sundance-communications.com/forum Forums TDM Business Telephone Systems Nortel Telephones & Systems toll fraud

we had a customer call us about some erroneous charges on their phone bill and apparently someone is accessing there phone lines and making long distance calls out over them. There system is a nortel modular with applications module voicemail. We believe they are somehow accessing disa or through a mailbox. No phone lines are set up for disa. Can someone shed some light on how they are doing this, we can't seem to duplicate it.

They are not accessing DISA but most likely using the outbound transfer feature from someones mailbox. Set a new coordinator password on your NAM and program some dialing restrictions for the DN's assigned to the NAM. Then check all mailboxes and change the Outdial to None! These steps are by no means a complete lists of things to do but they should stop the calling!

A mailbox has been hacked.

Read the security post at the top of the Nortel forum.

Have all user change passwords. Don't use 1111, 1234 or other common codes. Remove outbound transfer from all mailboxes that are not using it, including the GDM.

And make sure the customer didn't get a call from someone saying they were the "phone company" requesting that they perform a *72 (whatever the call forward code is) on one or more of their CO lines, for testing purposes. Actually had that happen with one of our customers.

Do you have any SMDR call records for the calls?