David, Make sure remote access is disabled. Make sure your not allowed to make outgoing calls from your voice mail box. Call your local phone company or service provider (whomever you have the DID numbers and phone service through) they can trace where this is coming from and they have a security department of their own. any modems connected to lines? they are probably war dialing against you two way trunks too, if they are war dialing. (disabling trunk to trunk connections was key) -----Original Message----- From: David Barnett [mailto:dbarn064at_private] Sent: Tuesday, June 24, 2003 6:41 PM To: incidentsat_private Subject: War Dial on my PBX My company's PBX system (Nortel Meridien) is getting hammered. All our DIDs are getting hit. Aside from disabling trunk to trunk, what could I do to help mitigate this problem. Another office last year was hit and through the voice mail system someone was able to make $25,000 worth of calls in a day. This was another system though. Any help is much appreciated. ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ---------------------------------------------------------------------------- *** END PGP DECRYPTED/VERIFIED MESSAGE *** ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Wed Jun 25 2003 - 20:05:09 PDT