitme-',email),''),email) as email, \
    IF(type='extension' AND channel<>'',device,channel) as extrachannel, $FINAL_FIELDS FROM fop2buttons \
    WHERE exclude=0 \
    ORDER BY $ORDER" | sed '/\*\*/d' | sed 's/: /=/g' | sed '/.*=$/d' | while read LINEA

[fop2]
secret = supersecret
deny=0.0.0.0/0.0.0.0
permit=127.0.0.1/255.255.255.0
read = all
write = all
writetimeout = 1000
eventfilter=!Event: RTCPSent
eventfilter=!Event: RTCPReceived
eventfilter=!Event: VarSet
eventfilter=!Event: Cdr
eventfilter=!Event: ExtensionStatus
eventfilter=!Event: ChannelUpdate

SELECT CONCAT(firstname,' ',lastname) AS name FROM visual_phonebook WHERE phone1 LIKE CONCAT('%',SUBSTRING('[NUMBER]',-8)) OR phone2 LIKE CONCAT('%',SUBSTRING('[NUMBER]',-8)) ORDER BY LENGTH(CONCAT(phone1,phone2)) LIMIT 1

• Added new languages: swedish, russian, polish[/*:m]
• Fix Logout when passing context, user and password via URL[/*:m]
• Fixes for IE9 to avoid warnings on close when clicking on links[/*:m]
• Display full caller id on mouse over as tooltip[/*:m]
• New fop2recording.pl script and browse recording interface.[/*:m]
• Improved permission system, ability to create custom permissions and limit actions to certain groups[/*:m]
• New queue restriction setup, to limit which extensions can be added to which queues[/*:m]
• Extended queuechannel directive, to allow passing different penalties for different queues[/*:m]
• Fixed bug on client not refreshing if socket order was altered and AMI connection was made after the client[/*:m]
• Added jcallback.js to allow custom javascript mods[/*:m]
• Add notifybroadcast command to fire popups/notifications to all connected clients[/*:m]
• Set fixed height to phonebook-application modalbox[/*:m]
• Add CLIDNUM and CLIDNAME variables to monitor_filename[/*:m]
• Use full php tags on donwload.php and php4 libraries[/*:m]
• Let queuechannel have spaces so you can use full names as queuemember[/*:m]
• Fix index_only_extensions.html so it actually works[/*:m]
• Changes on phonebook container to allow displaying the recording interface if enabled[/*:m]
• Added iax as a valid protocol for the dial box[/*:m]
• Added IP address to login-logout audit log[/*:m]
• Fix ghost park calls on failed attendant transfers to park slots[/*:m]
• Fix voicemailcount when leaving voicemail is aborted[/*:m]
• Pause members only on queue when called from queue button, or globally when called from extension[/*:m]
• Respect case on url get parameters for mixed case passwords[/*:m]
• Take VMPREFIX from freepbx globals table for autoconfig-buttons instead of using the default[/*:m]
• Fix crash when non using upper case on channel name when adding queue members[/*:m]
• Fix dial action for user & device mode[/*:m]
• Fix on sorting queue members by penalty[/*:m]
• Added QueueMemberStatus support to set valid/invalid upon sip registration/unregistration, requires to set eventmemberstatus=yes in the asterisk queue config[/*:m]
• Fix spy/listen actions for multi server setups, requires to set originatechannel to be Local/NNNN@YYYYY[/*:m]
• Added online-offline notifications in chat windows (so you know if a user is only or not)[/*:m]
• Added download option for voicemail and recording interfaces.[/*:m]
• Added parking lot timers[/*:m]
• Prevent fop2 server exit when attempting to register with a used code from web gui[/*:m]
• Fix originatechannel on pickup ringing[/*:m]
• Added LSB info to debian init script[/*:m]
• Sort results in popup by clid lenght to prevent popups on partial matched on internal calls[/*:m]
• Added generate_override_context.pl to easily create the proper freepbx context modifications[/*:m]
• Updated fop2admin to setup custom permissions and templates[/*:m][/list:u]
  
  Enjoy!

