TUCoPS :: Phreaking Technical System Info :: bbfraud.txt

Blue Box detection in the DMS-100

TABLE OF CONTENTS                    BLUE BOX FRAUD DETECTION DESC
1001-132
NTP



   NORTHERN TELECOM                            PRACTICE 297-1001-132
                                                    ISSUED: 87 04 24
                                             RELEASE: 02.01 STANDARD






                       DIGITAL SWITCHING SYSTEMS

                            DMS*-100 FAMILY

                       BLUE BOX FRAUD DETECTION
                          FEATURE DESCRIPTION






































       * DMS-100 is a trademark of Northern Telecom
                                                              Page 1
                                                            21 pages


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01











   (c) Northern Telecom 1980, 1987













































                                                              Page 2


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

                               CONTENTS
                                                                PAGE
    1.  INTRODUCTION  . . . . . . . . . . . . . . . . . . . . . .  4

        General   . . . . . . . . . . . . . . . . . . . . . . . .  4
        Practice Application  . . . . . . . . . . . . . . . . . .  4
        Reason for Reissue  . . . . . . . . . . . . . . . . . . .  5
        Software Identification   . . . . . . . . . . . . . . . .  5
        Command Format Conventions  . . . . . . . . . . . . . . .  5
        References  . . . . . . . . . . . . . . . . . . . . . . .  5

    2.  DESCRIPTION   . . . . . . . . . . . . . . . . . . . . . .  7

        Testing for Fraudulent Calls  . . . . . . . . . . . . . . 10
        Recording Fraudulent Calls  . . . . . . . . . . . . . . . 11
        Disposing of Fraudulent Calls   . . . . . . . . . . . . . 12
            Cut the Call  . . . . . . . . . . . . . . . . . . . . 12
            Continue the Call   . . . . . . . . . . . . . . . . . 12

    3.  OPERATIONAL MEASUREMENTS  . . . . . . . . . . . . . . . . 13


    4.  MAN-MACHINE INTERFACE   . . . . . . . . . . . . . . . . . 14

        Commands  . . . . . . . . . . . . . . . . . . . . . . . . 14
        Alarms  . . . . . . . . . . . . . . . . . . . . . . . . . 17
        Logs  . . . . . . . . . . . . . . . . . . . . . . . . . . 17

    5.  GLOSSARY  . . . . . . . . . . . . . . . . . . . . . . . . 20

                                FIGURES

   FIG.  TITLE                                                  PAGE

   1     Fraudulent Call Setup  . . . . . . . . . . . . . . . . .  8
   2     The Extra Wink   . . . . . . . . . . . . . . . . . . . .  9
   3     The Reserved Multifrequency Receiver   . . . . . . . . . 10



















                                                              Page 3

INTRODUCTION                         BLUE BOX FRAUD DETECTION DESC
1001-132
NTP
                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   1.  INTRODUCTION

   GENERAL

   1.01   This  Practice describes the Blue Box Fraud Detection fea-
          ture and its operation within the DMS-100 Family.  A "blue
   box" is any device, connected illegally to a  subscriber's  line,
   that can produce both a 2600 Hz tone and multifrequency (MF) dig-
   its.

   1.02   To  place  a fraudulent call, the perpetrator performs two
          steps:

   1.  Use a normal telephone to place a normal call. This  call  is
       usually  a  free  or inexpensive call, and uses a Single Fre-
       quency (SF) trunk beyond the perpetrator's billing office.

   2.  Use a blue box to place the fraudulent call. This  call  uses
       the SF trunk seized for the original, normal call.

   1.03   Calls  placed  with a blue box are typically undetected by
          the perpetrator's billing office, thus the term "blue  box
   fraud."

