<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#666666" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Did you have a look at the phone it
self already?<br>
<br>
Is call forwarding activated or something and can you call the
phone/extension from externally?<br>
I have seen this in the past where an employee enabled call
forwarding on the phone and once at home he or family called the
phone which forwarded the call to abroad. <br>
<br>
Good luck. Michel.<br>
<br>
Op 29-01-15 om 12:51 schreef <a class="moz-txt-link-abbreviated" href="mailto:dk@donkelly.biz">dk@donkelly.biz</a>:<br>
</div>
<blockquote cite="mid:040d01d03bb9$f7708780$e6519680$@donkelly.biz"
type="cite">
<pre wrap="">It's very unlikely that this was an employee calling Mom for 66 hours (I'm
assuming these calls appeared on a single bill). It's also unlikely that
someone "inside" would benefit financially from making these calls. (Follow
the money!) Don't discount the possibility that you've overlooked something
in the firewall.
Meanwhile, does the client need to do international calling? If not, they
may request that international calls be blocked by the carrier; once
blocked, any international calls are the carrier's responsibility, not the
client's.
--Don
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:asterisk-users-bounces@lists.digium.com">asterisk-users-bounces@lists.digium.com</a>
[<a class="moz-txt-link-freetext" href="mailto:asterisk-users-bounces@lists.digium.com">mailto:asterisk-users-bounces@lists.digium.com</a>] On Behalf Of Dave Platt
Sent: Thursday, January 29, 2015 12:11 AM
To: <a class="moz-txt-link-abbreviated" href="mailto:asterisk-users@lists.digium.com">asterisk-users@lists.digium.com</a>
Subject: Re: [asterisk-users] Investigating international calls fraud
</pre>
<blockquote type="cite">
<pre wrap="">Hmm the calls are made during the day (and sometimes very early in the
morning). Right now it looks like someone actually made these calls.
If that is the case it's somewhat comforting to know the system wasn't
compromised. However, the $25,000 phone bill still remains. Yikes.
$6.25 per minute to Cambodia seems quite steep to me.
</pre>
</blockquote>
<pre wrap="">
Since the Mitel had a default admin password, it seems possible that
somebody accessed its UI over the network, and then accessed and copied its
SIP credentials for your Asterisk server.
If that's the case, the calls might not have been placed through the phone.
The miscreant could have configured the purloined credentials into another
hardphone, or a softphone app on any PC or tablet or cellphone which was
able to access your LAN.
The "cloned" phone would not have needed to actually register with
Asterisk... it could simply have send an INVITE to place a call, and
Asterisk would have challenged it and then accepted the credentials.
If your CDR log shows IP addresses for each call, you might be able to
compare these with your DHCP (or whatever) IP registration service, and see
if the calls actually came through the phone or not. If not you might be
able to identify the device which initiated the calls.
The bad news is, I suspect that you're probably "on the hook" for the cost
of the calls. In the case of an "inside job" it's often hard to
legitimately "disavow" the charges. You may have to pay the bill and then
(if you can identify whomever placed the unauthorized calls) attempt to
recover the cost from him/her in court. This sort of misused by an insider
might be "theft by conversion".
--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a> -- New to
Asterisk? Join us for a live introductory webinar every Thurs:
<a class="moz-txt-link-freetext" href="http://www.asterisk.org/hello">http://www.asterisk.org/hello</a>
asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-users">http://lists.digium.com/mailman/listinfo/asterisk-users</a>
</pre>
</blockquote>
<br>
</body>
</html>