• IM chat (instant messaging), can also work as a mini note system
• Voicemail Explorer, you can browse your voicemail, move it between folders, remove them or listen to them (requires fop2_server and a php proxy (included) to have access to the voicemail folder)
• White Label License does not enforce footer or page title.
• Sound notifications, new queued call, extension ring and chat sounds
• Preferences Window
• Logout Button
• IAX peer status & IP
• Warning on close (configurable)
• New Queue Display Type (summary for condensed view, or detailed for the agent/waiting calls view)
• Desktop notifications for Fluid (on OSX), Prism (for Firefox) or Google Chrome
• Meetme Talk Detection Visual Indicator
• New toolbar action: Transfer to External Numbers / Mobile
• Dynamic Line display (it hides inactive lines in buttons)

• Detects button addition or removals on server reloads, and refresh the web client to update the display, avoiding showing incorrect status because of button number drift.
• More resilient on status and transfers when using Local type channels and queuemembers
• Fixes initial queue status when using alpha characters on the queuename
• Attempt to use HTML5 web sockets when supported
• License file (fop2.lic) is now searched in the same directory as fop2_server, it does not follow the -c confdir anymore so you can have hot standby clusters working with the same configuration directory, but each node with its own license
• Astdbcust option in buttons, to track custom ASTDB entries, show call forward status in FreePBX by default
• New License commands: revoke & reactivate
• Support for #include in fop2.cfg
• Add "external" in buttoons.cfg to setup external numbers to transfer to
• Added support for enumeration in the "channel" directive on the button configuration Example: channel=DAHDI/1&DAHDI/2
• Some global options from preferences.js can be set individually on the preference pane for each user, like notifyduration or language.

• Fixes that prevent picking up same extension channels on multi tenant setups
• Option to avoid using PICKUPMARK (no_pickupmark), also useful on some multi tenant scenarios

• checkdir.php improvements, you can still run your own popup function and also display notifications
• notify type can be checked so you can discern between notifications on ringing or agentconnect
• notifications on ringing include callerid number, callerid name, queue and extension
• notifications on connect also include call uniqueid

• Fixes disappearing parked calls when doing native sip transfers to the park extension.

• Visual indication when someone is talking in a meetme conference (meetme option T, or talk detection in FreePBX)

• Added monitor_exec to fop2.cfg so you can execute a script after a recording is finished
• When starting and stopping recording several times on the same call, it appends all sections instead
  of keeping only the last recording.
• Included sample tovoicemail.pl script to move recordings to voicemail when finished for easy retrieval
  via handset or fop2 voicemail explorer.

• Language is now configured only on the client side (js/preferences.js)
• op_lang_xx.cfg on the server is deprecated and not used anymore

• Added recordself permission, to allow start/stop recording only on your extension
• Added hangupself permission, to allow hangup only your own extension
• Added preferences permission, to allow a user open personal preferences from the Web
• Added phonebook permission, to allow a user to access the phonebook
• Added voicemailadmin permission, to allow a user access all voicemail boxes
• Added chat permission, to grant chat permissions to a user

• Improved Agent/Agentlogin monitoring
• notify_connect for popups when Agentconnect, it passes the call uniqueid
• queuechannel now takes parameters for AddQueueMember (penalty, membername, etc)
• Fixes some bugs when use_agentlogin is set (performs callbacklogin and agentlogout instead of addqueuemember)

• spy_options in fop2.cfg, to add global options to pass to chanspy when performing the Listen action
• whisper_options in fop2.cfg, too set the whisper option for chanspy, normally "w", but on newer Asterisk versions you can set it to B to perform a call barge.
• individual spy_options in buttons.cfg, they will override the general spy options for Listen, and will be appended on action Whisper
• Cannot start spy when there are no active calls
• Spy ends when spied channel hangs up

• Added CustomASTDB field in the button configuration
• Added Spy Options field in the button configuration
• Added New Permissions in the user configuration (chat, voicemail, preferences, hangupself, recordself)

Community Achievement Award

House Internet developed FOP, the first real-time switchboard for Asterisk, in 2004, and it remains the most widely used operator console. FOP is currently one of the tools that companies and integrators installing Asterisk use to highlight and visually demonstrate the potential of Asterisk as a VoIP platform. Many individuals involved in Asterisk are able to benefit from the solution, from developers and integrators to phone users. http://www.fop2.com