Switchboard scam costs companies millions
Namibian companies have lost more than N$6 million – and some say up to N$17 million – after their switchboards were hacked by “phreaking” syndicates.
International hacking syndicates have cost medium to large Namibian businesses more than N$6 million in fraudulent phone calls in February alone.
A number of companies have fallen prey to international syndicates who hack into Private Branch Exchange (PBX) systems, racking up between millions of dollars in unauthorised phone calls at the expense of the businesses.
This switchboard fraud is known as “phreaking” and takes place when hackers gain unauthorised entry to vulnerable telecommunications systems.
Telecom Namibia spokesperson Oiva Angula said on Friday that reported losses due to phreaking amounted to more than N$6 million, with the single largest loss reported to be in excess of N$2 million at an unidentified company.
A local insurance company was shocked to learn that it owed Telecom close to N$500 000 in late February.
Angula said only “a few” companies had been hacked to date and that Telecom technicians were working around the clock to help protect all PBX customers.
He could not confirm the exact number of companies affected, but unofficial sources said at least seven institutions had been hacked and there are unconfirmed reports that as much as N$17 million in fraudulent calls have been reported since January.
Angula explained that the legal liability for international call charges rested with customers, “so it is important that they remain vigilant regarding their PABX security.”
A meeting is scheduled for today, organised by affected businesses and concerned parties interested in learning how to prevent phreaking. Representatives of Telecom and the Communications Regulatory Authority of Namibia are expected to attend.
Angula explained that PBX hackers target systems that are vulnerable to unauthorised access, including call forwarding, call prompting and call processing features.
“But the most common ways phreakers enter a company's PBX is through Direct Inward Systems Access (DISA) and voicemail systems. They often search a company's rubbish for directories or call detail reports that contain a company's own numbers and PBX authorisation codes.”
Once the hackers have obtained the numbers and codes they can call into the PBX and place calls out to other locations.
Angula warned that in many cases the “PBX is only the first point of entry for such criminals. They can also use the PBX to access a company's data system. Call-sell operators can even hide their activities from law enforcement officials by using PBX-looping, using one PBX to place calls out through another PBX in another country.”
That was one of the reasons why phreaking was difficult to investigate, Angula said.
“As you can imagine the police authorities are hampered because so much of the problem is out of their jurisdiction. The developed world has recorded only a few successes of busting these syndicates,” he explained.
Unconfirmed reports indicate that some of the incoming calls were made from Spain, Austria and the UK.
Angula advised that there are a number of precautionary steps companies can take to prevent phreaking.
These including installing VoIP technology, regularly changing voicemail pass codes and avoiding using predictable or generic pin codes.
Companies are advised to disable call-through or set restrictions on the voicemail port. Moreover, inward direct dialling numbers should not be made available on a website where the public can access them, and companies should schedule routine PBX checks to assess the system vulnerabilities and minimise the chances of an attack.
JANA-MARI SMITH
A number of companies have fallen prey to international syndicates who hack into Private Branch Exchange (PBX) systems, racking up between millions of dollars in unauthorised phone calls at the expense of the businesses.
This switchboard fraud is known as “phreaking” and takes place when hackers gain unauthorised entry to vulnerable telecommunications systems.
Telecom Namibia spokesperson Oiva Angula said on Friday that reported losses due to phreaking amounted to more than N$6 million, with the single largest loss reported to be in excess of N$2 million at an unidentified company.
A local insurance company was shocked to learn that it owed Telecom close to N$500 000 in late February.
Angula said only “a few” companies had been hacked to date and that Telecom technicians were working around the clock to help protect all PBX customers.
He could not confirm the exact number of companies affected, but unofficial sources said at least seven institutions had been hacked and there are unconfirmed reports that as much as N$17 million in fraudulent calls have been reported since January.
Angula explained that the legal liability for international call charges rested with customers, “so it is important that they remain vigilant regarding their PABX security.”
A meeting is scheduled for today, organised by affected businesses and concerned parties interested in learning how to prevent phreaking. Representatives of Telecom and the Communications Regulatory Authority of Namibia are expected to attend.
Angula explained that PBX hackers target systems that are vulnerable to unauthorised access, including call forwarding, call prompting and call processing features.
“But the most common ways phreakers enter a company's PBX is through Direct Inward Systems Access (DISA) and voicemail systems. They often search a company's rubbish for directories or call detail reports that contain a company's own numbers and PBX authorisation codes.”
Once the hackers have obtained the numbers and codes they can call into the PBX and place calls out to other locations.
Angula warned that in many cases the “PBX is only the first point of entry for such criminals. They can also use the PBX to access a company's data system. Call-sell operators can even hide their activities from law enforcement officials by using PBX-looping, using one PBX to place calls out through another PBX in another country.”
That was one of the reasons why phreaking was difficult to investigate, Angula said.
“As you can imagine the police authorities are hampered because so much of the problem is out of their jurisdiction. The developed world has recorded only a few successes of busting these syndicates,” he explained.
Unconfirmed reports indicate that some of the incoming calls were made from Spain, Austria and the UK.
Angula advised that there are a number of precautionary steps companies can take to prevent phreaking.
These including installing VoIP technology, regularly changing voicemail pass codes and avoiding using predictable or generic pin codes.
Companies are advised to disable call-through or set restrictions on the voicemail port. Moreover, inward direct dialling numbers should not be made available on a website where the public can access them, and companies should schedule routine PBX checks to assess the system vulnerabilities and minimise the chances of an attack.
JANA-MARI SMITH
Comments
Namibian Sun
No comments have been left on this article