atcomsystems.ca/forum Forums TDM Business Telephone Systems Panasonic Telephones & Systems Interesting Panasonic hack discovered today

Over the years, we've seen that Panasonic voice mail systems are fairly easy targets for hackers since they are so well-known worldwide. I've seen all kinds of things done with them, mostly through setting up outward notification dialing strings. I ran into one today that was interesting:

The customer complained that their last line often is lit up, as in use, but nobody in the office is using it. This only occurs for about 15 seconds at a time. My coworker immediately suggested that this might be message notification by the voice mail. That part was fairly easy, but finding that one mailbox that had notification turned on was likely to be like finding a needle in a haystack. Fortunately, this was a small office and they didn't even have a clue how to use this feature.

Oh a whim, I went into the receptionist's mailbox (101) and sure enough, there were three hang-up calls that ended up as recorded messages in the wee hours of the morning over the past few days. Upon checking the outdialing settings, I found that someone has stored the string 81 (CO line 1), pause, *72 (CO call forwarding), pause,
011 + 63 (country code for the Phillipines), then 9XXXXXXXX, pause, pause and #. Upon further investigation, I learned that any numbers prefaced with 9 in the Phillipines are cell phone numbers.

So in this instance, once a message was left (legitimate or not), the system would go off-hook and forward their number via CO forwarding to an international number. I never investigated what this number in the Phillipines is, but I can only imagine that it isn't good. The customer's main number was forwarded there (with unknown cost) the first time that a message was left in the receptionist's mailbox.

Of course, a simple fix was to delete this stored number and advise the customer to have international calling blocked on their account with Verizon. Panasonic voice mail system hackers are professionals, so passwords won't help a bit.

My suggestion is to disable outward dialing on any voice mail system ports unless the customer really uses this antiquated feature.

The easiest part about outward dialing is you can disable it for the voice mail ports, but use trunk-to-trunk and spare 3-digit codes (4xx-5xx-6xx) of ICD groups to be able to dial a specific arranged number. We put owners cell phones in those groups and a transfer to those numbers will set up the off premise call. Making sure that you have the 3.xx or greater VM with the digit screen will also help. I allow only digit 1 or 4 (usually) to be dialed as a first digit and it cuts down the attempts because the VM simply plays the "you screwed up" message.

Carl

We, like Carl, lock down the voicemail to not allow the voicemail system make calls. make sure the managers mailbox is password protected or no phone access. and cos of mailboxes will not allow external notification, remote call forwarding enabling through mailbox, if they want this we will give them e-mail with wav attached

For the hackers to setup anything in the customers mailbox they have to access the managers one first to allow it. Never trust the user to secure their mailbox.