Africa calls 1

[puss1946]

I have a customer with a cics system with Flash Voicemail that somehow how people are getting into the system and calling Africa long distance. I have deleted all mail boxes except two that are being used and changed their passwords. The calls were still made. The customer has Comcast service. Comcast has blocked all out of country. Does anyone know how people can get into the system and make calls out.

Thanks

 

[snowman50]

Usually through the default mailboxes.
Weak passwords....Set to 8 digit...
Block the Voicmail ports extension numbers so as they can't dial out..no line pool access.

The 2 mailboxes that are left ..make sure they are 8 digit passwords.
Check outdial from the mailbox and disable it.

Check for any forwarding to external numbers from these mail boxes..

Use directory report to see what facilities are used.

 

[curlycord]

Comcast has blocked all out of country"
Your not clear on it was done before the hack or they just put it on now until a vendor locks down the system.

Did you also check mailbox passwords for General Delivery and System Manager?
These are normally mailbox #'s 10 & 12 or 100 & 102 depending on how many digits your DN's are.

If you use Off Premise Notification then you simply need to add restrictions to your system.
Restrictions are the key if you want to keep using Outdial features.

Example:
Filter 10
Restricted:
* <----prevents any star codes being used
0 <----prevents overseas calls
10 <----prevents 1010, 1011 type numbers from being dialed

Apply filter 10 to the DN of voice mail

Also see my Toll Fraud FAQ in the Norstar forum:

https://www.tek-tips.com/faqs.cfm?fid=7271

On the Flash they most likely changed the Off Prem phone number to a # in Africa.

Per snowman50 deny Outdial for any mailboxes under F983.




________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[puss1946]

Thank you for the info. I will check all the the things you have said.

 

[curlycord]

On the Flash they most likely changed the Off Prem phone number to a # in Africa."

I meant they most likely forwarded one of the lines using *72XXXXXXXXX as the Off Prem Notify.

Once they are in the mailbox they
Setup Off Prem Notify to call their own number
They get the caller ID of that line
They then change the number to *72 and the oversea's number to forward that line.
They then call that number to get overseas.


________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN