Lucent Technologies BCS Products Security Handbook

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
About This Document 
Page xxi Lucent Technologies Toll Fraud Crisis Intervention 
Lucent Technologies Toll Fraud Crisis 
Intervention
If you suspect you are being victimized by toll fraud or theft of services and need 
technical support or assistance, call the appropriate Lucent Technologies BCS 
service:
NOTE:
These services are available 24 hours a day, 365 days a year. Consultation 
charges may apply. Intervention services are...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
About This Document 
Page xxii Related Documentation 
nFor assistance with the DEFINITY AUDIX System, call:
800 562-8349
nFor assistance with the MERLIN II, MERLIN LEGEND, MERLIN Plus, 
PARTNER II, PARTNER Plus, or System 25 Communications Systems, or 
their associated voice mail systems or other adjuncts, call:
800 628-2888
NOTE:
The above services may result in an additional charge. Intervention services 
are performed at no charge for...

Introduction 
Page 1-1 Background 
1
BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
1
1Introduction
Background
Telecommunications fraud is the unauthorized use of a company’s 
telecommunications service. This type of fraud has been in existence since the 
1950s when Lucent Technologies first introduced Direct Distance Dialing (DDD).
In the 1970s Remote Access became a target for individuals seeking 
unauthorized network access. Now, with the added capabilities of voice mail and...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-2 Who is the Enemy? 
1
Who is the Enemy?
Hackers and Phreakers
Hackers and “phreakers” (phone freaks) use personal computers, random 
number generators, and password cracking programs to break into even the most 
sophisticated customer premises equipment-based system if it has not been 
adequately secured. Once a hacker penetrates a network and provides 
instructions to toll call sellers, large volumes of...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-3 What is in a Loss? 
1
after detecting the fraud. However, call sell operators know that the traffic on most 
customer premises equipment-based systems is not monitored.
That is why a calling card on the street sells for $30.00 and a customer premises 
equipment-based system code (called a Montevello) sells for up to $3,000.00.
Drug Dealers
Drug dealers want phone lines that are difficult to trace so they can...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-4 Known Toll Fraud Activity 
1
nPBX-Based Activity
—Maintenance Port
Maintenance ports are the most recent target of abuse. In this 
scenario, hackers find a PBX maintenance port number with their 
“war dialer,” a device that randomly dials telephone numbers until a 
modem or dial tone is obtained. They then “hack” the user ID and 
password, sometimes just by using the PBX default passwords, to 
enter your system....

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-5 Known Toll Fraud Activity 
1
In the first situation, a hacker dials either 9 or a TAC that allows the 
call to be transferred to the outgoing facilities. In the second 
situation, a hacker typically hacks the mail password and changes it 
along with the greeting. This gives the hacker access to proprietary 
corporate information.
—Automated Attendant
Auto Attendants are used by many companies to augment or 
replace...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-6 Known Toll Fraud Activity 
1
nNetwork-Based Activities
—Shoulder Surfing
Network hackers use video cameras in airports supposedly to take 
pictures of their family, but they are actually taking pictures of people 
using their calling cards. Hackers may also use an audio tape 
recorder to capture calling card numbers as they are spoken to an 
operator. This technique is known as “Shoulder Surfing.”
—Social...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-7 Known Toll Fraud Activity 
1
Examples include, but are not limited to the following 800 numbers: 
1 800 COLLECT, 1 800 CALLATT, and 1 800 GETINFO. They could 
also dial 950 carrier access numbers.
Lastly, they can dial various 10xxx carrier access codes. In any 
case, they can still use the PBX to place a fraudulent call. If the PBX 
is not in New York, NY, they can use the calling card. Use of the 
10xxx codes...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Introduction 
Page 1-8 Known Toll Fraud Activity 
1
The fee charged for calling these numbers can range upwards of 
$250 per call. As already stated, the fee is set by the owner of the 
number. Unscrupulous people who own these numbers call around 
the country inserting these numbers into pagers to get the users to 
return the call so that they can collect the fee. Consult your LEC for 
a list of 976-look-alike numbers in your exchange....