The Security Challenge:Combating VoIP Toll Fraud
A small chain of “Mom & Pop” retail shops gets a phone bill for $500,000, an increase of 400 times its typical monthly bill.
A service provider receives interconnection charges totaling more than $1 million for termination of long-distance phone calls from one of its partners, but there are no corresponding revenues to match these calls.
The telecom manager for a multinational enterprise discovers a spike in international calling volume and charges, but many of the calls take place in non-business hours when no one is working. Worse, the volume of calls during business hours is starting to max out the network capacity.
What’s going on?
Each of these scenarios illustrates how Voice-over-IP (VoIP) implementations, if not deployed with adequate security, can result in toll fraud.
Toll fraud is the unauthorized usage of paid communication services (such as international calling) charged to an unsuspecting entity – whether an enterprise or service provider. Beyond the unauthorized charges stemming from toll fraud, its misuse of communications services can also eat up network resources, leaving them unavailable to legitimate users.
Exploiting an Enterprise VoIP/UC for toll fraud Exploiting an Enterprise VoIP/UC for toll fraud
There are three main areas within an enterprise VoIP/UC deployment that are most vulnerable to exploitation.
- PBX/Voicemail/Application Servers: These communications systems are particularly susceptible to security breaches due to their often weak password protection. Furthermore, policy enforcement on these systems is limited, allowing redirects, transfers, and forwards to long distance and even international toll numbers
without proper authorization.
| - PSTN Connectivity: Attackers typically exploit the fact that Session Border Controllers (SBCs) or Media gateways accept calls from anywhere and route them to the service provider with limited or no authentication. Sometimes even service providers employ only weak authentication on SIP trunks, and the SBC can be bypassed.
| - User/Device Authentication: Enterprises deploying phones over extended networks in low security networks without strong authentication – including lobby phones, guest rooms, and the Internet – are especially vulnerable to exploitation. Without strong two-factor authentication, lost or stolen phones can be easily misused. Once attackers gain access to a misplaced device or are able to guess or "brute force" weak credentials, they are ready to make calls as the authorized user. This type of attack raises further security concerns, as attackers can also exploit the user identity associated with the credentials.
|
Please see our UC security best practices and solutions:UC Security Best Practices
Business Continuity Communications Solution The Security Challenge: Combating VoIP Toll Fraud VIPER Services: Unified Communications and VoIP Vulnerability Assessments
Learn more: please contact us with your questions about VoIP/UC security.
|