   1.04   The  Blue Box Fraud Detection feature attempts to discover
          fraudulent MF signaling over Centralized Automatic Message
   Accounting (CAMA) and SuperCAMA trunks; it does not detect  frau-
   dulent  signaling  over  Traffic  Operator Position System (TOPS)
   trunks.  This feature can alert the operating company of a  frau-
   dulent  call  attempt and either allow billing to be made for the
   call or disconnect the call.

   1.05   This feature detects fraudulent MF signaling but does  not
          detect  fraudulent SF pulsing.  No customer data schema is
   required, because the feature is activated and deactivated  using
   the  Command  Interpreter  (CI) facilities at the Maintenance and
   Administration Position (MAP1).  The feature implements the meth-
   od of detection of fraudulent toll telephone calls  described  in
   U.S. patent 4,001,513.


   PRACTICE APPLICATION

   1.06   The  information  contained in this Practice is applicable
          to offices  having  Batch  Change  Supplement  release  22
   (BCS22)  software.  It is also applicable to offices having a BCS
   release greater than 22 unless reissued. The application  of  all
   Northern Telecom Practices (NTP) editions with respect to a given
   BCS release is given in 297-1001-001.


   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

   1  MAP is a trademark of Northern Telecom.

                                                              Page 4


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   REASON FOR REISSUE

   1.07   This  Practice has been reissued to revise the content and
          format of the existing document.  Due  to  the  extent  of
   these changes, revision bars are not included in the text.


   SOFTWARE IDENTIFICATION

   1.08   Software applicable to a specific DMS-100 Family office is
          identified by a BCS release number and by Northern Telecom
   (NT)  Product  Engineering Codes (PEC).   The significance of the
   BCS number and the PEC  is  described  in  297-1001-450  (section
   450/32) and in the Office Feature Record D-190.

   1.09   A  display  of  the  BCS number and PEC for the NT feature
          packages available in a specific office can be obtained by
   entering the command string:

           PATCHER;INFORM LIST;LEAVE

   at a MAP.


   COMMAND FORMAT CONVENTIONS

   1.10   In this Practice, a uniform system of notation is used  to
          illustrate  system  commands and responses.   It shows the
   order in which command elements appear, the punctuation, and  the
   options.    Where the conventions are not used, an explanation is
   given in the text.

   CAPITAL letters or     show constants, commands, or keywords that
   special characters     the system  accepts when entered  as writ-
                          ten.

   lowercase letters      show  a  user-  or  system-supplied  para-
                          meter. Definitions are given for each par-
                          ameter.

   Brackets [ ] or Ú  ¿   enclose  optional  parameters. A  vertical
                   ³  ³   list enclosed  in brackets  means that one
                   À  Ù   or more of the parameters may be selected.

   REFERENCES

   1.11   References listed as prerequisites are  essential  for  an
          understanding  of  this Practice.  Those listed as inform-
   ative contain detailed information concerning  other  items  men-
   tioned  in  this Practice, but are not essential.  References are
   inserted at the appropriate places in the text.





                                                              Page 5


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   Note:  The documents listed may exist in more than  one  version.
   See  297-1001-001  to  determine  the release code of the version
   compatible with a specific release of software.



   Prerequisite References

   DOCUMENT
   NUMBER        TITLE
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
   297-1001-100  System Description


   Informative References

   DOCUMENT
   NUMBER        TITLE
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
   GFXINDEX      General Feature Description Index of Documents
   297-1001-001  Master Index of Practices
   297-1001-114  Operational Measurements (OM)
   297-1001-119  Automatic Message  Accounting  -  Northern  Telecom
                 Format
   297-1001-450  Provisioning
   297-1001-510  Log Report Manual






























                                                              Page 6

DESCRIPTION                          BLUE BOX FRAUD DETECTION DESC
1001-132
NTP
                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   2.  DESCRIPTION

   2.01   The Blue Box Fraud Detection feature allows the DMS-200 to
          perform three fraud detection functions:

   o   test for fraudulent calls

   o   record fraudulent calls

   o   dispose of fraudulent calls (cut or continue).

