Linux-Based Phone System Phones Home

An anonymous reader writes to let us know that users of Trixbox, a PBX based on Asterisk, recently discovered that the software has been phoning home with statistics about their installations. It's easy enough to disable, and not particularly steathy (beyond encrypting the data sent back), but customers in the forum are annoyed at not having been informed of the reporting. Trixbox is owned by Fonality, which makes customized PBXs (again based on Asterisk) for paying customers.

Comments

So?

[brad-x]

The initial setup at the web GUI makes it apparent that it wants to send stats back to home-base. How this can take people by surprise is baffling.

Re:So?

[QuantumG]

Well that's your own stupid fault then isn't it?

Security Vuln

[Anonymous Coward]

The issue here is not just the fact that it is phoning home - it is the method in which it is done. This has been reported as a security vulnerability to the voipsec mailing list. http://voipsa.org/pipermail/voipsec_voipsa.org/2007-December/002522.html

This about says it all

[sjames]

From the forum:

The point is that people should have been given a means to easily opt-out of the data collection process which is something we totally overlooked and in seeing the reaction we realize that this was a big mistake on our part. While it is pretty trivial for anyone with basic linux knowledge to disable it, the issue is that a) we didnt inform people well and b) we didn't make it easy to turn off. We thank you for your support on this but anytime there is a more than a few people complaining about something it means we missed the mark on it. So, as a team and a company we fix it and learn from it. -- Kerry Garrison trixbox Community Director

I used to be the lead developer..

[Rob from RPI]

And I'm somewhat annoyed by KerryG's assertion that "Both trixbox and FreePBX have phone-home mechanisms in them." Now, admittedly, I relinquished FreePBX at the beginning of this year due to personal commitments, but I have ALWAYS been dead against 'phone home' information. We DID have a rough idea of how many machines were actively being maintained by the 'hits' on the modules.xml file that contains the current version of all the modules and download links for it. That's it.

The only other slightly information-divulging bit of information was the built-in IRC client did a 'uname -n' and specified what distro the client was running. It broadcast that in a 'notice' to the FreePBX channel. This was highlighted on the IRC page, with exactly what would be sent.

FreePBX has NEVER 'phoned home'. I would be amazingly upset if it was doing so now. Trixbox, on the other hand, may do that, but please do NOT link the FreePBX project with it.

--Rob

Re:I used to be the lead developer..

[Rob from RPI]

Note for those who may have missed the point of my post: Trixbox is Centos + Asterisk + FreePBX + a couple of other things. It's just a bundle of various open source applications on a CD. The main parts of Trixbox are Asterisk and FreePBX, with CentOS as the OS and kernel.

So, when someone mistakenly says 'trixbox does...' they usually mean 'freepbx does...' as FreePBX is the GUI Trixbox uses to configure Asterisk.

--Rob

Re:Trick Box

[Anonymous Coward]

I tried out Trixbox Pro not that long ago but was really turned off by their premise that you must have Internet access to properly configure your server (my VoIP server is NOT on the Internet nor will I do so for privacy and security reasons!). And their appliance is expensive and still needs Internet connectivity. While their old-school Trixbox CE product doesn't have this limitation development on it has slowed down despite their claims of "it's still in development, really!".

AsteriskNOW isn't ready for prime-time yet, though it shows promise long-term.

If you don't want to compile Asterisk yourself and yet you still want to use FreePBX (and you really should!), I highly recommend you check out Nerd Vittles, http://www.nerdvittles.com/ instead -- everything that Trixbox CE could have been.

Mod parent up

[Fnord666]

This is a key point. A cron entry runs a process on the PBX every 24 hours that connects out to trixbox and picks up an arbitrary list of commands. It executes those commands (under whatever authorities it wss installed with) and returns the results. Sure hope their server is up to date on patches. That assumes DNS sent back the right server to begin with and not a spoofed site with a "different" set of commands.
In what universe does this seem like a good idea?

Re:Mod parent up

[grcumb]

This is a key point. A cron entry runs a process on the PBX every 24 hours that connects out to trixbox and picks up an arbitrary list of commands. It executes those commands (under whatever authorities it wss installed with) and returns the results.

What a terrible design! I worked for a couple of years on a FOSS product whose commercial version phoned home by design. It was a small server that allowed remote configuration changes via our NOC. The idea was to provide basic systems admin functionality for multiple geographically dispersed servers. Man-in-the-middle attacks - in either direction - were one of the primary concerns, second only to the privacy of the customer.

We vetted every byte, incoming or outgoing; we worried constantly about both sides of the the authentication process, addressed DNS poisoning and coped properly with pwned clients as well. We never ever passed anything but text between the server and the NOC. Even anti-virus signature updates were performed out-of-band with the 'phone-home' process.

Allowing execution of arbitrarily defined scripts is a disaster in the making. The trust model is entirely wrong, for one thing. I understand now why the manufacturer didn't want to talk about, because no sysadmin in his right mind[*] would accept that someone outside the organisation should ever have the right to run arbitrary code on their boxes without prior vetting.

*****

[*] Unfortunately, 'sysadmins in their right mind' is a far-too-small subset of all sysadmins....

Re:Trick Box

[Power_Pentode]

"If you don't want to compile Asterisk yourself..."

If you wish, you can use Asterisk without compiling it yourself; several distros have versions of Asterisk in their repositories. I'm pretty much a Linux n00b but once I read which modules are prerequisites, Asterisk compiled easily with the usual ./configure, etc. Thanks for the tip on FreePBX.

Kerry already addressed this in his blog

[Anonymous Coward]

Kerry has already addressed this in his blog:

http://www.trixbox.org/trixboxs-new-hardware-audting-tool

Re:Make your own Linux-based PBX system

[heelios]

And I recommend that you do NOT get Grandstream phones.

They're pieces of crap. Do yourself a favor and get yourselves phones intended for real business use.

Cisco and Polycom make the later.

Re:Trick Box

[SpzToid]

I highly recommend you check out Nerd Vittles

Me too! Those guys wanted to work with Trixbox devs, and finally gave up and rolled their own, which is the new PBX-in-Flash voip server. The true open-source devs have released a truely wonderful and solid server. They asked for donations to fund a server, and I'm so impressed with my phone server, humming away for a few weeks already, of course I'm donating; I want more good stuff in the future, and want these PBX-in-Flash devs to stay motivated. Great stuff guys!

Note that the PBX-in-a-Flash devs had no choice, Trixbox/Fonality locked them out of the build process completely. So yeah, they went and rolled their own; and did a great job at that.