<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Hello List,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>I’ve got a situation with
2 remote sites. Over the course of several days in late November, somehow
the analog POTS line in the site (which we use for SRST backup) proceeded to
make approx 4,940 calls to Cuba. There wasn’t really a pattern to
the calls. It started with a couple of repeated calls to the same number
and from that point, the dialed number changed (not dialed in any sort of
sequential pattern either). Calls varied in duration from 0 seconds to
many minutes long. Sometimes the next call would happen right away and other
times there would be several minutes delay between calls. This proceeded
to occur over the course of about a day and a half until the POTS provider
called us and we blocked the line.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>The analog line in the show home
serves 2 purposes. It is connected to the SRST FXO port on the Cisco 2801
router and also connects to the analog fax machine.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>At this point, the POTS provider
feels that somehow the 2801 router has been compromised and is being used to
route calls out the FXO port. We have a cordless phone on an ATA, and at
first they felt this was the source but I indicated that any calls from the
cordless phone would leave through our PRI in the main office, through the phone
line on the FXO port.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Even if someone had managed to
guess our admin password for the console of the router, I don’t believe
that person sitting on the Internet would be able to get a call to connect from
their computer, through the Internet, and leave out our FXO port in our site.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I’m wondering if anyone on
the list has some thoughts as to how the system could have been compromise or
if it just isn’t possible. The POTS line is actually a digital line
provided by Shaw (a local cable/telco in Alberta). I feel that their “digital”
phone terminal has been compromised though it isn’t connected to the
Internet in any way. One other possibility is old school phone phreaking
where someone has actually tapped into the physical line but they would have
been sitting outside in the cold for a very long time making these crazy calls.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>I look forward to any insight the
collective brain power of this list can provide. The bill for these calls is
over $6000.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Regards,<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Corbett Enders.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Corbett
Enders</span></b><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Network Manager<br>
Homes by Avi - 2007 Canadian Builder of the Year.<br>
Tel: (403) 536-7170<br>
Fax: (403) 536-7171<br>
</span><a href="http://www.homesbyavi.com"><span style='font-family:"Arial","sans-serif"'>www.homesbyavi.com</span></a><span
style='font-family:"Arial","sans-serif"'> </span><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'><o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>