   2.02   Figure 1 on page 8 describes how a perpetrator initiates a
          fraudulent  call.    Figure 2  on page 9 describes how the
   system responds to a fraudulent call, and how the testing  proce-
   dure  is invoked.   Figure 3 on page 10 describes how the DMS-200
   prepares to test for fraudulent calls.







































                                                              Page 7


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
             ÚÄÄÄ¿
              /O\                        To place a fraudulent call,
               ³                         the    perpetrator    first
               ³                         places a normal call.
               ³
               V                         The  End  Office sends  the
          ÚÄÄÄÄÄÄÄÄÄÄÄ¿                  digits to the CAMA office.
          ³           ³
          ³    END    ³                  The  CAMA  office  receives
          ³  OFFICE   ³                  and  translates the  digits
          ³           ³                  from  the  End Office,  and
          ³           ³                  seizes an outgoing trunk.
          ÀÄÄÄÄÄÂÄÄÄÄÄÙ
                ³                        The office  at the  far end
                ³                        of the outgoing trunk winks
                ³                        in  response, and  the CAMA
          CAMA  ³                        office  sends   the  called
          TRUNK ³                        digits   for  this   normal
                ³                        call.
                ³
                ³                        No  fraud  has taken  place
                V                        yet.
            ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
            ³        CAMA        ³
            ³       OFFICE       ³
            ³                    ³
            ³        DMS         ³
            ³        200         ³
            ³                    ³
            ÀÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
                ³
        OUTGOING³        A
           TRUNK³        ³WINK
                ³        ³
                ³
                V


                    Fig. 1 - Fraudulent Call Setup
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ















                                                              Page 8


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
             ÚÄÄÄ¿
              /O\                        Either before  or after the
               ³                         original,  normal  call  is
               ³                         answered,  the  perpetrator
   ÚÄÄÄÄÄ¿     ³                         uses the blue  box to place
   ³BLUE ÃÄÄÄÄ>³                         a fraudulent call.
   ³BOX  ³     ³
   ÀÄÄÄÄÄÙ     ³                         This fraudulent call causes
               ³                         the office  at the  far end
               ³                         of  the  outgoing trunk  to
               V                         wink, again, in response.
          ÚÄÄÄÄÄÄÄÄÄÄÄ¿
          ³           ³                  To  the office  at the  far
          ³    END    ³                  end of  the outgoing trunk,
          ³  OFFICE   ³                  the wink is  normal. To the
          ³           ³                  CAMA  office, however,  the
          ³           ³                  wink is unexpected.
          ÀÄÄÄÄÄÂÄÄÄÄÄÙ
                ³                        It is this  extra wink that
                ³                        invokes the  blue box fraud
          CAMA  ³                        testing procedure.
          TRUNK ³
                ³                        Without the  Blue Box Fraud
                ³                        Detection feature, the CAMA
                ³                        office ignores the wink.
                ³
                ³
                ³
                ³
                V
            ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
            ³        CAMA        ³
            ³       OFFICE       ³
            ³                    ³
            ³        DMS         ³
            ³        200         ³
            ³                    ³
            ÀÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
                ³
        OUTGOING³        A
           TRUNK³        ³
                ³        ³
                ³       WINK
                V

                        Fig. 2 - The Extra Wink
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ








                                                              Page 9


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   TESTING FOR FRAUDULENT CALLS

