Possible Dial Through Fraud

[TelstreamEngineer]

Are there any measures you can take on the ip office to stop fraudulent calls being made through the phone system? Can hackers dial into the voicemail and make calls out? The customer has voicemail pro with an auto attendant on the incoming call route and a number of mail boxes. Any ideas?

 

[tlpeter]

By default you can't do that.
But if vmpro is configured wrong then yes this is possible.


BAZINGA!

I'm not insane, my mother had me tested!

 

[TomMills]

is this because you suspect it's happening or just a precaution?

http://www.twitter.com/tem1985

ACSS-SME
fo shizzle ma nizzle.

 

[amriddle01]

Indeed, unless you have configured it to do so, the system will not allow dial through fraud

ACSS (SME)
APSS (SME)

http://www.ipoffice.tel

"I'm just off to Hartlepool to buy some exploding trousers

 

[TelstreamEngineer]

Our customer was contacted by the fraud team at BT and sent them a list of suspicious calls. I checked out the person at BT and they do exist so i know it's not a scam.

The customer is certain that it's not anyone internally making the calls. All the calls were made to the same number and for a around 30 seconds. Each call costing £3.50!

I just want to be certain that the phone system is locked up and cannot be at fault for these calls.

 

[TomMills]

Get SMDR logging and also Monitor, then search for the calls.

http://www.twitter.com/tem1985

ACSS-SME
fo shizzle ma nizzle.

 

[amriddle01]

What have you programmed in the attendant? Mailboxes will not give you breakout to the lines unless you have gone out of your way to make it happen, so the attendant is where people can open the system up, who programmed it?

ACSS (SME)
APSS (SME)

http://www.ipoffice.tel

"I'm just off to Hartlepool to buy some exploding trousers

 

[mattKnight]

>All the calls were made to the same number

Immediately, and I mean NOW!

Add this number to your ARS table as barred. This will prevent further abuse of *that* number, which is probably and overseas premium rate number.

However, it seems that you have a loophole on your Autoattendant prgramming. You need to investigate this and you also need to review your remote access passwords - particularily if you use access over the web to the voicemail.

Do any of the users have a modem on their PCs - has anyone eliminated the possibility of a "dialer" type malware?



Take Care

Matt
I have always wished that my computer would be as easy to use as my telephone.
My wish has come true. I no longer know how to use my telephone.

 

[IPGuru]

another option for your shortcodes would be

SC:<Fraud Number>
TN:<extn of Manager>
FeatureialExtn

Next time the call is made you should be able to identify whre it is coming from (& if internal ask the culprit to explain )

if this is beein done via the auto attendant then check any options that allow callers to dial an extn number

menu touch tones of ??? are a bad option!

I do not Have A.D.D. im just easily, Hey look a Squirrel!

 

[mattKnight]

IP Guru's suggestion is equally good, but you need to do something...

> you should be able to identify whre it is coming from

I'll bet £5 that you'll get modem tones when you answer the call



Take Care

Matt
I have always wished that my computer would be as easy to use as my telephone.
My wish has come true. I no longer know how to use my telephone.

 

[TelstreamEngineer]

Thanks all i'm looking over all this now.

 

[IPGuru]

Matt
I am not going to take that bet because I think you are dead right.
but at least that still helps identify the cause

I do not Have A.D.D. im just easily, Hey look a Squirrel!

 

[hairlessupportmonkey]

I have a splicecom at a customers site that racked up £1500 fraud calls in a few hours. Iraq / Pakistan / Afghanistan etc. Out of the box the VXML Auto attendant lets you dial off switch!!! Yikes. I didn't know that until their miserable support guys told me you have to set up a specific dial plan for Voice mail. this in turn kills off any off switch features the voice mail can offer....



ACSS - SME

 

[amriddle01]

Good old splicecom, they do try

ACSS (SME)
APSS (SME)

http://www.ipoffice.tel

"I'm just off to Hartlepool to buy some exploding trousers

 

[hairlessupportmonkey]

all but one splicecom we did - now has an IPO in its place..

ACSS - SME