<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div>It’s the old story locks are only for honest people. Spammers/Scammers almost always find a way to get their stuff through but legitimate emails get blocked.</div><div><br></div><div>Which is not to say one shouldn’t lock things down as tightly as possible, and adjust security regularly or as required. Had one customer the hackings had been probing for 5 years, on /off /burst, Until they finally found a small crack then the flood of spam and different site VOIP calls.</div><div>Check your logs regularly.</div><div><br></div><div><div>Cheers,</div><div>Chris Hurley </div><div><br></div></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Geneva; font-size:10pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>> on behalf of Andrew Yager <<a href="mailto:andrew@rwts.com.au">andrew@rwts.com.au</a>><br><span style="font-weight:bold">Date: </span> Saturday, 28 October 2017 at 2:54 pm<br><span style="font-weight:bold">To: </span> Mark Stewart <<a href="mailto:mark@nabc.com.au">mark@nabc.com.au</a>>, Matt Perkins <<a href="mailto:matt@spectrum.com.au">matt@spectrum.com.au</a>>, jay binks <<a href="mailto:jaybinks@gmail.com">jaybinks@gmail.com</a>>, "<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br><span style="font-weight:bold">Subject: </span> Re: [AusNOG] High number of inbound automated Chinese language calls on AAPT CTS<br></div><div><br></div><div><meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"><meta content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style>
<!--
@font-face
{}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Consolas}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
pre
{margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"MS Gothic ;color:#1F497D",serif;
color:black}
p.msonormal0, li.msonormal0, div.msonormal0
{margin-right:0cm;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black}
span.hoenzb
{}
span.m-8785849150445671491hoenzb
{}
span.HTMLPreformattedChar
{font-family:Consolas;
color:black}
span.EmailStyle23
{font-family:"Calibri",sans-serif;
color:windowtext}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.WordSection1
{}
-->
</style><div bgcolor="white" lang="EN-AU" link="blue" vlink="purple"><div id="compose-container" itemscope="" itemtype="https://schema.org/EmailMessage" style="direction:ltr"><span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span><div><div><div style="direction:ltr">They are spoofing source CLI so masking/monitoring CLI is useless. We have had downstream customers whose business has been significantly impacted by having their CLI used recently as an advertised number in scams similar to this
at least twice this year.</div><div><br></div><div style="direction:ltr">Someone has loose ACLs on their inbound and doesn’t check their customers properly... :(</div><div><br></div><div style="direction:ltr">And yes, it definitely isn’t limited to AAPT. Just had one today to my DID on a Symbio inbound number.</div><div><br></div><div style="direction:ltr">Andrew</div></div><div><br></div><div class="acompli_signature">Get <a href="https://aka.ms/o0ukef">Outlook for iOS</a></div></div></div><hr tabindex="-1" style="display:inline-block; width:98%"><div id="divRplyFwdMsg" dir="ltr"><font face="Calibri,sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> AusNOG <<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>> on behalf of Mark Stewart <<a href="mailto:mark@nabc.com.au">mark@nabc.com.au</a>><br><b>Sent:</b> Friday, October 27, 2017 5:12:18 PM<br><b>To:</b> Matt Perkins; jay binks; <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><b>Subject:</b> Re: [AusNOG] High number of inbound automated Chinese language calls on AAPT CTS</font><div> </div></div><div><div class="WordSection1"><p class="MsoNormal"><span style="color:windowtext">Had a conversation with my Telstra guys this week in relation to phone system hacking where phone systems were being breached and then systematically being used to autodial numbers.</span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><p class="MsoNormal"><span style="color:windowtext">The breaches can be occurred via –</span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><p class="MsoNormal"><span style="color:windowtext">Voicemail port hack is where their default pin number for their voicemail is the same has their 100 dial in number.</span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><p class="MsoNormal"><span style="color:windowtext">SIP / VoIP credentials can be hacked / obtained and then assume that SIP network.</span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><p class="MsoNormal"><span style="color:windowtext">Alternatively, their entire network has been hacked and the hacker is sniffing for IP Phone system and then interface into it to make calls.</span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><p class="MsoNormal"><span style="color:windowtext"> </span></p><div><div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal"><b><span lang="EN-US" style="color:windowtext">From:</span></b><span lang="EN-US" style="color:windowtext"> AusNOG [<a href="mailto:ausnog-bounces@lists.ausnog.net">mailto:ausnog-bounces@lists.ausnog.net</a>]
<b>On Behalf Of </b>Matt Perkins<br><b>Sent:</b> Friday, 27 October 2017 12:33 PM<br><b>To:</b> jay binks <<a href="mailto:jaybinks@gmail.com">jaybinks@gmail.com</a>>; <a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><b>Subject:</b> Re: [AusNOG] High number of inbound automated Chinese language calls on AAPT CTS</span></p></div></div><p class="MsoNormal"> </p><div><p class="MsoNormal">Hi Jay,<br>
Unwelcome Communications procedure only work when you have the source numbers. It's hard to give the CTS provider ~10,000 source numbers ;) They are trying however to chase it up. No it's not coming from a sip gateway. This equipment is not on the internet.
