Canadian IT company hit with $52,000 bill on toll fraud

SG Magazine bring the same old story we've heard before. misconfigured PBX, voice mail system with default or easy to guess PIN codes, unneeded options turned on (dial out via voice mail system TUI) and one or more individuals eager to make calls to Bulgaria on the expense of the unsuspecting Winnipeg-based HUB Computer Solutions.

Canadian SMBs suffer huge losses on toll fraud

The Hamilton Spectator reports that several small businesses on the Hamilton Mountain suffer huge loses due to voice mail toll fraud. now these cases are a few month old, but I'll still post it for reference.

The phreaker exploited weak/default PIN codes protecting the voice mail system and were able to dial in to the voice mail system and originate an outgoing international call, in similar to DISA or call forward exploits. it is also a reminder that toll fraud was here long before IPT.

These cases really sums up the recipe for a good toll fraud:

1. PBX and added value components configured in an insecure manner
2. Unneeded services and options are left on by default
3. Weak authentication meathods, default or easy to guess PIN codes
4. No monitoring of system utilization, call logs, abnormal events
5. And finally one or more indeviduals with the passion to call some exotic far away place or simply to make money on an unsuspecting PBX owner expense.