Bonsoir,
J'aimerais avoir votre expertise sur la mésaventure ci-dessous arrivée sur une config en production depuis fin 2009. J'en profite pour vous alerter :
Software
Ubuntu 9.10
Kernel 2.6.27-7
Asterisk 1.4.33.1
Zaptel 1.4.12.1

Hardware
Carte Digium TDM 400
FXS1 => FT
FXS2 => RJ11 Freebox
FXO1 => DECT Siemens (poste 100)
FXO2 => DECT Siemens (poste 200)
sur LAN => Siemens S450IP (poste 201)

Problématique
En consultant ma console Free, je découvre ce message:
"Facture No 11-xxxxx du mois de Novembre 2010 impayée"

Un coup d'oeil au détail de la consommation indique des centaines d'appels à un unique n° en Espagne (sauf le second appel). Ces n° me sont parfaitement inconnus !

21/11/1013:1200:00:030034902733170 Espagne - Mobile0.010 21/11/1013:1300:01:010034902733080 Espagne - Mobile0.193 21/11/1013:3500:27:240034902733170 Espagne - Mobile5.206 21/11/1014:1000:42:290034902733170 Espagne - Mobile8.072 21/11/1015:0500:32:360034902733170 Espagne - Mobile6.194 21/11/1015:3800:40:390034902733170 Espagne - Mobile7.724 22/11/1001:0800:25:480034902733170 Espagne - Mobile4.902 22/11/1001:3500:00:120034902733170 Espagne - Mobile0.038 22/11/1001:3600:09:270034902733170 Espagne - Mobile1.796 22/11/1001:4600:07:120034902733170 Espagne - Mobile1.368 22/11/1001:5400:07:090034902733170 Espagne - Mobile1.359 22/11/1002:0200:07:090034902733170 Espagne - Mobile1.359
etc... etc...

Après recherches, il ne s'agit malheureusement pas d'un piratage chez Free, car les logs de mon Asterisk attestent que les appels ont bien été passés en interne par le poste ... 201 (le Siemens S450IP) !!! Extraits des logs :
Code:
"","201","0034902733170","internal","201","SIP/201-08709430","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 18:54:17","2010-11-22 18:54:20","2010-11-22 19:02:08",471,468,"ANSWERED","DOCUMENTATION","1290452057.4571",""
"","201","0034902733170","internal","201","SIP/201-09112dc0","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:02:31","2010-11-22 19:02:35","2010-11-22 19:10:24",473,469,"ANSWERED","DOCUMENTATION","1290452551.4606",""
"","201","0034902733170","internal","201","SIP/201-08707c60","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:10:46","2010-11-22 19:10:49","2010-11-22 19:18:37",471,468,"ANSWERED","DOCUMENTATION","1290453046.4640",""
"","201","0034902733170","internal","201","SIP/201-09126350","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:18:59","2010-11-22 19:19:03","2010-11-22 19:26:49",470,466,"ANSWERED","DOCUMENTATION","1290453539.4673",""
"","201","0034902733170","internal","201","SIP/201-091e7aa0","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:27:11","2010-11-22 19:27:15","2010-11-22 19:27:52",41,37,"ANSWERED","DOCUMENTATION","1290454031.4705",""
"","201","0034902733170","internal","201","SIP/201-08718250","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:28:05","2010-11-22 19:28:09","2010-11-22 19:35:03",418,414,"ANSWERED","DOCUMENTATION","1290454085.4708",""
"","201","0034902733170","internal","201","SIP/201-08707c60","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:35:25","2010-11-22 19:35:29","2010-11-22 19:43:17",472,468,"ANSWERED","DOCUMENTATION","1290454525.4742",""
"","201","0034902733170","internal","201","SIP/201-08614b28","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:43:39","2010-11-22 19:43:42","2010-11-22 19:51:32",473,470,"ANSWERED","DOCUMENTATION","1290455019.4773",""
"","201","0034902733170","internal","201","SIP/201-08718250","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 19:51:54","2010-11-22 19:51:58","2010-11-22 19:59:44",470,466,"ANSWERED","DOCUMENTATION","1290455514.4807",""
"","201","0034902733170","internal","201","SIP/201-0875fc70","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 20:00:06","2010-11-22 20:00:10","2010-11-22 20:07:58",472,468,"ANSWERED","DOCUMENTATION","1290456006.4839",""
"","201","0034902733170","internal","201","SIP/201-087152b0","Zap/3-1","Dial","Zap/3/0034902733170","2010-11-22 20:08:20","2010-11-22 20:08:24","2010-11-22 20:09:00",40,36,"ANSWERED","DOCUMENTATION","1290456500.4871",""
1ère action
J'ai modifié mon extension.conf pour interdire la numérotation de type +3490xxx, le 0 correspond à des n° espagnols surtaxés.

2ème action
Recherche de ce qui a pu se passer avec le S450IP mais je sèche. La seule piste que je vois est d'avoir fait une maj de son firmware il y a quelques jours. Le firmware Siemens était-il hacké ???

Total de l'histoire, près de 300 € de surfacturation chez Free que je vais payer puisque les appels ont bien été passés de chez moi.

Je n'ai pas d'explication sur ces numérotations autos.
Pourriez-vous m'aider à comprendre / diagnostiquer ?
Qu'en pensez-vous ?

Merci d'avance.