User manual

117
Would dialing into an organization from outside the organization’s PBX rather than using
PhoneSweep internally impact PhoneSweep’s performance?
One disadvantage to conducting a PhoneSweep security audit from outside the organization’s PBX is
long-distance charges, but only if they apply to the calls you need to make. Dialing an organization's
phones from within its PBX can be slightly faster due to fewer digits being dialed and shorter call set-up
times. The speed increase is rarely more than 10 to 20%.
Sometimes dialing from inside a switch can cause problems with Single Call Detect. Typically the result
is obvious, such as half of all calls being identified as TONE.
Fax machines and Fax/Modems
What is a fax/modem? What kind of a security risk do they pose?
A fax/modem is a device that is capable of both fax and data communications. For security purposes, a
fax/modem is at least as dangerous as a data-only modem, and is probably more dangerous than a normal
modem. The user who installed the fax/modem may believe that it is answering only fax calls and be
unaware that it can also auto-answer data calls, and thus may not take any steps to secure the machine.
Do fax machines pose a security risk?
Yes. A user who has authorization for an analog line for fax machine use can intentionally use the analog
line to provide a data connection.
How would a fax/modem be reported if PhoneSweep were set to scan for only data or only fax?
A fax/modem will be reported as Fax by PhoneSweep running in fax-only mode and Carrier in data-only
mode.
Why is a number first reported as Fax and subsequently reported as Carrier?
That number reaches a fax/modem; fax detection takes place first with SCD.
When might PhoneSweep miss a fax machine?
If PhoneSweep reaches a fax machine that makes non-fax tones or plays a prerecorded message when it
answers the call (as in the case of an answering machine/fax combination and some Super Group 3 fax
devices), PhoneSweep will record the call as something other than Fax. Another possibility is problems
with your phone switch that make PhoneSweep thinks that the call has been answered when it hasn’t
been, or forgetting a dialing prefix. Most misidentifications occur at the Connect level of effort, where
PhoneSweep only listens to tones and hangs up.
The Super Group 3 protocol is the marketing term for faxes that push the Group 3 fax protocol to its
upper limits when transmitting fax signals at 36.6 K using compression.
Finding All the Modems
How do users attempt to hide unauthorized modems?
Users who do not want their unauthorized modems to be caught by a PhoneSweep scan may turn them off
when the modems are not in use, configure the modem for dial-out only, or configure the modem such
that it only picks up after a large number of rings. Fortunately, these measures also make the modems
harder for attackers to find.