Toll Fraud activity on Mitel Voicemail

[kwbMitel]

I don't know if it's just my territory or more global but I'm seeing a lot of activity on voicemail hacking.

Here is a copy of what I sent to my Mitel Rep recently

Mitel Embedded voicemails are a target of opportunity mainly in the hospitality industry.

A system is at risk in the following scenario
[ul]
[li]The voicemail system runs as an auto-attendant at any time during the day[/li]
[li]The voicemail ports are unrestricted for long distance and conferencing[/li]
[li]And either of the following:[/li]

[li]The Administrator mailbox (99, 999, 9999, 99999) has a default passcode[/li]
[li]Specifically, if the Technicians passcode is left at default (quite likely)[/li]
[li]The Attendant Mailbox (0) is left with a default passcode[/li]​

[li]With the above at risk, unauthorized persons can reconfigure the dial zero routing on the system to dial an external number for toll fraud purposes.[/li]
[/ul]
Remedy for hacked system
[ul]
[li]Change Administrators MB passcodes[/li]

[li]Technician[/li]
[li]Administrator[/li]
[li]Manager[/li]​

[li]Change the Attendant MB passcode[/li]
[li]Verify that the attendant mailbox dials the appropriate extension (0) or site specific extension.[/li]
[li]Access the personal directory numbers for the dial zero mailbox and verify none are set or that they are set appropriately[/li]
[li]Advise customer to avoid simple passcodes for regular mailboxes[/li]
[li]Verify that the Voicemail ports are restricted from dialing long distance[/li]
[/ul]


**********************************************
What's most important is that you realise ... There is no spoon.

 

[Billz66]

whay do they need the ports left at unrestricted ?
we just lock them all ( embedded and Nupoint ) to Country wide - not international , that stops any intereset , it seems that international and premium number calling is the main reason for hacks these days

If I never did anything I'd never done before , I'd never do anything.....

 

[pandabear1]

kwbMitel, I am close to your region and I have seen the hacking also of late, all good points

 

[kwbMitel]

@Billz66

Leaving the ports unrestricted is typically laziness or ineptitude on the part of the installer
Leaving the Tech passcode open is typically due to ignorance of its existence (especially on SX-200's)
Leaving the MB Zero at default might be due to false security or rarity of actual usefulness



**********************************************
What's most important is that you realise ... There is no spoon.

 

[sarond]

At least with the later versions the system enforces you to set a admin,manager and technician code in the VM Option form. (on 3300)