Panasonic TDA-TVM line fraud

[rivet]

hi all hope you can help with this!! i have a customer who was contacted by Eircom(our only service provider)in ireland.they informed him that he (or his phone system)had made 7000 euro of calls to a primary rate number over the weekend.the customer site is equiped with the following..

1. panasonic KX-TDA100
2. panasonic KX-TVM50

lines : PRI30

vm setup=
1. system password = 6 digit for user,manager,& installer.
2. Ext mailboxes = no password.
3. All mailbox COS = 1
4. all mailboxes including 998 & 999 remote forward to co Disable.
5. all mailboxes including 998 & 999 transfere to co Disable.
Ringing...no auto attendent setup just mailbox on ext 201 for messages at night.
outgoing ports (normaly set 1-6)i have deleted the entry (1-6)
co access digit(normaly -(9T) i have inserted(0T)
finaly
all mailboxes including 998-999 menu Disabled.

TDA Setup is as following.
1. system password 6 digit all 3 levels
2. ext password(pin) = none
3. reception COS = 1
4. all Other extention COS = 3 (including unused ports)
5. vm port 16 COS 3
6. TRS for COS 3 = 15 (no handset can dial 15)(execpt ext 201) the number dialed = 1550-***-***
7. DDI for remote Programing = none

but it gets better i logged into the system with call logging hyperterm and logged calls during the lunch hour system says no calls made by ext265(vm port) provider says 10 calls made.
here is the log.
Number Ring Duration Acc code CD

--------------------------------------------------------------------------------

28/05/07 10:04AM 208 02 6618145 00:00'43

28/05/07 10:14AM 207 02 0868337114 00:00'34

28/05/07 10:17AM 204 04 0872551841 00:00'26

28/05/07 10:19AM 205 02 8125515 00:03'29

28/05/07 10:22AM 204 04 6399656 00:00

28/05/07 10:24AM 204 01 0862579549 00:00'15

28/05/07 10:39AM 206 05 2760512 00:00'03

28/05/07 10:42AM 206 04 2760373 00:03'28

28/05/07 10:43AM 206 04 0866010708 00:00'33

28/05/07 10:49AM 205 02 0906480600 00:03'52

28/05/07 10:50AM 206 05 4973255 00:02'47

28/05/07 10:50AM 207 04 4945522 00:00'01

28/05/07 11:05AM 209 01 0862521007

28/05/07 11:24AM 205 01 6760251 00:00'59

28/05/07 11:26AM 209 02 8678650 00:00'53

28/05/07 11:27AM 206 05 04782136 00:00'02

28/05/07 11:28AM 206 04 04782417 00:00'04

28/05/07 11:28AM 205 01 6623255 00:00'44

28/05/07 11:29AM 206 04 0866010708 00:00'37

28/05/07 11:30AM 205 03 6185500 00:00'35

28/05/07 11:30AM 206 06 0866010708

28/05/07 11:35AM 206 02 04782417 00:06'07

28/05/07 11:42AM 206 05 0861713981 00:04'11

28/05/07 11:46AM 205 01 2674000 00:00'05

28/05/07 11:47AM 209 02 6044665 00:08'12

28/05/07 11:48AM 205 01 0868127095 00:01'22

28/05/07 11:51AM 205 01 0863880746 00:01'52

28/05/07 11:52AM 206 05 0872945522 00:06'11

28/05/07 11:54AM 208 02 4068155

28/05/07 12:00PM 206 04 4973255 00:03'31

28/05/07 12:07PM 206 03 0879212886 00:01'23

28/05/07 12:09PM 206 04 04782417 00:00'27

28/05/07 12:10PM 206 03 04756219 00:00'42

28/05/07 12:14PM 101 30 2830329 00:01'27

28/05/07 12:21PM 206 05 6115100 00:02'03

28/05/07 12:38PM 205 01 0872987519 00:00'02

28/05/07 12:52PM 208 02 0863793526

28/05/07 12:52PM 205 02 0872987519 00:00'02

28/05/07 12:56PM 207 03 4604260 00:01'51

28/05/07 01:04PM 205 02 0872513873 00:00'03

28/05/07 01:05PM 205 02 0872987519 00:00'02

28/05/07 01:06PM 206 04 0866010708 00:00'33

28/05/07 01:07PM 206 03 0906480600 00:00'09

2828/05/07 01:16PM 206 06 0878306101 00:00'28

28/05/07 01:22PM 209 01 8678650 00:01'06

28/05/07 02:12PM 206 05 4951111 00:01'26

28/05/07 02:25PM 206 03 0863855735 00:00'33

28/05/07 02:28PM 206 05 4903511 00:00'54

28/05/07 02:30PM 209 01 0879783143 00:01'35

28/05/07 02:34PM 206 01 0906480600 00:01'16

28/05/07 02:37PM 206 03 0861713981 00:02'20

28/05/07 02:37PM 204 03 0861713981- 00:00'15




Date Time Ext CO Dial Number Ring Duration Acc code CD

--------------------------------------------------------------------------------

28/05/07 02:37PM MN ALM #510 10000 SMDR disconnect

--------------------------------------------------------------------------------

28/05/07 02:37PM MN ALM #510 10000 SMDR disconnect

i have also checked the vm log it also says no transfers to co at any stage. so its a good one this time have i forgoton to do something here our panasonic supplier told me it is possible to program an Extention on the system by entring through th vm but couldnt tell me how.!!so my question is this with the above settings is it possible to get calls through the system to dial a 1550 number without seeing it on the call log of the system.Or is this more likely to be a supplier error.

peter.

 

[shardian]

I doubt it'll change anything, but check the SMDR options under the maintenance tab. Have a look at the secret and privacy dial settings.

In there, it could be set so calls aren't output to the SMDR log.

Other than that, run a protocol trace and log it. Get time stamps from the carrier for each of the calls for a specific time period. Then if you understand the trace output, see if you can match activity system side with activity carrier side. That'll prove if its the system or carrier.

If you don't understand all the output, send to Panasonic and get them to break it down.

 

[rivet]

hi shardian

as far as i know a a protocol trace will only tell me whats happening on the lines as its happening however the line supplier say it has stopped now so the trace wont show anything but correct me if im wrong you see my problem the customer doesnt have call logging and the tda only has a 2 hour memory for the smdr so by the time i got to it on monday i could only see back to 10am however the supplier says calls went out from the lines after i started which dont show up on the above SMDR log so i dont want to pay out 7000 unless it can be proved that it was the system


peter

 

[shardian]

You can leave a computer connected to the system over the weekend and leave the trace running. Then when you come back, you click on capture and basically output the data (that has been logged as the lines become active) to a text file. Then you can go over it and see what happened system side. Then get the carrier to give you a list of calls made and times also, and marry the 2 up. If the system didn't do anything when the carrier said there was line activity, then you have your answer.

If the problem has stopped, then I think you're gonna find it hard to prove/disprove the system is at fault.