Mark Collier's VoIP Security Blog

VoIP Security/Toll Fraud Video on YouTube

Here is a link to a brief video on YouTube that describes how you an use XLite (a SIP softphone) to connect directly to a media gateway, in this case in a router, to make outbound long distance calls.

The idea is that the softphone uses SIP (or H.323 or even MGCP) to connect to the VoIP side of the gateway, which typically gets converted to ISDN-PRI for access to the PSTN. This connection is not seen or monitored by the PBX, so no CDR is generated and no class restrictions are in place to block the call.

The motive is of course toll fraud. I actually worked with one company that was hit with over $250,000 of toll fraud, that occurred through this vulnerability.This is a good example of a traditional voice application attack, but which is made easier to execute through VoIP. Remember, its not that VoIP is insecure, its that it makes all of the traditional voice attacks easier.

The vulnerability is quite easy to fix. The trick is to just make sure the router/media gateway only accepts signaling requests from the PBX. You can also use IPSec to protect the connection between the two components. If a connection requests comes from any other system, it will be ignored. It is also a very good idea to enable logging. You should also deploy a voice firewall/IPS on the external trunks (PRI or SIP) to provide real-time monitoring and control of long distance traffic on the trunks.

Here is the link:

http://www.youtube.com/watch?v=9I6K9Bqn4VU

 

 

 

Voice/VoIP Security Toll Fraud List of Attack

Here is a handy list of recent toll fraud attacks. You can also access these in the "General Articles" list on my blog, but you might find this list a little more convenient.

Download Stop Toll Fraud & Voice Network Attacks

Another Case of VoIP Security and Toll Fraud

Here is a link to an article describing yet another instance of toll fraud. This one seems a little different because it occurred using SIP. I am trying to get more details:

http://www.computerworld.com/s/article/9194041/Security_Manager_s_Journal_Slammed_with_a_100_000_phone_bill

 

Telephony Denial of Service (TDoS) Webinar Link

Here is a link to the Telephony Denial of Service (TDoS) webinar that I participated in last week. It lasts right at one hour. You do have to register, but that is a small price to pay... :)

http://event.on24.com/r.htm?e=244707&s=1&k=C1C12638B5DFE4F09D89851AB372F278