Calls come in and forward Out????

[rachelle]

Was talking to a friend and he had the strangest issue. A customer's site seems to have been hacked but, how? They have a Norstar,key system. They couldn't remember the release. Analog trunks. 10 phone lines. A call will come in from the outside world and you will see it flashing on a set. Then, another line will pick-up and that first call is going out to another number. In the first instance of this, many $$$ were charged for international calls (all to same country). In the second instance of this, calls out were going to actual client numbers. No one could tell him what the clients heard when they answered the phone.

How would you find out how they are exploiting this site? This is a puzzler!!!



rlc

no matter where you go, there you are.

 

[trvlr1]

Is there a RAD hooked up and is the password still default or relatively easy? That would be the easy way in from the outside. Also, for someone with a little knowledge, it is pretty easy for someone inside to forward off site.

 

[Ronus]

Check to see if Disa is turned on as well, turn it off if is and not needed.

 

[NETWT]

There may be a mailbox setup to dial out to another number or another norstar voicemail

 

[curlycord]

Toll Fraud Lock Down:

Disable DISA
Disable Allow Line Redirect on sets
Put Restriction filters on Lines and/or sets (including the voice mail ports)

Disable Outdial on mailbox's or C.O.S.
Use 6 digit non-trivial passwords on mailboxes(not 1234 1111 etc.)

On NAM's install the Toll Fraud patch.

Thats all I can think of but I know I am missing something.






=----(((((((((()----=
curlycord

http://www.curlycord.com

 

[NETWT]

They can do it through mbox's with access to line pools or routes

most people use 1111 or 1234 for passwords.
Easy to get in other peoples mboxs when you know norstars

 

[RikRodgers]

The CICS had IRAD answer turned on by default on some sw revisions. It sounds like you have a MICS, but for those others reading this, make sure you set the IRAD to answer- NONE.

 

[PERRYPJ]

Refer to Nortel ITAS tip 315NA for any info needed.

OLD ROLMEN WORKING ON NORTELS AND AVAYA

 

[jerryreeve]

look first at mailboxes 100 and 102 and turn off external transfer. That is where I caught hackers on a couple of systems. (I listened to one of the calls and heard the call as it progressed and simply changing the password on the 102 mailbox stopped it right then)

If someone within the site actually forwarded a phone out you can tap the busy lamp of the outgoing line and see which extension initiated the transfer.

----------------------------
Hill?? What hill??
I didn't see any $%@#(*$ Hill!!
----------------------------
JerryReeve
Communication Systems Int'l
com-sys.com