PBX System Security

Following a number of PABX (Phone System) Hackings and the recent Information Notice released from ComReg, ATS would like to provide our customers with advice on PABX fraud prevention.

Internal telephone systems are frequently targeted by hackers in order to gain illegal access. If they succeed they are in a position, depending on the system, to alter the configuration of the system and to compromise the working of the system. Usually this will involve telephone fraud resulting in high cost international and premium rate services which can expose the company to charges running into thousands of Euro. Losses suffered in this way are the responsibility of the customer and not the supplier or network operator. 

There are a number of ways that fraudsters can hack into a phone system. Recently reported frauds involve hackers dialing every number in a range of DDI's to find the DDI assigned to the remote voicemail modem. Using software they will break the password and make a number of outgoing calls to test. They will then wait for the weekend of a holiday period when they will route huge numbers of international and premium rate calls through the system. This can continue until the customer receives their monthly telephone bill. Phone Hackers also get access to a phone system via the voicemail facility and crack the ''voice mail password'' especially if someone uses 1234 or 0000 as a password. Then they find a way of forwarding calls usually to International destinations. This activity normally happens at night and is finished by morning. 

While no system is invulnerable there are a number of basic measures that can be taken to minimise the risk of fraud: 

1. An overall owner of the system should be appointed.
2. Extensions or direct lines not assigned to individuals, that are possibly just ports in the wall, should be disconnected.
3. Eliminate the possibility of accessing an outside line from the outside through an auto attendant or voicemail. There should be no way of accessing dial tone by dialing into your PBX. 
4. Consider restricting the call forward to a trunk line facility. 
5. System passwords should be changed regularly. Ensure in particular that the system does not have the factory default password as they are readily available on the internet.
6. Set PABX to night service mode outside office hours.
7. By using products such as Ringmaster which have version which will look for abnormal traffic and which will alert you by text or email.
8. There are a number of other technical changes we can make on the system depending on your software versions.

If you are concerned about PBX fraud or would like more information on the issue please contact our ATS team on 01-2079500