atcomsystems.ca/forum Forums TDM Business Telephone Systems Nortel Telephones & Systems Long distance fraud on a MICS

I got a call asking about how somebody hacked a MICS to make a call to a country in Africa. How do you suppose they did it? Verizon verified the call originated onsite. I have yet to vist the site to see if they have a FastRAD or not. I know this is senstive info so probably a PM reply is best.

Just confirmed they have no FastRAD.

Start here

So far I found a lockdown FAQ. Appears it was very likely the VM. Must go visit the site.

i have seen this many times before. it is happening thru the call pilot. The hacker calls in after hours,dials ext. until they find easy password,like 1234. also the mailbox has been set to option 8, outbound transfer. The hacker changes the trans number to
"uncle Joes" number in Uganda. Then they call back
and call the mailbox and dial 7. Off it goes to Uncle Joe. So the fix is NO EASY passwords, anywhere. If the user does not use outbound trans, then disable it in admin (983). good luck.

One more thing to look at is, is the BT secure, We had that problem in vegas with people going out and put a buttset on a line and make long distance calls..

If I have a customer that has a PRI I almost insist that they make passwords 7 Digits. Everyone always complains at first but I recommend that it be a Phone number ie cell phone , home number or somthing they dail all the time. The hackers will never take the time to try and hack those PWs. They have to many low hanging fruit with 1111 and 1234 passwords out in the Nortel world.

I have personally had a customer that was hacked over a weekend to the tune of over 10,000. I have had several over the years that have had smaller hacking bills as well. You have to let the customer know that it is not a option. With Toll calls costing less than 5 cents a minute LD carriers do not have the margins they used to have and are not as willing to let thise charges get written off especially when everyone knows that Nortel VM is very easy to Hack into.

I would go out to your customer right away. They are dialing for dollars while we sleep tonight.

Does the customer NEED intl dialing? Carriers can block that or get one voip box and put it on a different group.

On Samsung in 724 you could change the dial 9 to dial 7788, they would never guess it, same with Toshiba flex numbering plan.

Toll restrict the vm ports, lots of ways to solve this.