Security Risks Associated With Transferring Through Voice Messaging Systems - Lucent Technologies MERLIN LEGEND Release 5.0 System Planning Manual

MERLIN LEGEND Communications System Release 5.0
System Planning 555-650-112
A Customer Support Information
Toll Fraud Prevention
Educate employees that hackers may try to trick them into providing them
with dial tone or dialing a number for them. All reports of trouble, requests
for moving extensions, or any other administrative details associated with
the MERLIN LEGEND Communications System should be handled by one
person (the system manager) or within a specified department. Anyone
claiming to be a telephone company representative should be referred to
this person or department.
No one outside of Lucent Technologies needs to use the MERLIN
LEGEND Communications System to test facilities (lines/trunks). If a caller
identifies him- or herself as a Lucent Technologies employee, the system
manager should ask for a telephone number where the caller can be
reached. The system manager should be able to recognize the number as
a Lucent Technologies telephone number. Before connecting the caller to
the administrative port of the MERLIN LEGEND Communications System,
the system manager should feel comfortable that a good reason to do so
exists . In any event, it is not advisable to give anyone access to network
facilities or operators, or to dial a number at the request of the caller.
Any time a call appears to be suspicious, call the Lucent Technologies
BCS Fraud Intervention Center at 1 800 628-2888 (fraud intervention for
System 25, PARTNER® and MERLIN systems).
Customers should also take advantage of Lucent Technologies monitoring
services and devices, such as the NetPROTECT
fraud-detection services, CAS with HackerTracker
with Watchdog. Call 1 800 638-7233 to get more information on these
Lucent Technologies fraud detection services and products.
Security Risks Associated with Transferring
through Voice Messaging Systems
Toll fraud hackers try to dial into a voice mailbox and then execute a transfer by
dialing . The hacker then dials an access code (either
*T
Selection or a pooled facility code) followed by the appropriate digit string to either
direct dial or access a network operator to complete the call.
NOTE:
In Release 3.1 and later systems, all extensions are initially and by default
restricted from dial access to pools. In order for an extension to use a pool
to access an outside line/trunk, this restriction must be removed.
SM
family of
®
, and CAT Terminal
1
for Automatic Route
9
Issue 1
June 1997
Page A-12