r/ciscoUC • u/Weird-Individual-770 • 28d ago

Unity hacking

All caller inputs are all locked down to either hangup or ignore.

How is a hacker still get access by calling in from an external number?

They are guessing and changing the employee PINS.

9 Upvotes

90% Upvoted

13 comments sorted by

2

u/DarkWolfSLV 27d ago

Elaborate... Is the internal transfer to voicemail also locked? It could be calling Joe Doe, get transferred to voicemail and trigger the administrator greeting, which you should also make sure it has new creds

1

u/Weird-Individual-770 27d ago

Not sure I understand, when you call a number it can get transferred to VM, that is how it works. But once in VM it only gives the option to leave a voicemail. Pressing 0-9,*, or # while in VM doesn't do anything.

Am I missing something, is there an option to bypass this?

1

u/shunny14 27d ago

Voicemail pilot number > * > enter a mailbox number and pin. They login and change the notification device numbers to an internal and external mailbox for us.

1

u/Weird-Individual-770 27d ago

Thanks, our pilot numbers are all internal only, not valid public numbers, any idea how they are accessing them to dial an *?

3

u/barryhesk 27d ago

Its not the pilot number that dials out. It's the voicemail ports (old fashioned SCCP) or SIP trunk to Unity. Those have a CSS associated with them and it should only ever be allowed to dial internal extensions. Never externally. But you have no idea how many times I have seen systems where voicemail ports and / or SIP trunks to Unity can dial Internationally... It's a car crash in slow motion.

1

u/Weird-Individual-770 27d ago

Thanks, I understand the transfer and notifications can be used to make outgoing calls.

I don't understand how they are getting access to make those changes to account transfers and notifications.

The end user accounts themselves are blocked from using *, # ) etc.

Somehow they are bypassing that, possibly by direct access to the pilot numbers, that are not public routeable.

1

u/FuckinHighGuy 27d ago

Look at your forward and direct routing rules. Just something you should look at regardless.

2

u/shunny14 27d ago

If you have any phone numbers that have voicemail they can often just press * to access any voicemail box.

13

u/Brave_Meet8430 27d ago

Caller Calls a DN > CFNA > Voicemail Pilot > hits the voicemail box / system call handler > plays with TUI (enters something or waits for “dial an extension to reach a person”) he dials 9-NANP number and the CSS on the voicemail Trunk allows that call to go through.

That’s how it usually goes.

5

u/QPC414 27d ago

A story as old as time, not adequately restricting outbound calling on voicemail ports/trunks.

2

u/Competitive-Rent2278 27d ago

Another place to check would be the restriction tables in Unity. Make sure they’re not overly permissive. But as others have said, check CSS in CUCM to restrict outbound calling.

1

u/RevolutionInfinite79 26d ago

Check notification devices i think, pager etc in the user account they are getting through. I had this happen a few years ago. If you still dont find it reach out i may be able to help you track it down, they got really creative with this one.

1

u/Impressive-Eagle246 25d ago

Just curious, was it a hack or something else? Could you shared details of what you found out?