atcomsystems.ca/forum Forums TDM Business Telephone Systems Nortel Telephones & Systems BCM 400 Repeatedly Hacked - Any Recommendations?

I think I locked this one done but it was too harsh and interfered with something so we just had the telco block international 011 stuff.

They switched carriers and by golly, whammy! again!

Any recommendations to screwing down a BCM 400 v-4.0.2.03?

So I have to use my laptop to connect with Element Manager because some cartridge won't download to my desktop and one of our techs is using it because I'm apparently the only guy on the planet who has this old Samsung cable in his bag... but I can connect to the Call Pilot Manager...

Class of Services used are 1 and 9. Both have Outbound and Remote Notification set to NO.

If I run a report for Port Usage / Call Handling, it shows all ZEROS in the OUTGOING CALLS section for the last week.

I haD the customer try to make an 011 call from a phone and the phone's screen says, "RESTRICTED" and drops it.

CBeyond just reported 30 international attempts to the Middle East within 9 minutes from our main number (service is PRI).

Am I missing something or could they somehow have access to a CBeyond line and are spoofing our (my customer's) number?

Uff da!

The first post was my old Norwegian memory :confused: talking. The second post was after I logged in :scratch: ... disregard the very first post please.

?????? :shrug: If you hadn't logged in, you wouldn't be able to post.

Make sure all your MBs have no access to Pools or Lines.

Every sight is different so you will need to do what suits the customer.

KSU/BCM:
-Disable DISA and/or change COS password to something more secure.
-Setup restriction filters and have them applied to voice mail ports/DN's (if all users are to be restricted from out dial)
-Setup restriction filters and have them applied to lines and/or setup COS passwords to bypass restrictions.
-Disable Allow Redirect option for all sets.
Restriction example- Restrict 0 for overseas, 1 for local long distance, 900 for billing.


Voice Mail
-NAM's and Call Pilot (Voice Messaging) run the Toll Fraud Patches, for BCM's make sure your upgraded to latest patches.
-Delete all unused mailboxes
-Have ALL users change mailbox passwords to 6 or 8 digit non-trivial passwords, including General Delivery and System manager mailboxes.
-Disable Outbound Transfer/Dial/Pool Access in admin programming (COS) for each mailbox.
-Disable the "enable external initialization" feature in COS
-Setup lockup mailbox after so many unsuccessful password attempts
-You could slow a hacker down by disabling the Return to AA option but this will effect checking messages remotely.

Carrier/Telco
-Have them restrict oversea calls if you don't call overseas and/or have them setup passwords.
They maybe also be able to restrict certain digits (filter).
You may not need the Telco involved if you did the above but the choice is there.


Who called over sea's
Usually voice mail is the culprit from an outside hacker but DISA and forwarded sets can be an issue as well.
You would need to setup an SMDR to see what ext. made the call or run reports from voice mail....see your vendor for more details.