Once a phreaker has successfully hacked into your PBX system

Protective Action 1: Avoid modem polls.1 Protective Action 2: Pass-thru dialing allows mailbox owners to dial into a Voice Messaging system and dial a code for an outside line. Fraud Scams 7. When a system answers, it is then compared to the known programming formats.2. (Also known as the "Prize" scam). Your employee is informed to visit a link on the internet or asked to install a program. Phreakers also recognize 'signatures' of systems.1 Vulnerability: Phreakers or scammers will use social skills to convince your employees to: - Release company information (mailbox log in procedures, switch room and modem numbers). - Lost password retrieval procedures.1 Protective Action 2: In cases where it is imperative that an extension be allowed to perform external transfers or call forwarding, create an internal procedure that sets: - Time of Day schedules for Call Forwarding (contact your vendor).2 Protective Action 3: You could place all of your modems in DND (Do Not Disturb). Instead, instruct employees to allow calls to be routed to their mailbox and to check their mailboxes regularly when away from the office. 

Once a phreaker has successfully hacked into your PBX system, he/she may exchange the information with other phreakers, implement Call Back schemes, or place long distance calls that are billed to your company. You'll never stop the attempts by phreakers to access your system, nor can you easily identify access attempts, but you can take steps to safeguard your PBX / Voice Messaging system.2 Protective Action 3: Set the software associated with modems to not auto-answer. 7. Many companies use modem pools to reduce the total cost of analog card ports. Perform an internet search for CLID Authentication modems or contact your vendor. Remote water pump cable Access 2. Your employee is asked to dial a number as a test. Related Websites: ·This connection path may be exploited by phreakers. Protective Action 1: Disallow auto-create mailboxes. - Area Code scams. Voice Messaging Systems 3. 5. 7.comArticle by Charles Carter.

 Your employee is informed to access an important message by dialing an 809 or 900 area code number.2 Protective Action 1: Verify with your vendor that all factory passwords have been changed or deactivated. 1. - If possible, change the Flexible Feature code associated with authorization codes at least once a year. 1. External Transfers - Call Forward External 4. The technician will connect via a modem to a system SDI (Serial Data Interface) port and log in to your system to perform the actions. Modems that are Direct Inward Dial should adhere to the discipline discussed in Step 2. - Change authorization codes on a regular basis. At a minimum the agreement should cover: - Password protection.2 Protective Action 3: Create and maintain a process that identifies how often passwords will be changed and 'triggers' that require system password changes.2.2. - Terminated employee procedures. To make a modem dial out only have your vendor program the extension as a non-Direct Inward Dial (DID). Workstation/Internal modems 6. 6. 3. 1. Employees could intentional take advantage of this feature to process non-business-related calls for themselves or friends. 6.1 Protective Action 2: Change your passwords frequently, especially if your company has a high number of employee turnovers. The act of sharing authorization codes exposes your company to possible employee fraud.2 Protective Action 1: Educate your employees on authorized contacts from your vendor or communications personnel. - http://www. Phreakers will also manually dial into your Voice Messaging system and attempt to breach your systems security features. The program then runs in the background and dials numbers.1 Protective Action 2: Determine if a modem will have dial in and/or dial out capabilities. Your employee is asked to forward calls as a test for a vendor.2. They must also contact the attendant when they are done programming. When your initial setup is complete - disable this feature. 4. Inform your vendor that they must call the attendant prior to dialing in so that the DND can be removed. - Dial a specific dial string or area code. Phreakers are savvy and are likely to know the authorization code procedures used by your particular system. - Regularly review calls associated with authorization codes.fraud. 4. 2. Most modems should be dial out only. 6. - Connect to external numbers or transfer to external numbers.2 Protective Action 3: Mailbox passwords should be as long as possible and employees should be encouraged to use the longest password. Phreakers use auto-create mailboxes as information exchange or pass-thru dialing points. 5. - Authorization codes should be as lengthy as your switch will allow. Protective Action 1: In most cases External transfer and/or Call forwarding isn't needed. 5.2. - Password creation procedures (avoid simple passwords or number sequences). 1.2. 2. Many software programs or emulation programs have built in security features that prevent unauthorized access.2. This is the most vulnerable setup. 4.2.1 Vulnerability: Some systems are installed with the default factory passwords still activated or unchanged. Many employees like to Call Forward calls to cell phones when out of the office - this is counter productive to your Voice Messaging system.2 Protective Action 1: Create and maintain procedures that encompass the following security procedures: - Cultivate non-sharing of authorization codes within your company. - A regular review of where calls are being routed. 3.1 Protective Action 2: Consider purchasing a modem with a CLID authentication feature.com.1 Vulnerability: Workstation/Internal modems not only provide phreakers with access to system resources, it also exposes your data network to hackers, worms and viruses. Calls made to the modem will be forwarded to your Attendants or a recorded announcement (RAN). Phreakers know your PBX / Voice Messaging system factory passwords and will try that password once connected. When a phreaker dials in and listens to the Voice prompts and instructions of you voice mail system, he/she recognizes what system they are communicating with and use that information to hack into the system.2. Phreakers take advantage of system interface vulnerabilities, known security (factory) passwords, and use social skills to obtain access to your system resources.1 Vulnerability: External transfers and forwarding exposes your company to employee fraud and phreaker activity.2. - Call Back scams.2. Vendors should always identify themselves.1 Protective Action 2: Ensure that authorization code entry is blind or hidden when entered on display phones and that redial of authorization codes is blocked.1 Vulnerability: Remote access allows vendors to access and perform maintenance or changes to your system remotely. Generally, phreakers use auto dialers to scan numbers that answer with carrier signals. 3. Factory Passwords 1. Authorization Codes 5. 6. Communicate with your vendor to determine what number they will be using.fcc.If your company uses a PBX / Voice Messaging system then you are being targeted by Phreakers (Phone Hackers).2. You may need to contact your vendor to activate these features.1 Protective Action 2: Educate your employees on existing scams and how to identify possible scams. The authentication feature checks the number dialing in and if it doesn't match the CLID authentication programming, the call is refused.

 Vulnerability: A Voice Messaging system is vulnerable when it is programmed with auto create mailboxes (also known as mailbox on demand), allows system to network transfers (pass-thru dialing), or uses default passwords when mailboxes are created. 2.3 Protective Action 4: Create and maintain an internal agreement with all Voice Messaging system users. - A regular review of calls associated with the extension. Phreakers use their social skills to convince employees to connect calls for them. This setting is usually enabled during installation to permit a quick setup. Modem pools allow phreakers and hackers to dial in and peruse your system for vulnerabilities. - Keep records of created authorization codes.cs2communications. 7. - New mailbox creation procedures. 2.2 Protective Action 1: Implement the protective actions in Step 1.1 Vulnerability: The most likely problem you will encounter with authorization codes is employee sharing. Existing/common scams: - Call Forwarding scams. 3. · communications.2.gov - Federal Communications Commission. Not only does this open your company to possible phreaker activity; it also exposes your company to employee fraud.com - Report suspected fraud. - Modem Hijack scams