Phantom calls being received?

[Microfiche]

We have one Android phone with the Mitel UC Advanced app (5.1.34.20409 v124) who is getting "phantom calls" on his soft phone from number 100 at strange hours like 3 AM.
There is no record of these calls, or the calling number, anywhere - not in the call logs, not in the server logs.
There is no "100" assigned to any phone/ extension etc.
The only record we have is the user telling us that this is happening, and this AM he showed me in "Recent Apps" where it showed a small screen cap with the number 100 calling. We had our tech in from the company who installed, and they can find anything.
Has anyone ever seen anything like this?

[acejavelin]

Haven't seen this... what do you get for a result if you go into the 3300 maintenance commands and execute:

locate number 100

[Navarre]

We have one Android phone with the Mitel UC Advanced app (5.1.34.20409 v124) who is getting "phantom calls" on his soft phone from number 100 at strange hours like 3 AM.
There is no record of these calls, or the calling number, anywhere - not in the call logs, not in the server logs.
There is no "100" assigned to any phone/ extension etc.
The only record we have is the user telling us that this is happening, and this AM he showed me in "Recent Apps" where it showed a small screen cap with the number 100 calling. We had our tech in from the company who installed, and they can find anything.
Has anyone ever seen anything like this?

Is this phone exposed to the Internet? Or is it on a LAN with a PC infected with malware?

Most likely something is scanning for SIP services, and finding his phone.

[ralph]

Most likely something is scanning for SIP services, and finding his phone.

Seen this before.
Do you have a PRI service that is delivered to your prem via SIP?   Or are you using an older version of Teleworker?

You can check out this thread for more detail:  mitelforums.com/forum/index.php?topic=3619.0

Ralph

[Microfiche]

Thanks everyone - I know that if you try to locate 100, it does not exist.
Unfortunately, I don't know enough about the system to comment intelligently about how our PRI service is being delivered - we are connected directly to our Telco if that helps. We should have the latest version of teleworker installed - the system is only a few months old.
I will send some of these questions to our installer tech who was looking into this and came up with nothing.
The problem is only happening to one person, and only when he is at home - I assume at that point he is connected to his home wireless LAN.
So would this hack (if that is what it was) be through his LAN? As I mentioned, we see no sign of any activity on the server.

[Microfiche]

Our MITEL installer/dealer says that our PRI is not being delivered via SIP, and that we are on the most recent version of Mitel Border Gateway.
They seem to be stumped by this.
So could this be a hack based from his home LAN? i.e. Could malware on a computer on that subnet be scanning for SIP devices and finding his phone?
The phone would be connected to the internet via his home WiFi as well as through cellular data services.

[Microfiche]

We now have had another different phone at a different location that received a number of these phantom calls while at home this past weekend.
When I check the 3300 call logs, there were no phone calls routed through the server over the weekend.
Based on that, I assume that these "calls" were not connected to our office system.
Does anyone have any ideas of how we can stop this from happening?
I am assuming that both these routers have NAT in place (the users are very technical, so asking would be pointless), so I am not sure how port scans could hit the phones.

[pmhaynes]

I had this once,
Just after i installed SIP teleworker
It looks like it may have been hacked
I chnaged the SIP teleworker usernames and passwords and it did not happen again

Do you have any teleworkers or SIP trunks with MBG?

[Microfiche]

These users are 2 of 5 that are using Teleworker on their Android phones with Mitel Border gateway.
What I find strange is that it has only occurred with these 2 phones, and only when at their homes.
If their home routers are running NAT, would a SIP scan still be able to hit their phones?