<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns:v = "urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content=text/html;charset=iso-8859-1 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.18702">
<STYLE><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></STYLE>
</HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody lang=EN-US leftMargin=0 link=blue topMargin=0 vLink=purple
CanvasTabStop="true" name="Compose message area">
<DIV><FONT color=#000080 face=Tahoma>Hello Jason,</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma></FONT> </DIV>
<DIV><FONT color=#000080 face=Tahoma>The CME has intenret accessibility, but
with Natted IP.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>Its behind firewall, </FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>I think we were hacked by those pay phone
gangs,</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>they have some how scanned the system for
the CLID manipulation, once they found the matching four digit DID, they have
started sending calls using that DID.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>I traced the calls, they were going to
"dial to win " hold your call as long as to win prizes, blah blah.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>I don’t have any call pattern.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>But what amazes with the sophistication of
those gangs, it was done deliberately during weekend.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>I see SIP call legs in call logs, I don’t
have SIP configured in the CME, but I don’t have in " h.323 to sip and sip to
h.323 " conversion in voice service voip.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma></FONT> </DIV>
<DIV><FONT color=#000080 face=Tahoma>Still not sure how was it done, with CLID
manipulation.</FONT></DIV>
<DIV><FONT color=#000080 face=Tahoma>Please share any ideas.</FONT></DIV>
<DIV> </DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><FONT color=#000080 size=3></FONT><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=jason.aarons@us.didata.com
href="mailto:jason.aarons@us.didata.com">Jason Aarons (US)</A> </DIV>
<DIV><B>Sent:</B> Sunday, January 16, 2011 6:35 AM</DIV>
<DIV><B>To:</B> <A title=ahjawad@hotmail.com
href="mailto:ahjawad@hotmail.com">Jawad A Hai</A> ; <A
title="mailto:cisco-voip@puck.nether.net
CTRL + Click to follow link"
href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</A> </DIV>
<DIV><B>Subject:</B> RE: [cisco-voip] E1 call Fraud + h.323 Gw</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV class=WordSection1>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 11pt">Hopefully
the CME doesn’t have any Internet accessability? It’s behind a firewall
right?<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 11pt"><o:p> </o:p></SPAN></P>
<DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<P class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> <A
title="mailto:cisco-voip-bounces@puck.nether.net
CTRL + Click to follow link"
href="mailto:cisco-voip-bounces@puck.nether.net">cisco-voip-bounces@puck.nether.net</A>
[mailto:cisco-voip-bounces@puck.nether.net] <B>On Behalf Of </B>Jawad A
Hai<BR><B>Sent:</B> Saturday, January 15, 2011 1:21 PM<BR><B>To:</B> <A
href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</A><BR><B>Subject:</B>
[cisco-voip] E1 call Fraud + h.323 Gw<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Hello
Group,</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Recently I faced a
problem with one of my client, who has got E1r2,
DID/DOD.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">He has Cisco CME and
Cisco Voice Gateway.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Suddenly all 30 ports
got busy with international calls. All the calls are being generated by ONE IP
Phone which has got local extension 2000.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">This extension was
translated to DID number, so that any call goes out via this number takes the
DID and any call comes on this DID will land on this
Phone.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">The CME was configured
to access via outside with live IP. ie Live IP to Local IP
(NAT).</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Now the thing here is
all the calls which were generated are international calls, we rebooted the gw,
we rebooted the CME it stayed same..once it reboots all 30 ports got busy with
international calls.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">calls going to african
countries/russian countries( dial codes belongs to these
countries).</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">When I changed the
international dial peer on the CME they stopped.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">But catch here is they
have received more than 100 k USD bill from TELCO. DEAD DEAD Bang
Bang.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">What are the chances of
toll Fraud or any other way of hacking ?</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">OR could it be TELCO
side issue?</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Cuz I see mostly calls
are being generated by single DID number ??</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; COLOR: navy">Aali</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV></DIV>
<P>
<HR SIZE=1>
<P></P>
<P><STRONG>Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee, you are
hereby notified that you have received this communication in error and that any
use or reproduction of this email or its contents is strictly prohibited and may
be unlawful. If you have received this communication in error, please notify us
immediately by replying to this message and deleting it from your computer.
Thank you. </STRONG></P></BODY></HTML>