A timely reminder

[OzzieGeorge]

Guys

Below is the text from a press release by the Western Australian Police. I would have attached the document but I don't know how. It's pdf format so logos and such won't be there.


Page 1 of 1
visit our website:

http://www.police.wa.gov.au

Phone: (08) 9222 1217 (08) 9222 1853 Fax: (08) 9222 1703
(08) 9222 1701 (08) 9222 1394
Email: Police.Media@police.wa.gov.au
BUSINESSES WARNED OVER INTERNET FRAUD
Detectives from the WA Police Technology Crime Investigations are warning small business operators to be vigilant and to utilise security software to help protect their internet phone systems after a number of complaints received at the unit.
Thieves are targeting older style PBX systems, exploiting the call forwarding functionality and running up huge international phone bills. However, what is more concerning to police, is the emerging trend of sophisticated compromises of modern VoIP (Voice Over Internet Protocols) phone systems which occur when unauthorized users gain access to a VoIP network.
In a recently received complaint from a small Perth business, their VoIP PBX telephone system was “hacked” by an unauthorized user who utilized the businesses phone systems to make over 11,000 international telephone calls in 46 hour period. This business was alerted to the crime when they received an invoice from their service provider that was in excess of $120,000.00 as a result of this security breach.
This latest reported incident is a timely reminder for businesses to be prudent with their phone system security, in particularly to know exactly what services are enabled and to change their passwords on a regular basis.
Detective Sergeant Jamie McDonald said “Business operators should invest in appropriate security software to protect their communication systems. Most businesses are prepared to install firewalls on their computers but fail to extend that level of security to their phone systems.”
Ends Release.
Greg LAMBERT
Sergeant 7973
Police Media
20/Jan/2009

 

[pingram3541]

I wouldn't be surprised if it was an employee or ex-employee.

Even without any security in place (encryption/firewalls/changing ports,etc.), there's still a lot of guess work to "find" the connection.

However, I still run into the older "hack the VM system method" about 3-4 times a year and end up with 3-4 new customers that like it done right. =)

-Phil Ingram

http://www.tell-a-tek.com/

{All-You-Can-Eat Telecom and IT Buffet}

 

[pingram3541]

oh yeah, forgot to say thanks for the info Ozzie!

-Phil Ingram

http://www.tell-a-tek.com/

{All-You-Can-Eat Telecom and IT Buffet}

 

[gbaughma]

Good reminder, Ozzie.

I had to do a forensics analysis for a company with an NEC phone system who had gotten a $10,000 phone bill because of Phreaking.

The first thing I did was walk around to every desk, and dial their voicemail code.

7 of the 15 phones did *NOT* have a security code set.

Make sure all of your users have a security code set, and that Amy Ronk's (or Sandy Simmons') extension ALSO have a security code set

This will thwart 99% of the phone hackers out there.


Just my 2¢

"What the captain doesn't realize is that we've secretly replaced his Dilithium Crystals with new Folger's Crystals."

--Greg

http://parallel.tzo.com

 

[MercuryComm]

I always toll restrict the voice mail ports if the customer will not be using the voice mail for any long distance notification to cell phones, etc. That kind of idiot proofs things due to the on site admin person reseting VM boxes and then new users not setting passwords.

 

[gbaughma]

MercuryComm:

Not a bad idea... what do you do, set the voicemail ports to a COS 3 or something?



Just my 2¢

"What the captain doesn't realize is that we've secretly replaced his Dilithium Crystals with new Folger's Crystals."

--Greg

http://parallel.tzo.com

 

[MercuryComm]

Yes. In 1201 set your ports to a COS that's toll restricted. The class depends on how your LCR is programmed up. If you don't know use a test ext. and try a 22, 33, 44 or whatever, then after you set each one try a local call, then toll call until you find the one that works like you want.

 

[metballnut]

I can't eblieve that installers/admin are not securing their VMs.
In 1987, I went to a bank to "fix" the VM (Octel. A hacker had gotten in and changed the manager passcode and put a recording on saying "you have reached the bank. We are out of money and closed. We will keep your money".
The Octel password could only be reset by an engineer through the backdoor and cost $500.00.
While waiting for the tech to call me back, I started trying numbers.
On the third number "guess" I typed in 1234567890 and it worked.
There were new mailboxes set up, including conversations back and forth from hackers in these mailboxes.
The bank was able to trace them and they were arrested.
I had to testify AND I was also investigated.
The investigator couldn't believe I could "guess" a 10 digit number.
I think it was my lottery win.
Damn, why couldn't it have been the Lotto ? :0