<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Have you checked your UCM CDR records to see where calls to those numbers are coming from?
<div class=""><br class="">
</div>
<div class="">With an internal IP and only FXO ports the most likely source is a Unity Connection mailbox with a forwarding rule or something similarly shady. </div>
<div class=""><br class="">
</div>
<div class="">Tracking the calls inside your network is going to be key to finding out how they are getting triggered.</div>
<div class=""><br class="">
</div>
<div class="">Unless you have a business need to call Jamaica I’d also start by outright blocking calls to area code 876 at that router.</div>
<div class=""><br class="">
<div class="">-Ryan </div>
<br class="">
<div>
<div class="">On Sep 12, 2016, at 8:57 AM, David Zhars <<a href="mailto:dzhars@gmail.com" class="">dzhars@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class="">Hey Ryan,<br class="">
<br class="">
</div>
The telco said these POTS lines (four of them) were being used to dial Jamaica. The router has 4 FXO ports. For some reason, they were leaving the fourth line alone, though the telco felt that wouldn't last long.<br class="">
</div>
The router only has an internal non-routable IP addy.<br class="">
</div>
Only processes H.323 (but does allow telnet and SNMP)<br class="">
</div>
I don't know what PSTN egress means. Sorry!<br class="">
</div>
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Sun, Sep 11, 2016 at 11:49 AM, Ryan Huff <span dir="ltr" class="">
<<a href="mailto:ryanhuff@outlook.com" target="_blank" class="">ryanhuff@outlook.com</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" class="">
<div style="font-size: 12pt; background-color: rgb(255, 255, 255); font-family: Calibri, Arial, Helvetica, sans-serif;" class="">
<p class="">Hi David,</p>
<p class=""><br class="">
</p>
<ul class="">
<li class="">Did the telco say that the calls were originated from your POTS trunks or were they responding to customer complaints that one of your numbers had been reported to them for fraud ... etc?</li><li class="">Does this router have a public Internet facing interface?</li><li class="">Does this router process any other signaling protocols besides H.323?</li><li class="">You mentioned having Unity / Unity Connections ... are you allowing PSTN egress from Unity Connections / have you verified the restriction tables are correct?</li></ul>
<p class="">There are a number of things you could do on either side (UCM / Gateway). To cover the gap for the interim, I would at least deal with the specific called numbers that the telco gave you. In UCM, you could create specific route patterns in the egress
path that do not route the match. On the gateway, you could use voice translation rules to try and reject the call attempt or translate the number to something the carrier won't route. You could also create specific dial-peers for the called numbers that do
not route to anything.</p>
<p class=""><br class="">
</p>
<p class="">This reminds me of a time I had this issue (and I was a bit less mature); I created dial-peers on the CUBE that matched the 'bad' called numbers and I routed them back into CCM->CTIRp->CUC and had a small sample of Rick Astley's, "Never Gonna Give
You Up" playing as the opening greeting to a System Call Handler .... ahhh the younger days ....<br class="">
</p>
<p class=""><br class="">
</p>
<p class="">ANYWAYS ....</p>
<p class=""><br class="">
</p>
<p class="">I would say, in my experience, this sort of thing typically comes from the outside in. In cases where CUBE has a public Internet facing interface, usually someone finds something open on CUBE, sends some signaling that matches a dial-peer and off
it goes. In this case you'd want to look at some outside ACLs or putting a firewall between the public Internet and the CUBE. If your CUBE does not face the Internet or is on a private network like MPLS ... that is much less likely to be the case and you want
to start looking elsewhere on the network.</p>
<p class=""><br class="">
</p>
<p class="">I have seen bot dialers/Probers like '<a href="http://blog.sipvicious.org/" target="_blank" class="">SIPVicious</a>' (<a href="https://tools.cisco.com/security/center/viewAlert.x?alertId=33141" target="_blank" class="">Cisco even has an advisory
about it</a>) be able to access CUBE from the inside while installed on an infected PC. Granted, this tool is for SIP, but similar tools exist for h.323. <br class="">
</p>
<p class=""><br class="">
</p>
Thanks,<br class="">
<br class="">
Ryan<br class="">
<div class=""><br class="webkit-block-placeholder">
</div>
<div style="" class="">
<hr style="display:inline-block;width:98%" class="">
<div dir="ltr" class=""><font style="font-size:11pt" face="Calibri, sans-serif" class=""><b class="">From:</b> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank" class="">cisco-voip-bounces@puck.<wbr class="">nether.net</a>> on
behalf of David Zhars <<a href="mailto:dzhars@gmail.com" target="_blank" class="">dzhars@gmail.com</a>><br class="">
<b class="">Sent:</b> Sunday, September 11, 2016 9:37 AM<br class="">
<b class="">To:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank" class="">
cisco-voip@puck.nether.net</a><br class="">
<b class="">Subject:</b> [cisco-voip] Phone Fraud H.323</font>
<div class=""> </div>
</div>
<div class="">
<div class="h5">
<div class="">
<div dir="ltr" class="">So yesterday I was alerted by our landline company that some of our phone numbers that come in POTS on an H323 router, we being used for phone fraud. I am wondering how this happens with an H323 router (I am familiar with someone hacking
Unity and setting up actions to route to Jamaica once someone leaves a voicemail or similar).
<div class=""><br class="">
</div>
<div class="">The odd part is that these numbers are almost NEVER used for calling out, unless the user presses a 7 for an outbound line (versus an 8 which puts the call out on ISDN).</div>
<div class=""><br class="">
</div>
<div class="">I found a link on how to disable OffNet calling in UCM, but should I instead look at securing the H323 router? Or does the call blocking rule need to be done in UCM?</div>
<div class=""><br class="">
</div>
<div class="">Thanks for any enlightenment you can provide.</div>
<div class=""><br class="">
</div>
<div class="">PS- Client is in USA, call fraud to Jamaica which does not require a country code, so harder to block.</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
</div>
</div>
<br class="">
</div>
</body>
</html>