   2.03   Triggered by the unexpected wink, the  DMS-200  begins  to
          test the suspected call.

   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
             ÚÄÄÄ¿
              /O\                        To test the  call, the DMS-
               ³                         200 establishes a broadcast
               ³                         network connection from the
   ÚÄÄÄÄÄ¿     ³                         suspected   incoming   CAMA
   ³BLUE ÃÄÄÄÄ>³                         trunk  to   a  reserved  MF
   ³BOX  ³     ³                         receiver (MFR).
   ÀÄÄÄÄÄÙ     ³
               ³                         These MFR are reserved when
               V                         the feature is activated.
         ÚÄÄÄÄÄÄÄÄÄÄÄ¿
         ³           ³                   As long  as the  feature is
         ³    END    ³                   active,  the  reserved  MFR
         ³  OFFICE   ³                   are   not   available   for
         ³           ³                   standard call processing.
         ³           ³
         ÀÄÄÄÄÄÂÄÄÄÄÄÙ                   NOTE: The number of MFR set
               ³                         in  reserve depends  on the
               ³                         number    of   simultaneous
         CAMA  ³          ÚÄÄÄÄÄÄÄÄ¿     fraud   attempts  expected.
         TRUNK ³          ³reserved³     For provisioning  MFR refer
               ³broadcast ³        ³     to 297-1001-450.
               ÃÄÄÄÄÄÄÄÄÄÄ´   MFR  ³
               ³connection³        ³     Following is  a description
               ³          ÀÄÄÂÄÄÄÄÄÙ     of  the  events that  occur
               ³             ³           after the MFR is attached.
               ³            d³
               ³            i³
               ³            g³
               ³            i³
               ³            t³
               ³            s³
               V             V
           ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
           ³        CAMA        ³
           ³       OFFICE       ³
           ³        DMS         ³
           ³        200         ³
           ÀÄÄÄÂÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ
               ³
       OUTGOING³
          TRUNK³
               ³
               ³
               V

             Fig. 3 - The Reserved Multifrequency Receiver
   ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ


                                                             Page 10


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   2.04   After  attaching the MFR, the DMS-200 waits for one of the
          following events:

   EVENT         EXPLANATION AND SYSTEM RESPONSE

   Wink          Wink on the same trunk again.

                 System Response: Reset the MFR timeout and continue
                 to wait.

   Digits        A  fraudulent  set  of  called  digits   has   been
                 received.

                 System  Response:  Provide  the charge utility with
                 these digits and use the Automatic Message Account-
                 ing (AMA) Event Information Digit to flag this call
                 as a Blue Box call.

                 Release the MFR.

                 If the CUT option was specified from the MAP,  dis-
                 connect the call.  Refer to Commands on page 14 for
                 information about the CUT option.

   Call failure  Mutilated    digit(s) detected by the MFR.  Several
                 things could cause this:

                 o   the call may have released

                 o   there may be a real transmission problem

                 o   the perpetrator may be using SF pulsing.

                 System Response: Release  the  MFR  and  assume  no
                 fraud has taken place.

   MFR Timeout   The  time  allowed to detect possible fraudulent MF
                 digits has expired.

                 System Response: Release  the  MFR  and  assume  no
                 fraud has taken place.


   RECORDING FRAUDULENT CALLS

   2.05   The DMS-200 performs the following actions after detecting
          a fraudulent call:

   o   If  the  CUT  option  was not specified, replace the original
       digits in the charge buffer with the fraudulent digits.

       Note:  If the perpetrator places  more  than  one  fraudulent
       call, only the last call appears in the charge buffer.



                                                             Page 11


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   o   Set  the  AMA  event  information digit to mark the call as a
       Blue Box call. See 297-1001-119.

   o   If the office is performing AMA recording for this call, gen-
       erate a log to alert the operating company office that a Blue
       Box call is in progress.  See Logs on page 17.

   o   If the ALARM option was specified  at  the  MAP,  generate  a
       visual/audible minor alarm.


   DISPOSING OF FRAUDULENT CALLS

   2.06   There  are  two options for disposing of fraudulent calls:
          cut the call or continue the call.

   Cut the Call

   2.07   To cut a fraudulent call, the DMS-200 performs the follow-
          ing actions:

   o   releases the MFR

   o   releases the connection between the originating and terminat-
       ing agents of the call

   o   processes the AMA information

   o   deallocates the terminator

   o   sets treatment for the originator.

