Avaya MERLIN MAGIX Maintenance And Troubleshooting Manual page 196

Preventive Measures
Take the following preventive measures to limit the risk of unauthorized use of the Automated
Attendant feature by hackers:
Do not use Automated Attendant prompts for Automatic Route Selection (ARS) codes or
I
Pooled Facility codes.
Assign all unused Automated Attendant selector codes to zero, so that attempts to dial these
I
are routed to the system attendant.
If Remote Call Forwarding (RCF) is required, MERLIN MAGIX Integrated System owners
I
should coordinate with their Avaya Account Team or authorized dealer to verify the type of
Central Office facility used for RCF. If it is a ground-start line/trunk, or if it is a loop-start line/
trunk and Central Office reliable disconnect can be ensured, then nothing else needs to be
done.
In most cases, these are loop-start lines/trunks without reliable disconnect. The local
telephone company must be involved in order to change the facilities used for RCF to
ground-start line/trunks. Usually, a charge applies for this change. Also, hardware
and software changes may be necessary in the MERLIN MAGIX Integrated System.
The Octel Messaging 100 Automated Attendant feature merely accesses the RCF
feature in the MERLIN MAGIX Integrated System. Without these changes being
made, this feature is highly susceptible to toll fraud. These same preventive
measures must be taken if the RCF feature is active for MERLIN MAGIX Integrated
System extensions, whether or not it is accessed by an Automated Attendant menu.
Security Risks Associated with the Remote
Access Feature
Remote Access allows the MERLIN MAGIX Integrated System owner to access the system from a
remote telephone and make an outgoing call or perform system administration using the network
facilities (lines/trunks) connected to the MERLIN MAGIX Integrated System. Hackers, scanning
the public switched network by randomly dialing numbers with war dialers (a device that randomly
dials telephone numbers, including 800 numbers, until a modem or dial tone is obtained), can find
this feature, which will return a dial tone to them. They can even employ war dialers to attempt to
discover barrier codes.
Preventive Measures
Take the following preventive measures to limit the risk of unauthorized use of the MERLIN MAGIX
Integrated System Remote Access feature:
The Remote Access feature can be abused by criminal toll fraud hackers if it is not properly
I
administered. Therefore, this feature should not be used unless there is a strong business
need.
Customer Support Information
6
6
Toll Fraud Prevention
A-13