Unauthorized outgoing long distance 1

[desphoneguy]

I have a customer with a BCM400 that is experiencing unauthorized international long distance calls.

I ensured Outdialing and notification were not active in the voicemail class of service.

When I download CDR it only shows outgoing calls from the extensions which are in the Application Section of the SETS.

Any ideas how the calls are being made?

 

[Firebird Scrambler]

Is the BCM connected onto the Internet?. If so then unplug it now!. Then check the firewall to see if any ports are forwarded onto the BCM system. Very recently (In the past two days), we have discovered a problem whereby hackers have got in via port 443 and used the Mailbox Manager tool.

There will soon be an updated FAQ on this.

Also get all the mailbox accounts to have their passwords reset and remove any that aren't in use any more.

Check that DISA isn't in use.


Firebird Scrambler
Nortel Meridian 1 / Succession and BCM / Norstar Programmer in the UK
Advance knowledge on BCM support

http://www.linkedin.com/in/davidbromley

 

[desphoneguy]

Thanks for the path to find this.

What do you mean by Mailbox Manager?

 

[desphoneguy]

Also, FYI I do not see any incoming calls CDR only outgoing calls.

 

[curlycord]

Toll Fraud FAQ has now been updated:

http://www.tek-tips.com/faqs.cfm?fid=7861

Mailbox Manager is what users use to admin their own mailbox instead of using the phone:

http://BCM'sIPaddress/mailboxmanager

You might have been hacked the good ol fashion way (most common) by hackers dialing into the mailbox via AA at night and the users had a weak password like 1234 then the hacker changed the outdial number.

Activity Reporter only records last 4 days, it is in and out
Callpilot Mailbox reporting will record up to 7 days, in there you can see the out dial number if programmed.








________________________________________
We take the time to try to answer your questions for free, please return the favor and take the time to answer back and include any resolution you found elsewhere, thanks.

=----(((((((((()----=

http://www.curlycord.com

Toronto Canada

http://www.telcopc.ca

 

[desphoneguy]

I restricted the outdial access in class of service lets say on Monday and the CDR showed LD on Tuesday.

Again the CDR only shows outgoing calls it does not show incoming calls being routing out wards.

 

[Firebird Scrambler]

Has your BCM system got any SIP trunks or any IP sets that are remote (or even on site!).

Have you used the BCM Monitor tool and leave it running and watch for any incoming and outgoing activity.

I also used a tool found on my release 6.0 BCM called the CDR Live Client. I leave this running on my computer and it records all CDR activity.


Firebird Scrambler
Nortel Meridian 1 / Succession and BCM / Norstar Programmer in the UK
Advance knowledge on BCM support

http://www.linkedin.com/in/davidbromley

 

[cook1082]

What time of day are the calls being made? Could it be a cleaning crew at night dialing out?