   Continue the Call

   2.08   If the CUT option was not specified, the DMS-200  releases
          the  MFR and the call continues. The perpetrator is billed
   based on the fraudulent digits.

   2.09   When the subscriber disconnects the call, the system  gen-
          erates  a  log and turns off the alarm if the ALARM option
   was specified.















                                                             Page 12

OPERATIONAL MEASUREMENTS             BLUE BOX FRAUD DETECTION DESC
1001-132
NTP
                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   3.  OPERATIONAL MEASUREMENTS

   3.01   The Operational Measurement BLUEBOX is associated with the
          Blue Box Fraud Detection  feature  (see  297-1001-114  for
   more  information).    The CI command OMSHOW BLUEBOX will display
   the contents of each field.

   3.02   BLUEBOX has the following fields:

   FIELD       DESCRIPTION

   BBWinks     Number of unexpected winks detected on incoming  CAMA
               trunks. These winks could indicate fraudulent calls.

   BBAttach    Number  of  successful  MFR  attachments to suspected
               trunks.

   BBDetect    Number of fraudulent calls detected.





































                                                             Page 13

MAN-MACHINE INTERFACE                BLUE BOX FRAUD DETECTION DESC
1001-132

NTP
                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   4.  MAN-MACHINE INTERFACE

   4.01   The Blue Box Fraud Detection feature is activated by a  CI
          command  issued  at the MAP.  The same command can be used
   to query the status  of  the  feature.    The  following  section
   describes the syntax and options of the commands.


   COMMANDS

   ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
   ³         ³                                                     ³
   ³         ³                                                     ³
   ³         ³ Ú                    Ú     ¿¿¿ ¿                    ³
   ³ BLUEBOX ³ ³ACT  [nmfr [timeout ³ALARM³³³ ³                    ³
   ³         ³ ³                    ³CUT  ³³³ ³                    ³
   ³         ³ ³                    À     ÙÙÙ ³                    ³
   ³         ³ ³CLR                           ³                    ³
   ³         ³ À                              Ù                    ³
   ³         ³                                                     ³
   ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

   activates,  clears,  or  queries the status of the Blue Box Fraud
   Detection feature. Activating the feature reserves the  specified
   number of MFR. Clearing the feature returns the MFR to the common
   pool.

   Where:

   ACT      activates  the  Blue Box feature and reserves the speci-
            fied number of MFR.

   CLR      deactivates the Blue Box feature and returns the MFR  to
            the common pool.

   nmfr     specifies the number of MFR to be reserved.

            o   Range: 1 through 3.

            o   Default: 1.

   timeout  specifies  the  number  of seconds the MFR will wait for
            digits.

            o   Range: 5 through 35.

            o   Default: 30.

   ALARM    specifies that an audible/visual alarm will be generated
            when a Blue Box call is detected.

   CUT      specifies that fraudulent calls  will  be  disconnected.
            If  this parameter is not specified, the fraudulent call
            will continue.
                                                             Page 14


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   Notes:

   1.  The activation parameters are position-dependent.   That  is,
       nmfr  must be specified before timeout; both nmfr and timeout
       must be specified before ALARM or CUT.

   2.  The BLUEBOX command issued without any parameters queries the
       system for the feature status.

   Examples

   1.  Activate the Blue Box feature using only the default  parame-
       ters. The user inputs the following CI command:

       BLUEBOX ACT

       The system responds with the feature status and parameters:

       Bluebox Fraud Detection Feature Status:
       Active.
       1 MFR reserved, timeout set to 30 seconds.

   2.  Activate  the  Blue Box feature and reserve two MFR. The user
       inputs the following CI command:

       BLUEBOX ACT 2

       The system responds with the feature status and parameters:

       Bluebox Fraud Detection Feature Status:
       Active.
       2 MFR reserved, timeout set to 30 seconds.

