<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<base href="x-msg://27/"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap: break-word;-webkit-nbsp-mode: space;-webkit-line-break: after-white-space">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Broadsoft had a fraud prevention best practices document that detailed disabling call forwarding and voice portal dialing through the voice portal. It addressed
password hardening as well. You should be able to find it on Xchange. Voice portal calling is dangerous, it can be used to place calls directly but I have also seen it used as a social engineering tool. There are some devious people out there with a lot of
time on their hands, if something can be exploited, eventually it will.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">At my prior employer we did the same thing as Mark suggests – disabling international forwarding/transfers across the board by default and requiring the customer
to sign a waiver if the capability was required.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Rob<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> voiceops-bounces@voiceops.org [mailto:voiceops-bounces@voiceops.org]
<b>On Behalf Of </b>Mark Holloway<br>
<b>Sent:</b> Friday, December 30, 2011 1:09 PM<br>
<b>To:</b> Zak Rupas<br>
<b>Cc:</b> voiceops@voiceops.org<br>
<b>Subject:</b> Re: [VoiceOps] Broadsoft SIP Trunks and ILD Fraud<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some items to check:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1) Do you have the voice portal enabled? If yes, are you allowing users to dial into the voice portal and enable call forwarding to a PSTN number?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2) Do you provide open access to the web portal? How is your username/password strength? Once a user account is hacked through the web portal call forwarding is typically enabled for fraud purposes.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3) If you have the voice portal enabled, are you allowing users to obtain outside dial tone to place calls from the voice portal?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">A best-practice I always observed was to modify the outgoing dial plan for every Group or Enterprise and disable international call forwarding/transfers. It is very rare customers in the U.S. require this and you are better off disabling
by default but having your Sales team ask up front when gathering customer requirements if they really need this enabled. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Dec 30, 2011, at 10:44 AM, Zak Rupas wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mark</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">All of SIP trunk customer have to Registers on the network. It’s a requirement we adopted some time ago. I also just checked and Bursting is disabled on my
latest account that had the issue. The had 5 SIP trunks but were averaging 20 CC ILD calls. So we may have encountered a Broadsoft bug. I am working on trying to come up with a plan for testing?</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:17.5pt;font-family:"Arial","sans-serif";color:#1F497D">Zak Rupas</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D">VoIP Engineer<br>
<br>
<b>SimpleSignal</b><br>
3600 S Yosemite Suite 150</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#1F497D">Denver, CO 80237<br>
One Number Rings All My Phones: 303-242-8606</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><image001.png></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"><a href="http://www.simplesignal.com/">SimpleSignal.com</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://www.simplesignal.com/blog">Blog</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://www.facebook.com/SimpleSignal?ref=ts">Facebook</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://twitter.com/simplesignal">Twitter</a></span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;border-width:initial;border-color:initial">
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> </span></span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Mark
Holloway [mailto:<a href="mailto:mh@markholloway.com">mh@markholloway.com</a>]<span class="apple-converted-space"> </span><br>
<b>Sent:</b><span class="apple-converted-space"> </span>Friday, December 30, 2011 10:38 AM<br>
<b>To:</b><span class="apple-converted-space"> </span>Zak Rupas<br>
<b>Cc:</b><span class="apple-converted-space"> </span><a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br>
<b>Subject:</b><span class="apple-converted-space"> </span>Re: [VoiceOps] Broadsoft SIP Trunks and ILD Fraud</span><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal">The IP PBX (or on-prem SBC) should be registering to Broadworks using the Pilot number. The SBC in your core will only allow SIP Invites from the registered device. If you have non-registered SIP Trunks in Broadworks this is very dangerous. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">On Dec 30, 2011, at 9:36 AM, Zak Rupas wrote:<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Good Morning Voice OPS</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Is anyone else experiencing anything like this? If so please share what you have done / or will to make it stop</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">We have a series of smaller SIP trunk customers using Broadsoft trunk groups. By design the trunk groups have a concurrent call limitation based off the customer’s order.
These smaller SIP trunks groups when compromised are able to run up HUGE fraud bills even tho they only have 5 or 6 SIP trunks. Needing to know if anyone else is seeing this that has Broadsoft and what was done to protect yourselves?</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Otherwise Happy NYE<span class="apple-converted-space"> </span></span><span style="font-size:11.0pt;font-family:Wingdings">J</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:17.5pt;font-family:"Arial","sans-serif"">Zak Rupas</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><br>
</span><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">VoIP Engineer<br>
<br>
<b>SimpleSignal</b><br>
3600 S Yosemite Suite 150</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial","sans-serif"">Denver, CO 80237<br>
One Number Rings All My Phones: 303-242-8606</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><image001.png></span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><a href="http://www.simplesignal.com/">SimpleSignal.com</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://www.simplesignal.com/blog">Blog</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://www.facebook.com/SimpleSignal?ref=ts">Facebook</a><span class="apple-converted-space"> </span>|<span class="apple-converted-space"> </span><a href="http://twitter.com/simplesignal">Twitter</a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica","sans-serif"">_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a></span><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>