Toll Fraud & Hacking 3

[DaveThePhoneDoctorLV]

I just had a customer that had their Nortel hacked and was able to route over 600 calls to an international number via reprogramming the Centrex feature to transfer calls out and then they used a 1010 casual dialing code.

AT&T noticed a large call volume and contacted the customer. However before they called I started to get a lot of calls that VMB's needed their PW reset. I suspected there was something rotten in Denmark.

I always train customers to use a PW that is not easy. Of all the extension users that could have made it easy for the hackers to do this was the CFO.

When that VMB was set up I asked that the PW be a hard one but I noticed that the PW that was entered was 2222 despite my warning. That was the MB that was used for the calls to the international number!

I have now advised my customers to use a 7 digit number like their cell or home number.

What experiences have you been thru and what are you doing to prevent hacking and LD abuse?

 

[Khosher]

What type of Nortel system is it ?

 

[stsguy]

TRY THIS FAQ

WORK SMART NOT HARD

 

[DaveThePhoneDoctorLV]

MICS 6.1 with NAM 4.1

 

[Khosher]

Sorry man, no experience with that one.

 

[cwc3]

we deny forward to co and outgoing co access to voicemail ports
with the advent of message notify via email there is no reason for voicemail to outdial....

 

[hawks]

Also you do not use 1010 codes let your provider know that. Build restriction filters and assign to the VM ports and the lines.

 

[Westi]

I work mostly on Avaya IP Office and there are no default options like in the Nortel voicemail to log into the mailbox and then hit a key to get DISA functionality but some customers want it so it has to be custom built from the Auto Attendant and then I usually pick also a password that can not easily guessed and also only allow customers cell caller ID to access it.
Sorry NortelNate this is a problem where the manufacturer listened to clients requests without thinking of the implications it might have in the long run and then after tehy get hacked they complain about the product not being secure.
But to the fact that it was the CFO of the company that doesn't surprise me in the least ;-)

Joe W.

FHandw., ACSS

insanity is just a state of mind

 

[DaveThePhoneDoctorLV]

What is DISA functionality

 

[kwing112000]

Id is something like dial in system access or direct inward system access. it means you can dial into a system and get dialtone and dial back out.

Kevin Wing
ACSS Small and Medium Enterprise (SME) Communications
ACS- Implement IP Office
ACA- Implement IP Office
Carousel Industries

 

[DaveThePhoneDoctorLV]

any problems with IP based systems ie viruses easier toll abuse, employee access security issues,etc?

 

[Westi]

no problem because the security you have is that you need to create an account (User) before you can log on and if the settings (and there are many) don't match you are out of luck. It is sometimes hard enough to get an IP phone working if you know all the settings but if you don't then I guess hacking is no option.

Joe W.

FHandw., ACSS

insanity is just a state of mind

 

[DaveThePhoneDoctorLV]

What IP system do you like the best?

 

[cwc3]

I like the KX-NCP 1000

 

[Westi]

I started when the phones made the systems click when you made a call and when IP telephony was coming up I only worked on one brand and that is Avaya.
The Communications Manager is a very reliable system, and you pay for it. I like the IP Office because it has become very reliable and feature rich and you can be very creative with it.
I have heard good things about Shoretel and would love to give that a test drive but can't afford to buy one just for fun

Joe W.

FHandw., ACSS

insanity is just a state of mind

 

[DaveThePhoneDoctorLV]

what creative things can you do with AVAYA IP?

 

[cwc3]

Hey Nate why don't you hop on Norvayas website and check it out !

 

[Sympology]

Good things about IP systems (generally).

Well for one, we've had an ongoing battle with a Telco that mean't our Meridian Option11 was useless for 3 days. However in the meantime (i.e. two hours) we set up 14 accounts set up the phones, drove to site and threw them in. A working replacement in 2 hours. Well it's now going to stay, so the Teclo is just about to loose that contract.

Less ranting.
You can have a Voicemail, convert it to a wav fail and chuck it in an email. Then when they delete it from the email it wipes it from the system (if you want it to).
Remote set up is a breeze and most phone issues can be done with a reboot / reload.
Office move. Pah, tell them to unplug and move the phone. Even if it's a brand new site, it's a piece of cake.
Remote users can have softphones on the pc, VPN into site and away they go.
You can hook up SIP enabled mobile phones, so that calls to their extension ring if they have a wifi connection, with no billing costs.

Downside.
You need a damm good network!
Firewalls....Aaagggghhhh

Robert Wilensky:
We've all heard that a million monkeys banging on a million typewriters will eventually reproduce the entire works of Shakespeare. Now, thanks to the Internet, we know this is not true.

 

[DaveThePhoneDoctorLV]

So if the internet speed is not fast or if the customer has a network that is thrown together or has lots of issues then I assume they will carry over to the phone system?

 

[Sympology]

Yup...

You'll get break up, echo, delay and all sorts of nasties.



Robert Wilensky:
We've all heard that a million monkeys banging on a million typewriters will eventually reproduce the entire works of Shakespeare. Now, thanks to the Internet, we know this is not true.