<br><br>
Matt.<br>
<br><br>
On 27/10/17 3:22 pm, jay binks wrote:</p></div><blockquote style="margin-top:5.0pt; margin-bottom:5.0pt"><div><p class="MsoNormal">There are methods for dealing with unwelcome or nuisance calls.
</p><div><p class="MsoNormal">It's not always effective, but its worth a try.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">If your calls fit the definition of an "UNWELCOME COMMUNICATIONS" you may be able to utilise
<a href="http://www.commsalliance.com.au/Documents/all/codes/c525">http://www.commsalliance.com.au/Documents/all/codes/c525</a>.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">The OP may have a claim to this with 3000 calls within 4 hours.</p></div><div><p class="MsoNormal">Contact your CSP. <i>"C/CSPs must assist end users in receipt of unwelcome messages where it is reasonably possible to do so "</i> </p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">They may only pass the complaint on to the originating carrier, but you might get lucky.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">The other thing I initially thought of when I saw this ( but it seems like its probably not the case after reading other peoples accounts ).</p></div><div><p class="MsoNormal">Make sure your SIP equipment only accepts SIP from your SIP provider. Sometimes you find people scanning your network, doing this sort of thing.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Good luck !</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Jay</p></div></div><div><p class="MsoNormal"> </p><div><p class="MsoNormal">On 27 October 2017 at 14:12, Matt Perkins <<a href="mailto:matt@spectrum.com.au" target="_blank">matt@spectrum.com.au</a>> wrote:</p><blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm"><div><div><p class="MsoNormal">The volumes we are getting are stunning if it's not targeted at AAPT. as it appears it's not from some of the on/off list responses. We have had over 3000 calls in the last 4 hours. This has been going on for almost 4 days.
<br><span style="color:#888888"><br><br><span class="hoenzb">Matt.</span></span> </p><div><div><p class="MsoNormal"><br><br><br>
On 27/10/17 2:51 pm, <a href="mailto:Tom.Minchin@csiro.au" target="_blank">Tom.Minchin@csiro.au</a> wrote:</p></div></div></div><div><div><blockquote style="margin-top:5.0pt; margin-bottom:5.0pt"><div><p class="MsoNormal" style="background:white"><span style="font-family:"Arial",sans-serif">We are getting runs of these to a Sydney and a Melbourne site. We are Telstra inbound.</span></p></div><p class="MsoNormal" style="margin-bottom:12.0pt"><br><br></p><div><p class="MsoNormal" style="margin-bottom:12.0pt">On Fri, Oct 27, 2017 at 1:55 PM +1100, "Andrew Yager" <<a href="mailto:andrew@rwts.com.au" target="_blank">andrew@rwts.com.au</a>> wrote:</p><blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm"><div><div><p class="MsoNormal">Hi Matt, </p><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">We have seen multiple instances of this over the last couple of months to different number blocks.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">It's usually a Mandarin message claiming to be from the ATO.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Have logged a few complaints on a few of them; have not got anywhere useful because each number is called "once" and doesn't meet the threshold for a nuisance claim.</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">If any of my upstreams want to care though… I'm happy to provide more details… :) (nudge… nudge…)</p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">Andrew</p></div><div><p class="MsoNormal"> </p></div></div><div><p class="MsoNormal"> </p><div><p class="MsoNormal">On 27 October 2017 at 13:34, Matt Perkins <<a href="mailto:matt@spectrum.com.au" target="_blank">matt@spectrum.com.au</a>> wrote:</p><blockquote style="border:none; border-left:solid #CCCCCC 1.0pt; padding:0cm 0cm 0cm 6.0pt; margin-left:4.8pt; margin-right:0cm"><p class="MsoNormal">Here's some Friday fun.<br><br>
Are there any people with AAPT CTS that are receiving very high volumes (500 an hour) of a Chinese language automated message. Numbers dialed in appear to be random within a routed ranges they also appear to be using random calling id's some start with 028009XX.
