atcomsystems.ca/forum Forums TDM Business Telephone Systems Comdial Telephones & Systems Latest Comdial Bulletin on Toll Fraud

Did anyone else notice any problems with Comdial's latest bulletin regarding toll fraud in VM? Some of the instructions didn't quite seem correct. I emailed Comdial Tech Support about it, but have received no response, and the bulletin is still there, as-is. Maybe it's just me...

5Y&C:
I just took a look at it and didn't see anything odd. What is it that you found to be "not correct"? Maybe it's me--not you...

The part where it tells you to turn on outdial allowed in class of service. I can understand turning it on on the Line Information screen, but not in class of service. Doing so in class of service would allow a user (or malicious intruder) to log into a mailbox, press zero to make an outbound call, then dial the number and away they go. That kind of goes against the concept of preventing toll fraud. What it sounded like to me was that they meant to instruct you to turn it on on the Line Info screen, as this would be required for notification. Am I off base here, based on their instructions?

5Y&C:

Here is what they say:
******************
5. COS Create #1 and verify ‘Out Dial Allowed’ is set to “NO.”
6. Change the prototype mailbox to use COS 1.
7. Create COS #2 and set ‘Out Dial Allowed’ to “Yes” for those mailboxes that will need to use message delivery.
******************
# 5 allows NOo mailbox that is COS 1 to grab a line & dial out for any reason
# 7 allows COS 2 to outdial--this COS would only be for those who have pagers etc.

As far as I know (and I may be wrong here)--the "Outdial" option in Line Setup allows what ports are to be used for MW notification and outdialing---in otherwords which ports do you want to have the capability of doing that.

I think that they are saying that doing "outdials" from the mailbox is a weak security issue, possibly---but the other points that they mention, make the mailboxes more secure (passwords etc.) I think the term "message delivery" is somewhat misleading and should be "pager notification" or something like that.

Does this make any sense??

What I am saying is that "outdial allowed" in class of service is not required for message notification (message delivery to cell phone) or pager notification. It would only be required in the Line Info screen. That is why I am calling this incorrect. The way I am reading the bulletin, they are actually opening up more of a vulnerability. We always keep outdial allowed disabled in class of service, specifically for the purpose of preventing toll fraud. on every system with this disabled, we still have functional message and pager notification, because there are ports enabled for outdial in the Line Info screen.

OK...I stand corrected. I had always thought that you had to allow the MB to outdial for pager notification. I'll have to read the manuals again on this. It says--"This field indicates whether the owner of a mailbox belonging to this class of service is allowed to place outgoing calls from the mailbox." I had always read "outgoing calls" to mean "outgoing page notification" If you are getting pager notification without that being allowed, then it must be for something else. So, again, the "Message Delivery" phrase seems to be somewhat hazy in my mind. Let's see if JWooten, CMDLGuy, BigDog, markk, Tip or some of the others can shed some light on this. My head is starting to hurt.

According to section 7-18 of the manual this setting only effects the mailboxs user's ability to dial "0" from their mailbox's main menu to access a three-way cal trabsfer out of the mail box and does't effect the ability to exterbal notification or transfer the caller to an external number from the box.

Kerry

I just set mine up to call through by allowing it in COS. When I get to the mailbox and hit zero it asks for the number to transfer to, I put it in, and keylink says it's doing a 3 way call, but it never establishes a connection. It seems to put me on hold but it doesn't seize a line and dial. There must be some other required parameter. Appears this setting doesn't allow toll fraud.
mark

Mark,

I m not sure but I think that three way call transfer needs Centrex services on the trunk to work. Look at Sequence to Transfer Three way call and it should give you an idea.

Kerry

kerry,
centrex or 3 way calling on the line, and I have 3 way calling on the lines. I don't care to use it, I just wanted to see the senario in the thread. If I have to get out the manual, somebody has to get billed.
mark