Nortel NAM

[PatsyR]

We have a customer that has a Nortel NAM 4.1 with an automated attendant set up. It was built as CCR tree 1 before they were our client. When you call their main number and the AA answers and you press 9 it transfers to one of there other locations in a different state. When I go under CCR 1 programming to look at path 9 the display show invald path. How do I remove this. I have tried to build other trees but every time I push 9 in any tree it does an external transfer to one of there other locations in another state. Currently there AA option 1-1 goes to an external number and 1-2 also goes to an external number. Is there a way I can restrict the voice mail from being able to call out but make and exception for the 2 numbers they need to transfer to. Someone is hacking into their system and had made calls to Zimbabwe and other places. We did a SMDR traffic study and identified multiple calls going out their voice mail that should not be.

 

[allworxguy]

It sounds to me like there is a "man in the middle" that is capturing "9". 9 has only one function in all Nortel voice mails and that is to change language. Tree entries are 1-8 only.

Marv

http://www.telemarv.ca

 

[PatsyR]

How would I go about looking for "the man in the middle

 

[curlycord]

-What version software is KSU? 6.X or up?
-How do internal users dial out? 8?
-If users dial 9 do they get the same destination in next state?

9 is probably a destination code and told to use a certain route, that route is told to call the other branch.

You best to install the toll fraud patch on the NAM so that they cannot use the dest code from the NAM's AA.

Here is the patch:

http://www.curlycord.com/files/TollFraudPatch4.1.zip

As for Toll Fraud itself it is most likely a user with a mailbox has a weak password and allowed External Transfer, deny it in Class Of Service or change their COS.

You can log to NAM and get some detailed reporting such LD's called out if you want to find that mailbox.

Check out the FAQ's for Toll Fraud :

http://www.tek-tips.com/faqs.cfm?fid=7271

=----(((((((((()----=
curlycord

http://www.curlycord.com