2 cissp ® Official Study Guide Eighth Edition

Fraud and Abuse
Another voice communication threat is private branch exchange (PBX) fraud and abuse. 
Many PBX systems can be exploited by malicious individuals to avoid toll charges and hide 
their identity. Malicious attackers known as 
phreakers
abuse phone systems in much the 
same way that attackers abuse computer networks. Phreakers may be able to gain unau-
thorized access to personal voice mailboxes, redirect messages, block access, and redirect 
inbound and outbound calls.
Countermeasures to PBX fraud and abuse include many of the same precautions you 
would employ to protect a typical computer network: logical or technical controls, admin-
istrative controls, and physical controls. Here are several key points to keep in mind when 
designing a PBX security solution:
■
Consider replacing remote access or long-distance calling through the PBX with a 
credit card or calling card system.
■
Restrict dial-in and dial-out features to authorized individuals who require such func-
tionality for their work tasks.
■
If you still have dial-in modems, use unpublished phone numbers that are outside the 
prefix block range of your voice numbers.
■
Protect administrative interfaces for the PBX.
■
Block or disable any unassigned access codes or accounts.

---

528
Chapter 12 
■
Secure Communications and Network Attacks
■
Define an acceptable use policy and train users on how to properly use the system.
■
Log and audit all activities on the PBX and review the audit trails for security and use 
violations.
■
Disable maintenance modems (i.e., remote access modems used by the vendor to 
remotely manage, update, and tune a deployed product) and/or any form of remote 
administrative access.
■
Change all default configurations, especially passwords and capabilities related to 
administrative or privileged features.
■
Block remote calling (that is, allowing a remote caller to dial in to your PBX and then 
dial out again, thus directing all toll charges to the PBX host).
■
Deploy 
Direct Inward System Access (DISA)
technologies to reduce PBX fraud by 
external parties. (But be sure to configure it properly; see the sidebar “DISA: A Disease 
and the Cure.”)
■
Keep the system current with vendor/service provider updates.
Additionally, maintaining physical access control to all PBX connection centers, phone 
portals, and wiring closets prevents direct intrusion from onsite attackers.
dISA: A disease and the Cure
An often-touted “security” improvement to PBX systems is Direct Inward System Access 
(DISA). This system is designed to help manage external access and external control of a 
PBX by assigning access codes to users. Although great in concept, this system is being 
compromised and abused by phreakers. Once an outside phreaker learns the PBX access 
codes, they can often fully control and abuse the company’s telephone network. This can 
include using the PBX to make long-distance calls that are charged to your company’s 
telephone account rather than the phreaker’s phone.
DISA, like any other security feature, must be properly installed, configured, and
monitored in order to obtain the desired security improvement. Simply having DISA is not
sufficient. Be sure to disable all features that are not required by the organization, craft 
user codes/passwords that are complex and difficult to guess, and then turn on auditing
to keep watch on PBX activities. Phreaking is a specific type of attack directed toward the 
telephone system. Phreakers use various types of technology to circumvent the telephone 
system to make free long-distance calls, to alter the function of telephone service, to 
steal specialized services, and even to cause service disruptions. Some phreaker tools are 
actual devices, whereas others are just particular ways of using a regular telephone. No 
matter what the tool or technology actually is, phreaker tools are referred to as colored 
boxes (black box, red box, and so on). Over the years, many box technologies have been 

---

Multimedia Collaboration 
529
developed and widely used by phreakers, but only a few of them work against today’s 
telephone systems based on packet switching. Here are a few of the phreaker tools often 
used to attack telephone services: 
■
Black boxes
are used to manipulate line voltages to steal long-distance services. They 
are often just custom-built circuit boards with a battery and wire clips. 
■
Red boxes
are used to simulate tones of coins being deposited into a pay phone. They 
are usually just small tape recorders. 
■
Blue boxes
are used to simulate 2600 Hz tones to interact directly with telephone 
network trunk systems (that is, backbones). This could be a whistle, a tape recorder, 
or a digital tone generator. 
■
White boxes
are used to control the phone system. A white box is a dual-tone multifre-
quency (DTMF) generator (that is, a keypad). It can be a custom-built device or one of 
the pieces of equipment that most telephone repair personnel use.
As you probably know, cell phone security is a growing concern. Captured 
electronic serial numbers (ESNs)
and
mobile identification numbers 
(MINs)
can be burned into blank phones to create clones (even
subscriber 
identity modules—SIMs
—can be duplicated). When a clone is used, the 
charges are billed to the original owner’s cell phone account. Furthermore, 
conversations and data transmission can be intercepted using radio 
frequency scanners. Also, anyone in the immediate vicinity can overhear 
at least one side of the conversation. So don’t talk about confidential, 
private, or sensitive topics in public places.
Multimedia Collaboration 
Multimedia collaboration is the use of various multimedia-supporting communication solu-
tions to enhance distance collaboration (people working on a project together remotely). 
Often, collaboration allows workers to work simultaneously as well as across different 
time frames. Collaboration can also be used for tracking changes and including multimedia 
functions. Collaboration can incorporate email, chat, VoIP, videoconferencing, use of a 
whiteboard, online document editing, real-time fi le exchange, versioning control, and other 
tools. It is often a feature of advanced forms of remote meeting technology.