   3.  Activate the Blue Box feature and reserve three  MFR  with  a
       timeout  of 22 seconds. The user inputs the following CI com-
       mand:

       BLUEBOX ACT 3 22

       The system responds with the feature status and parameters:

       Bluebox Fraud Detection Feature Status:
       Active.
       3 MFR reserved, timeout set to 22 seconds.

   4.  Activate the Blue Box feature with the ALARM option.  Reserve
       one  MFR  with  a timeout of 30 seconds.  The user inputs the
       following CI command:

       BLUEBOX ACT 1 30 ALARM

       The system responds with the feature status and parameters:

                                                             Page 15


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

       Blue Box Feature Status:
       Active.
       1 MFR reserved, timeout set to 30 seconds.
         Detection will report alarm.

   5.  Activate the Blue Box feature with the  CUT  option.  Reserve
       two  MFR  with  a timeout of 25 seconds.  The user inputs the
       following CI command:

       BLUEBOX ACT 2 25 CUT

       The system responds with the feature status and parameters:

       Bluebox Fraud Detection Feature Status:
       Active.
       2 MFR reserved, timeout set to 25 seconds.
         Detection will cut off call.

   6.  Determine the status of the Blue Box feature. The user inputs
       the following CI command:

       BLUEBOX

       If the feature is not active, the system responds with:

       Bluebox Fraud Detection Feature Status:
       Inactive.

       If the feature is active, the system responds with  the  fea-
       ture status and parameters:

       Bluebox Fraud Detection Feature Status:
       Active.
       2 MFR Reserved, timeout set to 35 seconds.
         Detection will cut off call.

   7.  Deactivate  the  Blue  Box  feature and return the MFR to the
       common pool. The user inputs the following CI command:

       BLUEBOX CLR

       The system indicates command execution with the response:

       Bluebox Detection Feature Cleared.












                                                             Page 16


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
   ³   ³                                                           ³
   ³ Q ³ BLUEBOX                                                   ³
   ³   ³                                                           ³
   ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

   queries the system for the syntax of the BLUEBOX command.


   Example:

   Display the BLUEBOX command syntax.
   The user inputs the following CI command:

   Q BLUEBOX

   The system responds with the following syntax diagram:

   Parameters for Bluebox Fraud Detection
   Parms: [<Active Status> {CLR,
                            ACT [<Number of MFRs> {1 TO 3}]
                                [<Timeout Value> {5 TO 35}]
                                [<Notification Option> {ALARM,
                                                        CUT}]}]


   ALARMS

   4.02   If the ALARM option is specified, a minor office alarm  is
          activated  whenever  a  Blue  Box  call is detected.   The
   office alarm is deactivated at call disconnect.


   LOGS

   4.03   The following six logs are associated with  the  Blue  Box
          Fraud Detection feature:

   o   AUDT118

   o   EXT106

   o   TRK151

   o   TRK152

   o   TRK153

   o   TRK154.







                                                             Page 17


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

   4.04   The  following  is a brief description and example of each
          log.  See 297-1001-510 for more detailed information.

   LOG       DESCRIPTION

   AUDT118   The Audit subsystem generates this log  when  Blue  Box
             Fraud  Detection  feature data is inconsistent with the
             corresponding MFR data. The identified  MFR  cannot  be
             used for fraud detection until the problem is cleared.

             Example:
             AUDT118 APR12 12:00:00 2112 FAIL BLUEBOX MFR LOST
                 CKT RCVRMF 1

   EXT106    The External Alarms subsystem generates this log when a
             fraudulent  call is detected and when that call discon-
             nects.

             Example:
             *EXT106 MAR14 12:00:00 2112 INFO BLUEBOX ON
                 CALL DETECTED


             *EXT106 MAR14 12:05:00 2113 INFO BLUEBOX OFF
                 CALL DISCONNECTED

   TRK151    The Trunk Maintenance subsystem generates this log when
             the Bluebox Fraud Detection feature is activated.