Im told that the message says it's from the Chinese consulate and ask you to push zero. I suspect they are trying to determine which numbers have Chinese language speakers answer for some later scam. But only appears to be on AAPT CTS. We have CTS with a
few other carriers and seeing nothing on those inbound.<br><br>
Interested to see if others are receiving same.<span style="color:#888888"><br><br><span class="m-8785849150445671491hoenzb">Matt.</span><br><br><br><br><span class="m-8785849150445671491hoenzb">-- </span><br><span class="m-8785849150445671491hoenzb">/* Matt Perkins</span><br><span class="m-8785849150445671491hoenzb"> Direct <a href="tel:1300%20137%20379" target="_blank">
1300 137 379</a> Spectrum Networks Ptd. Ltd.</span><br><span class="m-8785849150445671491hoenzb"> Office <a href="tel:1300%20133%20299" target="_blank">
1300 133 299</a> <a href="mailto:matt@spectrum.com.au" target="_blank">matt@spectrum.com.au</a></span><br><span class="m-8785849150445671491hoenzb"> Level 6, 350 George Street Sydney 2000</span><br><span class="m-8785849150445671491hoenzb"> Spectrum Networks is a member of the Communications Alliance & TIO</span><br><span class="m-8785849150445671491hoenzb">*/</span><br><br><span class="m-8785849150445671491hoenzb">_______________________________________________</span><br><span class="m-8785849150445671491hoenzb">AusNOG mailing list</span><br><span class="m-8785849150445671491hoenzb"><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a></span><br><span class="m-8785849150445671491hoenzb"><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a></span></span></p></blockquote></div><p class="MsoNormal"><br><br clear="all"></p><div><p class="MsoNormal"> </p></div><p class="MsoNormal">-- </p><div><div><div><div><div><div><div><div><div><div><div><div><div><div><p class="MsoNormal"><b>Andrew Yager, CEO</b> <i>(BCompSc, JNCIS-SP, MACS (Snr) CP)</i></p></div><div><p class="MsoNormal">Real World Technology Solutions - IT People you can trust</p></div><div><p class="MsoNormal">Voice | Data | IT Procurement | Managed IT</p></div><div><p class="MsoNormal"><a href="http://rwts.com.au" target="_blank">rwts.com.au</a> |
<a href="tel:1300%20798%20718" target="_blank">1300 798 718</a></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal"><span style="border:solid windowtext 1.0pt; padding:0cm"><img border="0" width="100" height="100" id="_x0000_i1025" src="cid:~WRD000.jpg" alt="Image removed by sender." style="width:1.0416in; height:1.0416in"></span></p></div><div><p class="MsoNormal"><i><span style="font-size:12.0pt; font-family:"Arial",sans-serif">Real World is a DellEMC Gold Partner</span></i></p></div><div><p class="MsoNormal"> </p></div><div><p class="MsoNormal">This document should be read only by those persons to whom it is addressed and its content is not intended for use by any other persons. If you have received this message in error, please notify us immediately. Please also destroy and delete
the message from your computer. Any unauthorised form of reproduction of this message is strictly prohibited. We are not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt. Please
consider the environment before printing this e-mail.</p></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></blockquote></div></blockquote><p><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p><pre>-- </pre><pre>/* Matt Perkins </pre><pre> Direct <a href="tel:1300%20137%20379" target="_blank">1300 137 379</a> Spectrum Networks Ptd. Ltd. </pre><pre> Office <a href="tel:1300%20133%20299" target="_blank">1300 133 299</a> <a href="mailto:matt@spectrum.com.au" target="_blank">matt@spectrum.com.au</a> </pre><pre> Level 6, 350 George Street Sydney 2000</pre><pre> Spectrum Networks is a member of the Communications Alliance & TIO </pre><pre>*/</pre></div></div></div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a></p></blockquote></div><p class="MsoNormal"><br><br clear="all"></p><div><p class="MsoNormal"> </p></div><p class="MsoNormal">-- </p><div><p class="MsoNormal">Sincerely<br><br>
Jay</p></div></div></blockquote><p><span style="font-size:11.0pt; font-family:"Calibri",sans-serif"> </span></p><pre>-- </pre><pre>/* Matt Perkins </pre><pre> Direct 1300 137 379 Spectrum Networks Ptd. Ltd. </pre><pre> Office 1300 133 299 <a href="mailto:matt@spectrum.com.au">matt@spectrum.com.au</a> </pre><pre> Level 6, 350 George Street Sydney 2000</pre><pre> Spectrum Networks is a member of the Communications Alliance & TIO </pre><pre>*/</pre></div></div></div></div>
_______________________________________________
AusNOG mailing list
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</span></body></html>