atcomsystems.ca/forum Forums Other TDM Phone Systems Telrad Telephones & Systems someone using our PBX to call cuba!

1.
Do you have Disa set up?


2.Set up forced account codes, I would also check the SMDR as it will tell you what station or stations are doing it, if it is going on in the day time it sure sounds like an employee is involved. I have run into this a few times and the account codes stopped it dead in the tracks because if it is from a hacker they won't be able to do it anymore and if it is an employee the will be able to be traced.

Also change your system program password just in case.

no we checked disa and it is disabled.

we changed passwods on pbx and vm and the calling has stopped

ayb

Years ago I had a customer with a similar situation. Their onsite tech had created a bunch of vm boxes in the 9XX range. Someone was calling their auto-attendant line and dialing extension 901. This would result in a trunk to trunk transfer (9 01) and the outside caller could then finish dialing an international call.

So would any VM box in the 9xx allow this or would it have to be 901?

I am checking now to see if I have any MB in that range.

also what is a trunk to trunk transfer and how does it work?
thanks
ayb

just checked no VM boxes in 9xx range.

Does anyone have any experience with the the call accounting package tapit 2000? According to our logs we show an Extension 845
[Which is not an extension as far as I can see, that is associated with a T-1 card]
placing a call on trunk 809
[a COL card with POTS line attached I think]
Which is making the connections to cuba and other places.

crazy

I've put in a several Tapit systems but I think you need a Telrad expert. Somehow someone is getting access to your lines via DISA or auto-attendant, etc.

It is not DISA as it's disabled.

I am on my second telrad expert at this point, the second being better than the first but even they are saying it is not anything they have seen before. Not the simple things with VM at least.

What we have learned:
we have a toll free number[one of many] that seems to be the point of entry and is even related to the point of exit.

This toll free has a local number associated with it something like 800-123-1234 and 212-123-1234.

What the billing is telling us is that all the LD calls are being billed to the local number 212-123-1234, this is a POTS line on a COL card using labeled Trunk 809.

So we have a T-1 with toll free traffic, and an associated POTS line.

The SMDR is showing that the extension dialing the LD numbers in cuba is usually 845, this to me is not an extension, our internal extensions are 200, 300, 400, and 500 numbers. 845 is a number associated with a t-1 card in the system.

As a test I tried the following:
ran smdr report showing all outgoing calls from trunk 809, got a list of dialed numbers and called one of them in canada. So this guy Mark answers and I proceed to ask him hwo called him at 2:28 today? He seemed like a nice enough guy and told me his sister had called at that time. So I thanked him and mentioned she might want to find a better wa to make her calls.

Anyway my experiment was to see how that called showed up in the smdr reporting so I wnet back to the reports and ran it for outbound from my extension 499. It showed the 3:32 call to the guy in the great white north 'eh

It also showed me how a true call should look coming from an ext 499 to a trunk 862 to Mark in Canada.

But after all this I still can't see how they are doing it. Our new Telrad vendor is going to escalate to Telrad Engineering to see if they have any ideas.

thanks
ayb

Forgot to mention that we took Tony's suggestion as well and set the class of service FWD COR to I for all of them.

thanks
ayb

Is there any value in updating our current system from PCP DB 6.05? What could we go up to without buying new hardware? I think that there is a firmware card or module that usually comes with these upgrades.

thanks again
ayb

I haven't worked on anything Telrad since the late '80s, but just a thought...

If '809' is the trunk number, is this a system code? I remember the Nitsuko DS01 had trunk numbers (801=line 1, 802=line 2, etc etc.) that if dialed would access that line directly.

In that case are there any mailboxes in the 8xx range (like 809)? Or any whos dial string could possibly access an outside line?