sundance-communications.com/forum Forums TDM Business Telephone Systems Samsung Telephones & Systems Help Help - VM Hacking

Hi All

Got some little twats trying to hack my customers VM.

They cant do anything, but there busying up the lines.
The system is OS 7030, the VM cant dial out via VM from either mailboxes or extensions, only via the dial function to the pre-programmed numbers.

Currently, the calls hit the night VM service which allows the incoming user to only leave a message. Ive set all other options to hangup, which when i dial in works fine. however the shites still seem to come inbound and manage to dial my operator group, which ive disabled them from doing.

Ive tried myself, and if you keep hitting loads of numbers, it finally goes through to my operator group.

However this is still happening thru the day in day mode and again all lines are tied up.

No idea how to stop this. Its not costing call cost, but causing issues with incoming calls.

And checking call logs, they dont have a number so cant bar them, and VM not showing any info on incoming call, so not sure if they are some how bypassing the VM immediatly.

Ohh and the incoming lines are SIP, theres no ISDN or the like. So it quickly hits my Sip Trunk license limit.

Any help most appreciated. Customer not happy, but what else can i do, as the system is secured as far as it can be. ??

regards

Adam Roberts

Do you know the phone numbers of the hackers you could always block them

Whoops did't read all the message sorry

Preferably, turn off port forwarding for port 5060 in your firewall, and set Alive Notify to Options, and set an appropriate notify time to keep the port open to your provider. This will stop "drive by" SIP connections.

Otherwise, set your firewall to only allow SIP connections from your SIP provider. Remote clients such as SIP extensions should use a VPN.

Hi

Thanks for replys, The router is crap BT one, cant program for specified incoming IPs, for some reason they wont use the Draytek i had installed.

It looks like they are hitting the router, and not coming in over the phone number, or via the SIP trunk supplier.

Going to setup port mirroring and monitor incoming data on the sip port.

Think best way it to replace router again and only allow traffic from allowed SIP provider IP.

Which is what I normally do, but BT routers are so limited.

Reason why i never use any router than Draytek
its made for ip

Whitelists?

Or if they are coming in via the SIP trunk provider trying to hit the VM and not getting anywhere then they will soon give up.

Annoying little twits, we answer live 24/7, the number of bloody hang ups we get is ridiculous. We log the number google it and either no info or obviously spoofed numbers. The spoofing has got to stop but with all these mom and pop CLEC's I don't see it happening anytime soon.
Off the soap box,
John

Tell the menu in vm that whenever the number for the group is dialed, set it to go goodbye. That will block it from allowing numbers to be dialed. In the night menu, delete the ??? entries. This will force them to only do what the AA tells it to do.