<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
depending on how far you want to go:
<div class=""><a href="http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/7_1_2/ccmfeat/fsgd-712-cm/fsxfer.html#wp1043824" class="">http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/7_1_2/ccmfeat/fsgd-712-cm/fsxfer.html#wp1043824</a></div>
<div class=""><br class="">
</div>
<div class="">-w</div>
<div class=""><br class="">
<div>
<div class="">On Sep 13, 2016, at 12:54 PM, Erick Bergquist <<a href="mailto:erickbee@gmail.com" class="">erickbee@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Yep, seen that scenario a few dozen times with unity.<br class="">
<br class="">
Restriction tables and lock down CSS on CUCM side if unity does not<br class="">
need to make external calls. Use a separate CSS for Unity (don't<br class="">
re-use the LDCss, etc on voicemail ports/trunk).<br class="">
<br class="">
COBRA also doesn't include restriction tables, so those need to be put<br class="">
back in if you use COBRA to migrate to other server.<br class="">
<br class="">
I wish they would add option to class of service to not allow users to<br class="">
enable alternate transfer method. No good unity report to see when a<br class="">
user changed transfer method either.<br class="">
<br class="">
Erick<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
<br class="">
On Tue, Sep 13, 2016 at 6:11 AM, David Zhars <<a href="mailto:dzhars@gmail.com" class="">dzhars@gmail.com</a>> wrote:<br class="">
<blockquote type="cite" class="">The main problem, as Ryan pointed out, is more than likely weak voicemail<br class="">
passwords. Hackers are able to dial your main number and get an automated<br class="">
greeting, when they press (asterisk) they get the "welcome to voicemail"<br class="">
prompt. From there, it's pretty easy to start inputting extensions<br class="">
(especially if any are published on your website) and guessing passwords.<br class="">
Once they have that, they can input call forwarding details when someone<br class="">
receives a message, and just start calling that extension all the time. I<br class="">
have definitely seen THAT scenario before.<br class="">
<br class="">
Dave<br class="">
<br class="">
On Mon, Sep 12, 2016 at 10:39 PM, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" class="">lelio@uoguelph.ca</a>> wrote:<br class="">
<blockquote type="cite" class=""><br class="">
Oh, we definitely have dial-peers. Both inbound and outbound.<br class="">
<br class="">
I'm concerned because of the earlier comment about not all DIDs being<br class="">
accounted for.<br class="">
<br class="">
I'm pretty sure I have an "inward dial" config on each PRI. But not sure I<br class="">
have a num-exp for each.<br class="">
<br class="">
I'll double check my configs and share.<br class="">
<br class="">
Sent from my iPhone<br class="">
<br class="">
On Sep 12, 2016, at 10:11 PM, Nick Britt <<a href="mailto:nickolasjbritt@gmail.com" class="">nickolasjbritt@gmail.com</a>> wrote:<br class="">
<br class="">
Do a<br class="">
<br class="">
Sh run all | sec dial-p<br class="">
<br class="">
If you don't have any DP's in the config I would imagine you are OK.<br class="">
<br class="">
On Monday, 12 September 2016, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" class="">lelio@uoguelph.ca</a>> wrote:<br class="">
<blockquote type="cite" class=""><br class="">
<br class="">
Here's a question:<br class="">
<br class="">
We're using PRIs w/ MGCP so I'm assuming we're not affected. However, we<br class="">
have SRST configured, which I believe uses H323.<br class="">
<br class="">
Could this affect us as well?<br class="">
<br class="">
Lelio<br class="">
<br class="">
Sent from my iPhone<br class="">
<br class="">
On Sep 11, 2016, at 8:46 PM, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" class="">lelio@uoguelph.ca</a>> wrote:<br class="">
<br class="">
+1 here. By default with (the older?) IOS if someone dialled a number<br class="">
associated with the line plugged into your router, you'd get dial tone and<br class="">
from there you could dial an number the dial plan allowed.<br class="">
<br class="">
<br class="">
<br class="">
Sent from my iPhone<br class="">
<br class="">
On Sep 11, 2016, at 11:49 AM, Nick Britt <<a href="mailto:nickolasjbritt@gmail.com" class="">nickolasjbritt@gmail.com</a>><br class="">
wrote:<br class="">
<br class="">
Hi David,<br class="">
<br class="">
Can I ask Which version of IOS you are using?<br class="">
<br class="">
Also could you post your incoming dial peer configuration or are you just<br class="">
using the default DP 0?<br class="">
<br class="">
Ive experienced a similar issue before (luckily I didn't configure this<br class="">
particular deployment)<br class="">
<br class="">
Before IOS 15 (I believe) direct in ward dial was not applied to the<br class="">
default dial peer. This allows people to call in on an unnnallocated number<br class="">
with in the DID range and receive a dial tone. (Check it out quite scary)<br class="">
<br class="">
The resolution was to apply the command direct in wars dial to all<br class="">
incoming dial peers.<br class="">
<br class="">
I will try and dig out the link from Cisco.<br class="">
<br class="">
<br class="">
<br class="">
On Sunday, 11 September 2016, David Zhars <<a href="mailto:dzhars@gmail.com" class="">dzhars@gmail.com</a>> wrote:<br class="">
<blockquote type="cite" class=""><br class="">
So yesterday I was alerted by our landline company that some of our<br class="">
phone numbers that come in POTS on an H323 router, we being used for phone<br class="">
fraud. I am wondering how this happens with an H323 router (I am familiar<br class="">
with someone hacking Unity and setting up actions to route to Jamaica once<br class="">
someone leaves a voicemail or similar).<br class="">
<br class="">
The odd part is that these numbers are almost NEVER used for calling<br class="">
out, unless the user presses a 7 for an outbound line (versus an 8 which<br class="">
puts the call out on ISDN).<br class="">
<br class="">
I found a link on how to disable OffNet calling in UCM, but should I<br class="">
instead look at securing the H323 router? Or does the call blocking rule<br class="">
need to be done in UCM?<br class="">
<br class="">
Thanks for any enlightenment you can provide.<br class="">
<br class="">
PS- Client is in USA, call fraud to Jamaica which does not require a<br class="">
country code, so harder to block.<br class="">
</blockquote>
<br class="">
<br class="">
<br class="">
--<br class="">
- Nick<br class="">
<br class="">
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
<br class="">
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
cisco-voip@puck.nether.net<br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
</blockquote>
<br class="">
<br class="">
<br class="">
--<br class="">
- Nick<br class="">
<br class="">
<br class="">
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
<br class="">
</blockquote>
<br class="">
<br class="">
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
<br class="">
</blockquote>
_______________________________________________<br class="">
cisco-voip mailing list<br class="">
<a href="mailto:cisco-voip@puck.nether.net" class="">cisco-voip@puck.nether.net</a><br class="">
https://puck.nether.net/mailman/listinfo/cisco-voip<br class="">
</div>
</div>
</div>
<br class="">
</div>
</body>
</html>