AT&T MERLIN LEGEND Release 3.1 System Planning Manual page 266

Customer Support Information
n
No one outside of AT&T needs to use the MERLIN LEGEND
Communications System to test facilities (lines/trunks). If a caller
identifies him or herself as an AT&T employee, the system manager
should ask for a telephone number where the caller can be reached. The
system manager should be able to recognize the number as an AT&T
telephone number. Before connecting the caller to the administrative port
of the MERLIN LEGEND Communications System, the system manager
should feel comfortable that a good reason to do so exists . In any event,
it is not advisable to give anyone access to network facilities or
operators, or to dial a number at the request of the caller.
n
Any time a call appears to be suspicious, call the AT&T GBCS Fraud
Intervention Center at 1 800 628-2888 (fraud intervention for System 25,
PARTNER
n
Customers should also take advantage of AT&T monitoring services and
devices, such as the NetPROTECT
CAS with HackerTracker
1 800 638-7233 to get more information on these AT&T fraud detection
services and products.
Security Risks Associated with Transferring
through voice messaging systems
Toll fraud hackers try to dial into a voice mailbox and then execute a transfer by
dialing * T. The hacker then dials an access code (either 9 for Automatic Route
Selection or a pooled facility code) followed by the appropriate digit string to
either direct dial or access a network operator to complete the call.
NOTE:
In Release 3.1 and later systems, all extensions are initially and by default
restricted from dial access to pools. In order for an extension to use a pool to
access an outside line/trunk, this restriction must be removed.
Preventive Measures
Take the following preventive measures to limit the risk of unauthorized transfers
by hackers:
n
Outward restrict all MERLIN LEGEND voice mail port extensions. This
denies access to facilities (lines/trunks). In Release 3.1 and later
systems, voice mail ports are by default outward restricted.
n
As an additional security step, network dialing for all extensions,
including voice mail port extensions, should be processed through ARS
using dial access code 9
A–12
System Planning
® ®
and MERLIN systems).
®
, and CAT Terminal with Watchdog. Call
SM
family of fraud detection services,