“Criminals use brute-force techniques to hack private branch exchange (PBX) systems to place fraudulent, long-distance calls; usually international,” the report states. “These incidents, often targeting small or midsize businesses, have resulted in significant financial losses for some companies.”
One of the most popular scams employed by VoIP-abusing criminals are vhishing schemes, which are telephone-based phishing ploys. The report points to one recent vhishing scam targeting the U.S. Federal Deposit Insurance Corporation. Vhishers called U.S. consumers on mobile and land-line phones to inform them they were delinquent in loan payments that had been applied for over the Internet or made through a payday lender. Criminals were able to collect personal information, such as Social Security numbers from victims, according to the report.
“What we’ve seen in the last couple of years is growing VoIP abuse around getting access to someone else system with baseline security hacks and then either using it for criminal purposes or selling it to other folks as long distance,” said Patrick Peterson, Cisco fellow and chief security researcher. “Some people have made money that way and some victims received huge telcom bills.”
Peterson and Cisco technical manager Randy Birdsall explain why VoIP abuse has been on the upswing in recent years and appears poised for further growth.
1. It’s widely deployed
According to market research firm In-Stat, almost 80 per cent of businesses will use VoIP by 2013. And VoIP is in most enterprises in some fashion by now, according to Peterson. Whether it’s fully deployed or still being tested, it’s now pervasive, and therefore a target for criminals.
“Anytime there is a free, anonymous resource, criminals flock to it because that combination of free and anonymity is too good to be true,” said Peterson. “What we’ve seen is an extraordinary increase in the last few years in the number of cracking attempts, and port scans, and attempts to log in with default admin passwords on various VoIP access points.”
As VoIP has gained popularity, it’s now a worthwhile endeavor from criminals because there is a large pool of potential victims to pull from. Birdsall said the concern among organizations using VoIP has changed, too.
“When I first started talking to companies a few years ago about VOIP security, the comments were ‘Well, it’s good to know it’s available,'” he said. “Now the conversation is, ‘We have had this incident happen. Now we want to know everything you can tell us so it doesn’t happen again.'”
2. There are several ways to abuse it
While vhishing and SPIT (spam over internet telephony) get the most attention as VoIP problems, there are many ways criminals can take advantage of a VoIP network. Denial-of-Service attacks using VoIP technology are gaining popularity. In these attacks, criminals make the victims’ phones ring constantly or sound busy.
“Organizations are deploying gateways that allow them to do SIP trunking to service providers as a way to save cost on telecom bills,” explained Birdsall. “Now they are out on internet with a gateway that has the ability to do SIP trunking, and SIP is an open protocol. There is a lot that is known about that across the entire industry and that is a great thing. But it also allows more people to understand it to the point of manipulating it and using it doing things with it that are malicious.”
Some of the other types of exploits Birdsall has seen include criminals routing calls through an organization’s SIP trunk under the guise of being a telephony-service provider, therefore selling a service they never had to pay for. Criminals can also route their calls over the unsecured gateway to other sources, therefore bypassing long distance charges and international call charges.
“They can also redirect calls to 900 numbers, or other numbers that allow them to actually make money off of it,” said Birdsall.
There is also the potential for hackers to breach your network and steal sensitive data using the gateway.
“One financial institution pulled me in when they noticed traffic coming from their product out to the internet. In that case, they (the criminals) had leveraged the IP-telephony network to gain access to a data path within their corporate enterprise. So the IP-telephony network was a way to get to the data side of things. That’s another attack vector people may not have anticipated.”
3. It’s not well protected
“In a lot of mid-market organizations, VOIP systems are deployed to save money, but they dont have someone on staff who understands the security implications and knows what to look out for. They are leaving it wide open,” said Birdsall.
A VoIP network often shares the vulnerabilities of the operating system it runs on, yet the organization often fails to protect it with standard firewalls and security software. Many neglect to change the default manufacturer passwords that come with the system.
“Organizations deployed these systems several years ago and then just sort of forgot about security,” said Peterson.
