Hacked Panasonic VM

This is a Job Aide displaying what we have seen to help you

Repair your system. By no means is this a definitive guide for

All the ways that a Panasonic TVA VM Systems get hacked.

If your system was hacked a quick way to stop it happening

will be to turn off the Voicemail System.

Some things you can do to prevent the hacking is to make sure all

Mailboxes have good passcodes. In The System Security section you

can set Default parameters for mailbox security. Also make sure 999

and 998 Have secure passwords assigned. Assign the Extensions

connected to the VM ports to COS 7. Which by default does not

allow outside calls.

On releases before 3.11. A caller would call into VM and dial

801 or 901 from the menu and get returned re-order dial tone,

Allowing the caller to make outbound calls.

In 3.11 Under Service Settings and then Parameters

At the top under Automated Attendant a Call Admission Table

Was added.

By Default you now are not allowed to dial 8,9,0 from a menu unless 

You check mark the box.

If you have weak passcodes on mailbox 999. Hackers get in and create new mailboxes

And assign a different class of service for these mailboxes.

After setting up the new mailbox they edit the settings for Class of Service.

They turn on Remote Call Forward to CO and Call Forward to Outside.

In the Mailbox 555 You will see the phone number that is being forwarded out to.

The Hackers will also change Notification Parameters for the mailbox. 

Another hack we’ve seen is on Trunks from cable providers, with call forward enabled on the trunks.

They will go into the notification field and turn on the call forward code.

Then the main co will be call forwarded to the hackers destination number.

The last way we’ve seen the mailboxes hacked is in Personal Custom Service.

They get into the mailbox and setup the outside number to dial the hackers

Destination number.

Added information when used with Mike from Telephone Systems (via David):

For the auto attendants, set 8 and 9 to exit.

Service Settings > Custom Service: Go through all auto attendant greetings, make 8 and 9 exit.

Change default password for new mailboxes so it is not 1111.

System security

1. Subscriber

Default password, change to 2580

2. Logon failures

Change to 2 (instead of 3, so hackers get discouraged)

Also under System Security, reset System Manager & Message Manager passwords.

Class of service 7 should be in TDA class of service (not in TVA)

Manually under internal and external call block

Go through all of 7 (day, night, lunch, etc) block and make it blue.

VM port in AJD (165) should be cos 7 (extension settings, main)

2.7.1 cos settings

Under 7, both should be disabled (transfer to and call fwd to)