             Example:
             TRK151 APR11 12:00:00 2112 INFO BLUEBOX DETECTION ACTIVE
                # OF MFRS = 2 ALARM ENABLED
                CKT RCVRMF  0 CKT RCVRMF  1 CKT RCVRMF  2

   TRK152    The Trunk Maintenance subsystem generates this log when
             the Bluebox Fraud Detection feature is deactivated.

             Example:
             TRK152 APR04 12:00:00 2112 INFO BLUEBOX DETECTION CLEARED

   TRK153    The Trunk Maintenance subsystem generates this log when
             the Bluebox Fraud Detection feature  is  active  and  a
             fraudulent call is detected.

             Example:
             TRK153 APR16 12:00:00 2112 INFO BLUEBOX CALL DETECTED
                IC TRUNK = CKT RTP2W  1      CALLING # = 9197811199
                OG TRUNK = CKT CARY2W 2      CALLED # = 61247418888
                CALLED # REPLACED BY 3152651234
                CALLID = 123456

   TRK154    The Trunk Maintenance subsystem generates this log when
             the  Bluebox  Fraud  Detection  feature is active and a
             fraudulent call is disconnected.


                                                             Page 18


                                               PRACTICE 297-1001-132
                                                      RELEASE: 02.01

             Example:
             TRK154 APR11 12:00:00 2112 INFO BLUEBOX CALL DISCONNECT
                CKT APEX2W  1
                CALLING # = 6133628669  2  CALLED # = 6124741888
                CALLID = 123456

















                                                             Page 19

F0184 BLUE BOX FRAUD PREVENTIONN     NTX044AA CAMA                  FDM
ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄÄÄ¿
³ DMS ALL BCS27 Feature Description Manual                            ³
890120 ³
ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄÄÄ¿
³    Package        NTX044AA04 CENTRAL AUTOMATIC MESSAGE ACCOUNTING (CAMA)
  ³
³    Feature set    ADMINISTRATION
  ³
³    Feature        BLUE BOX FRAUD PREVENTIONN
  ³
³    Feature no     F0184
  ³
ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄÄÄ¿
³
  ³
³
  ³
³
  ³
³  DESCRIPTION
  ³
³  -----------
  ³
³
  ³
³  "Blue Box" fraude prevention depends upon an in-band signalling link
(SF)  ³
³  being  present  in an end-to-end call connection.  This signalling link
is  ³
³  relealsed by the calling party using a blue box before or after the
called  ³
³  subscriber answers.  The signalling link is then re-seized by the
calling  ³
³  party and a new destination directory number outpulsed (MF) using the
blue  ³
³  box.    This operation, except for the wink start or delay dial signal,
is  ³
³  transparent to the offices preceding the in-band signalling link.
  ³
³
  ³
³  In order to detect this type of fraud, DMS-200 will detect a  seocnd
pro-  ³
³  ceed  to send signal from the incoming SF unit at the distant office,
i.e.  ³
³  a signal having a nominal duration of 200 msec. (greater than 75 msec.
and  ³
³  less than 2 sec.).  Upon detection of the second proceed to  send
signal,  ³
³  DMS-200  will  connect an MF receiver to the incoming CAMA trunk for a
pe-  ³
³  riod of 30 sec.  If digits are not received within this  30  sec.
period,  ³
³  the second number is entered on tape, together with an identifying code.
  ³
³
  ³
³  At this point the call may be dropped or allowed to proceed, the
operating  ³
³  company having the necessary data to correctly bill the call.  There is
no  ³
³  danger  of the fraudulent call proceeding after time-out of the DMS-200
MF  ³
³  receiver, as the MF receiver at the distant office will time out after
25  ³
³  sec.    If  this  occurs, the fraudulent call must re-instate his call,
in  ³
³  which case the detection is repeated.
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
³
  ³
ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄÄÄ¿
³  Section B Available Features           NTX044AA04  Feat: F0184  ³ Page
1093 ³
ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
ÄÄÄÄÙ



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH