Researchers identify Asterisk vulnerability
Researchers from Check Point Software recently identified a vulnerability in Asterisk FreePBX software that hackers used to gain control of the PBX server, read call files, listen to recorded calls, and make spoofed calls with complete anonymity.
The exploit was described in a presentation on October 4, 2019 at the Virus Bulletin Conference in London.
The attack profile infects the Asterisk FreePBX server with a customized PHP WebShell that enabled the hackers to gain control of the server.
Researchers noted that this vulnerability enables a different kind of attack objective—wiretapping—in addition to the usual goal of downloading data.
Check Point researchers shared their research with Asterisk. The vulnerability that enabled the attack has been patched.
Organizations that use Asterisk FreePBX are advised to apply the latest patches to keep these systems as secure as possible.