PBX Fraud strikes Toronto. Some tips you can take to protect your system from toll fraud.

by Guest on December 1, 2009

telephone_security_device Twas a month before Christmas, and all through the office, not a creature was stirring, except for the hackers that had broken in and gave themselves access to make outgoing calls from one of Toronto’s marketing firm’s PBX system.  Access that allowed them to make calls to shell businesses over seas, earning them huge dollars in toll fees for every minute spent connected.

OK, maybe it was a little bit longer than a month before Christmas, but Rod Bell’s system was compromised by hackers that felt he was a good target to bilk out of thousands of dollars.  The worst part about it is how little support he has received from his telco.

After noticing an increase in his monthly bill (going from ~$250/month to $4000+ in August) Telus contacted Mr. Bell to inform him that he might have been compromised.  They suggested that he review his network setup, and change all of his voicemail passwords.  Apparently they neglected to block all toll numbers, as the next bill that Mr. Bell received was for over $70,000.  Mr. Bell has “successfully” negotiated them down to ~$32,000.

Telus’s excuse for this billing is ““They never let us off the hook when there’s a situation like that.” 

In order to protect your phone system from toll fraud, there are some basic precautions you can take.

There is a particular vulnerability within the Nortel Norstar and BCM system that makes it more prone to toll fraud. The feature is “through dialing”, and if not needed should be disabled. The feature is enabled on Nortel systems by default, thereby leaving it more vulnerable to toll fraud.

* Ensure your employees change the manufacturers’ default password immediately upon being assigned a voicemail box, and are trained to change the password frequently thereafter
* Program your voicemail system to require passwords with a minimum of 6 characters (8 is preferred – the more complex the password, the more difficult it is to guess)
* Train your employees not to use easily-guessed passwords such as their phone numbers, local number, or simple number combinations.
* When assigning a phone to your new employee, never make the temporary password the employee’s telephone number
* Program your voicemail system to force users to change their password at least every 90 days
* Validate if the through-dialling feature is needed, and if not it should be disabled. Through-dialling allows you to make long distance calls through your mailbox when you are at an offsite location.
* Remove all unassigned mailboxes

Some of the above tips are Nortel Norstar or BCM specific, but, they could also apply if you are running any system (Avaya IP Office, Cisco UCME …)

Written by: Jason Finnerty. www.digitcom.ca. Follow TheTelecomBlog.com by: RSS, Twitter, Identi.ca, or Friendfeed

{ 1 trackback }

Level 25 | Voice Over IP For Hotel-Motel Industry
February 9, 2010 at 5:14 pm


cell phone treasure December 1, 2009 at 3:04 pm

Fraud is the new ethics in 2009…

Joel December 2, 2009 at 6:41 am

Forgive me for the ignorance, but why is this news? This has been a problem for many years. Companies should be getting more diligent about security these days.

Since one company missed the boat on securing their phone system, now they cry to the media and beg for a deal on their bill.

Jeff, I think you can make tons of cashola just dropping into business’ and making the small changes to make phone systems more secure. Oh wait, then people will think you’re actually trying to hack their systems. Just can’t win…

Jeff Wiener December 2, 2009 at 12:48 pm

Thanks for the comments Joel. This has always been news – as long as there are phone systems, as long as there are loop holes, and long as there are people there will always be criminals looking to take advantage of others. And then, there will always be people looking to blame others for their misfortunes.

I write about toll fraud quite frequently. I speak about it, talk with customers about it, and yet, we still get at least 1 call / month related to toll fraud.

Daivd December 23, 2009 at 9:17 pm

Guess what, same thing happend to one of my customers.
The company that installed the phone system is the same as the phone lines (Bell Canada) and they never secured the BCM50 that they installed and configures!!!
Then they have the nerve to try and collect for the phone bill!!


Ernie December 24, 2009 at 8:46 am

So typical of Bell, it doesn’t come as a shock one bit.

Comments on this entry are closed.

Previous post:

Next post: