Lucent Technologies DEFINITY User Manual page 11

About This Document
Maintenance ports are their most recent target of abuse. In this scenario,
hackers find a private branch exchange (PBX) maintenance port number with
their " war dialer;" a device that randomly dials telephone numbers until a modem
or dial tone is obtained. They then " hack" the user ID and password, sometimes
just by using the PBX default passwords, to enter your system.
This is the most dangerous type of abuse because, once in your system, the
hackers have control over all the administrative commands. While in your
system, they have been known to:
Turn on Remote Access or Direct Inward System Access (DISA). Hackers
n
have been known to change the system at 8:00 p.m. to allow fraudulent calls.
Then, at 3:00 a.m., they reprogram the system back to its original
configuration. One company was hit three weekends in a row before it
realized what was happening.
Turn off Call Detail Recording (CDR) or Station Message Detail Recording
n
(SMDR), hack your system all weekend, then turn it back on before Monday
morning. This is especially disturbing to managers who are security
conscious and check the CDR/SMDR reports every morning looking for
suspicious activity. They will not see records of the calls because
CDR/SMDR was turned off by the hackers. The administrator may notice the
absence of CDR/SMDR records for evening, night, and weekend calls made
by employees.
PBX Security Measures
Everyone in your company who uses the telephone system is responsible for
system security. Users and attendants need to be aware of how to recognize
and react to potential hacker activity. Informed people are more likely to
cooperate with security measures that often make the system less flexible and
more difficult to use.
Implement the following general security measures to protect your PBX and
discourage the unauthorized use of your communications system.
Never program passwords or authorization codes onto auto-dial buttons.
n
Display phones reveal the programmed numbers, and internal abusers can
use the auto-dial buttons to originate unauthorized calls.
Discourage the practice of writing down passwords. If a password needs to
n
be written down, keep it in a secure place and never discard it while it is
active.
Attendants should tell their system manager if they answer a series of calls
n
where there is silence on the other end or the caller hangs up.
Users who are assigned voice mailboxes should frequently change personal
n
passwords and should not choose obvious passwords.
Issue 2.5 October 1999
xi