/voice/community?hl=en
/voice/community?hl=en
5/17/18
Original Poster
K Chen

Random fake calls from strange caller ids like 1008, 9001, etc.

I have been using google voice with Obihai devices without issues for many years. Recently, I start to have strange fake incoming calls from caller id 1008, 9001, 8001, 7001, 2001, 3001, 4001, 801, 800, 9000, etc on my obihai 202. These calls were not real, as no one is on the line if I answer. These fake incoming calls started about one week ago from just 1008, but today I started to get such calls from all these other numbers. They come in almost once every minute. This has been very annoying. I have to change the obitalk incoming call routing to block these numbers, or send them to aa, with the following routing digitmap:

{(x00x|x0x):aa},{ph,ph2}

Is this a bug introduced by google voice? Can this be fixed by changing some gv settings?
Community content may not be verified or up-to-date. Learn more.
Recommended Answer
Was this answer helpful?
How can we improve it?
All Replies (9)
ellix
5/17/18
ellix
I am experiencing the same issue today. Most annoying.
5/17/18
Original Poster
K Chen
It is just getting worse. Now I am getting fake calls from 90001, 10001, etc as well. Had to change digitmap again to block those.

esme
5/17/18
esme
I've had over 3 hours of this today. Two per minute when I answered and waited for the fake call to hang up, and one after another when I just turned off the ringer and let it go. I couldn't even get in an outgoing call. A week or so ago, it happened 2 days in a row for several hours, sometimes with caller id showing a non-number: "a'or'3=3--".  I don't know how to change obitalk call routing to block the numbers, nor do I know how, or even what it means to "send them to aa". Perhaps K Chen could share?

If not pure mischief, this seems more like a rival attack on  GV than a GV bug. Or could the origin/target be Obi? 
ellix
5/18/18
ellix
It continues this evening. Less frequently, but still continues.
Bluescat
5/18/18
Bluescat
These are known as SIP scanner attacks.  They have nothing at all to do with Google Voice.  The perpetrators attempt to connect to SIP VoIP endpoints (such as OBiTALK devices, or any other brand of SIP equipment), to use the compromised device to make calls.

You can discuss the issue over on the OBiTALK help forum, where users will explain how to block these calls.
5/18/18
Original Poster
K Chen

Bluescat,

Thanks for the info. It seems this does look like a SIP scanner attack. However, my obi202 call history shows that these calls are from SP1 (my gv line). But GV uses xmpp, not SIP. Here is what I found in that forum:

You only have to block scanners when you defined a SIP trunk for SP2. You don't have to do this for trunks defined as GV. GV uses the XMPP protocol. 

So is there such thing as XMPP scanner?

 

esme: 

you need to go to your obitalk account, enter obi expert configuration menu, go to Voice Services->SP1 service (or SP2, SP3 depending your config), on X_InboundCallRoute,  uncheck Obitalk settings checkbox on the right, then uncheck device default checkbox,  then change the field to the following:

{(x000x|x00x|x0x):aa},{ph, ph2}

basically, it means to send all calls with cid equals x000x, x00x, x0x (x is any single digit) to aa, send all other calls to phone 1 and 2.

you can also remove aa in above, which will block all such calls.

sending calls to aa will still leave such calls in the call history, which you have to login into the obi device directly to see. (not available in obitalk website).

blocking calls by removing aa from above will not keep history of such incoming calls.

John of Lower Merion
5/18/18
John of Lower Merion
@ellix and @esme

If you notice from your home router activity logs that your public IP address is being scanned and probed by unknown entities out on the 'net, it can be helpful to change your public IP address to stop such probing.

If your router has a user configurable "MAC Address Clone" field, changing any digit of the MAC address and rebooting your router will cause your Internet Service Provider (ISP) to assign you a new IP address which effectively hides you from the entities who are scanning your ports. Chances are they found you at random and it may take them days or weeks to find your new IP address, if they even bother to try.

Changing your public IP address in this manner should be of no consequence to you unless you allow someone to remotely administrate your router or you're running web cams that you access from a smart phone app when you're away from home, or you keep a file server with music or photos that you share with others on the Internet. If you do any of these things, be sure to share your new public IP address with all interested parties. Otherwise feel free to change your public IP address whenever necessary.
ellix
5/18/18
ellix
After enabling the Firewall and DMZ function in the BIOS the attack stopped. Everything seems to be working.

Bluescat
5/19/18
Bluescat
No, none of the answers posted are correct.  Do not mess with the dial string, and no, Google Voice no longer uses XMPP; it now uses SIP.

Do this:
  1. Go to the OBiTALK dashboard page, https://www.obitalk.com/obinet/pg/obhdev
  2. Click on your device, then scroll down and click "OBi Expert Configuration", get past the various redundant mouse-clicks until you are on the Expert page.
  3. Under "Voice Services", click the SP1 - SP4 slot that holds the Google Voice number, e.g. "SP1 Service".
  4. Remove both of the check marks to the right of the parameter "X_AcceptSipFromRegistrarOnly" and then check-mark the box to enable that setting.
  5. Scroll down and click the "Submit" button.
  6. If you have more than one SPx configured, change the same parameter for the other SPs.



 
This question is locked and replying has been disabled. Still have questions? Ask the Help Community.

Badges

Some community members might have badges that indicate their identity or level of participation in a community.

 
Expert - Google Employee — Googler guides and community managers
 
Expert - Community Specialist — Google partners who share their expertise
 
Expert - Gold — Trusted members who are knowledgeable and active contributors
 
Expert - Platinum — Seasoned members who contribute beyond providing help through mentoring, creating content, and more
 
Expert - Alumni — Past members who are no longer active, but were previously recognized for their helpfulness
 
Expert - Silver — New members who are developing their product knowledge
Community content may not be verified or up-to-date. Learn more.

Levels

Member levels indicate a user's level of participation in a forum. The greater the participation, the higher the level. Everyone starts at level 1 and can rise to level 10. These activities can increase your level in a forum:

  • Post an answer.
  • Having your answer selected as the best answer.
  • Having your post rated as helpful.
  • Vote up a post.
  • Correctly mark a topic or post as abuse.

Having a post marked and removed as abuse will slow a user's advance in levels.

View profile in forum?

To view this member's profile, you need to leave the current Help page.

Report abuse in forum?

This comment originated in the Google Product Forum. To report abuse, you need to leave the current Help page.

Reply in forum?

This comment originated in the Google Product Forum. To reply, you need to leave the current Help page.