Hacker 2

[firenut1]

can anyone help i have a mics 6.1 with a Nam 4.1 i have two T1 one is PRI thee other is a super trunk and the provider is Telepacific. I have re-programmed the entire voicemail with no Outdail, Turn off the allow redirect from the ksu,Also put a filter that allows only local calls all others must enter a COS password.

the biggest problem are international call and now long distance.

 

[bkrike]

international call and now long distance calls from where? Onsite, meaning from the employees, or from some outside entity calling in? Do you know?

The problem with telling you how to secure the system, is that in doing so it also tells any potential hackers how to get in.

What I can suggest is that you change all your voice mail passwords to something that is hard to guess (no 1111 or 2222, etc.) Also, delete all unused mailboxes. Don’t have any sitting around for "future" use. Don’t have any that have been abandoned.

You can also search the forum, as it has been discussed previously many times.

 

[NTL555]

To add to that... since you did build restrictions... did you restrict the line or the set? if you restrict the line... it'll restrict all the sets...

I would recommend getting some type of SMDR or account codes to place LD calls. This well it'll tell you when and where and what set placed the call.

NTL555

 

[hawks]

Did you assign the filter to the voice mail ports?

 

[curlycord]

Lockdown is in order!

Take all lines and all pool access away from voice mail DN's (all of them)
Edit ALL class of service's to not allow Outdial

Down load the Toll Fraud patch for NAM, reboot NAM with disk in, wait for long tone, reboot again, go into F815 and press Next until you see Outdial/Transfer and make sure it's set to NO.

Hook up laptop to NAM and use NVM to access mailbox list and delete any suspicious mailboxes the contact does not recognize.

Have customer call Teclo next day to report calls over night then again in a week.

 

[Bob3470]

Should that be Feature 915?

 

[firenut1]

were do get the toll fraud patch from.

 

[Norstarguru]

Ok, #1 SHut down international calling temporarily with the LD Provider, #2 if your LD Provider is tied into qwest you are going to get hit with National LD fraud after you lock this up, I have had so many Qwest Complaints it has been crazy. Now we need to get into your NAM to print some reports and find out which mailbox is the problem. Then we need to check the class of service and remove Off Premise anything, then we will restrict the voicemail ports from making LD calls.

norstarguru

http://www.1stalliancecom.com

 

[curlycord]

Sorry yes F915 (or 916,917,918)

Patch available at Nortel site if you are authorized.

 

[Norstarguru]

If you have remote access on the mailboxs and remote access is enabled. What will the patch do? Im curious on what this actually does.

norstarguru

http://www.1stalliancecom.com

 

[mad006]

Just FYI, I have had 14 system which have been hacked...guess what, they are all from Telepacific. (Focal circuits) Makes you wonder...

Just a data guy with a little knowledge, programming PBX for fun...

RT

 

[firenut1]

mad006, so what did you from happening again did you get them from hacking your NAM.if so please help.

 

[mad006]

Firenut1,

The NT patch is just another way of disabling redirecting in the NAM. Your best bet is to log in the NAM via NRU. Once your in, disable redirect, deny access for route/pool out dialing for all MB. Run a report to see all MB and delete the ones that your DB. (note: all MB that you or the hacker have created and set NO to display in directory will not show up when you scroll thru the directory, but it will show up in NRU MB report.) There are other report that will give you the past 7 days activity. You will also want to change the VM admin pwd and KSU pwd. There are other ways of preventing hackers coming into your system but I'll leave that to your local Nortel vendors.

RT

 

[mad006]

Firnut1,

re:
mad006, so what did you from happening again did you get them from hacking your NAM.if so please help.

If your system is connect to the PSTN there always be a way. All we can do is to change our pwd every so often and check the MB report. There's really no point of putting a CRD on the system and monitor the incomming calls to trace the hacker because, he or she most likely have hacked another system to get into yours...ect. As for your Telco provider, all they are going to do is just point fingers and transfer you to there toll fraud dept...big deal-while your stuck with the bill.

Best of luck,
RT

 

[Norstarguru]

restrict the voicemail ports from making long distance calls, restrict the mailboxes ie. class of service,that dont use off premise call forwarding from doing it, we can also setup routes for international calls from your location that is a special code so they do not try it with the common code.

norstarguru

http://www.1stalliancecom.com