Operation Open Line

PRACTICAL · LINUX · difficulty 3 · ~25 min · 17 steps

The help desk reset an account for a voice they recognised. Nobody spoke to them.

Briefing

02:07 last night the service desk took a call from the finance director. Stressed, travelling, locked out before a board deadline. The agent knew the voice, followed the script as far as the script goes, and reset the account. The director was asleep at home and has not made a phone call since Tuesday. Separately, and nobody has connected these yet, telephony billing has flagged eleven hours of outbound calls to a satellite prefix over the same night. You run the PBX. Both of those arrived through it.

Objectives

• Find what the PBX is carrying right now and stop the bleeding
• Establish how an outside endpoint came to be trusted
• Look at the call that fooled the help desk as an artefact, not a memory
• Check whether the account reset was actually used
• Fix the thing that is actually broken, which is not on this machine

Return to the range lobby