PBX Security Guide: How to Prevent VoIP Hacking & Toll Fraud

PBX hacking (also called toll fraud or VoIP fraud) occurs when attackers gain unauthorized access to your phone system to make calls at your expense. The Communications Fraud Control Association (CFCA) estimates global telecom fraud losses exceed $38 billion annually.

How Hackers Profit

1. Brute Force SIP Registration

The most common attack. Automated tools scan the internet for SIP servers on port 5060 and attempt thousands of username/password combinations. Default or weak credentials are cracked within minutes.

2. Social Engineering

Attackers call your company posing as telecom support, IT vendors, or even employees. They trick staff into revealing PBX credentials, transferring calls to premium numbers, or enabling call forwarding to external lines.

3. Misconfiguration Exploitation

Poorly configured PBX systems often have:

• Open SIP ports allowing anonymous calling
• Unrestricted outbound dialing (no international call blocking)
• DISA (Direct Inward System Access) without PIN protection
• Outbound routes accessible without authentication
• AMI (Asterisk Manager Interface) exposed to the internet

4. Voicemail System Abuse

Attackers exploit voicemail-to-external transfer features. They access voicemail boxes with default PINs (0000, 1234) and use transfer features to reach outside lines, bypassing normal call restrictions.

5. Web Interface Vulnerabilities

FreePBX and other web GUIs can be compromised through default credentials, unpatched vulnerabilities, or exposure to the public internet. Once attackers access the admin panel, they control the entire phone system.

Strong Password Policy

This is your first line of defense. Every SIP extension must have a strong, unique password.

Fail2Ban Configuration

Fail2Ban monitors log files and automatically blocks IP addresses that show malicious behavior. This is essential for protecting against brute force attacks.

Create /etc/fail2ban/jail.local:

# Asterisk/FreePBX Fail2Ban Configuration

[asterisk]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=asterisk, protocol=all]
logpath  = /var/log/asterisk/full
maxretry = 3
bantime  = 86400
findtime = 600

[freepbx]
enabled  = true
filter   = freepbx
action   = iptables-allports[name=freepbx, protocol=all]
logpath  = /var/log/asterisk/freepbx_security.log
maxretry = 3
bantime  = 86400
findtime = 600

Create /etc/fail2ban/filter.d/asterisk.conf:

[Definition]
failregex = SECURITY.* SecurityEvent="FailedACL".*RemoteAddress=".+?/.+?/<HOST>/.*
            SECURITY.* SecurityEvent="InvalidAccountID".*RemoteAddress=".+?/.+?/<HOST>/.*
            SECURITY.* SecurityEvent="ChallengeResponseFailed".*RemoteAddress=".+?/.+?/<HOST>/.*
            SECURITY.* SecurityEvent="InvalidPassword".*RemoteAddress=".+?/.+?/<HOST>/.*

ignoreregex =

Firewall Rules (iptables)

Only allow SIP traffic from trusted sources. Never expose port 5060 to the entire internet.

# Allow SIP from your SIP trunk provider (IPComms example)
iptables -A INPUT -p udp -s 208.67.60.0/24 --dport 5060 -j ACCEPT
iptables -A INPUT -p udp -s 66.212.71.0/24 --dport 5060 -j ACCEPT

# Allow SIP from your office IP
iptables -A INPUT -p udp -s YOUR.OFFICE.IP.HERE --dport 5060 -j ACCEPT

# Allow RTP media ports
iptables -A INPUT -p udp --dport 10000:20000 -j ACCEPT

# Drop all other SIP traffic
iptables -A INPUT -p udp --dport 5060 -j DROP
iptables -A INPUT -p tcp --dport 5060 -j DROP

# Block AMI from external access
iptables -A INPUT -p tcp --dport 5038 -j DROP

PJSIP Security Settings

Configure your endpoints to require authentication and restrict access:

; /etc/asterisk/pjsip.conf - Secure endpoint template

[endpoint-secure](!)
type=endpoint
context=from-internal
disallow=all
allow=ulaw
allow=alaw
direct_media=no
trust_id_inbound=no
trust_id_outbound=no
send_pai=no
send_rpid=no
auth=auth-template
aors=aor-template

[auth-template](!)
type=auth
auth_type=userpass
; Always use strong, randomly generated passwords

[aor-template](!)
type=aor
max_contacts=1
remove_existing=yes
qualify_frequency=60

Disable Guest Calls

Never allow unauthenticated calls. In /etc/asterisk/pjsip.conf:

[global]
type=global
allow_unauthenticated_registrations=no

FreePBX Intrusion Detection

Enable the built-in Intrusion Detection module in FreePBX:

1. Admin > System Admin > Intrusion Detection
2. Enable "Intrusion Detection"
3. Set ban time to 86400 (24 hours) or longer
4. Set max retry to 3
5. Whitelist your office IP and SIP provider IPs

Restrict Outbound Dialing

Create outbound route restrictions to limit damage if compromised:

• Block international by default - Only enable for users who need it
• Block premium rate numbers - 900, 976, and international premium prefixes
• Set concurrent call limits - No extension should make 50 simultaneous calls
• Time-based restrictions - Block international calls after hours

Session Border Controller (SBC)

For enterprise deployments, consider placing an SBC between your PBX and the internet. The SBC acts as a security proxy that:

• Hides your PBX topology from external attackers
• Normalizes SIP messaging to prevent protocol exploits
• Provides call rate limiting and anomaly detection
• Handles NAT traversal without exposing the PBX

Early detection is critical. Set up monitoring to alert you before a small breach becomes a massive phone bill.

What to Monitor

Log Analysis Script

Create a simple cron job to alert on suspicious activity:

#!/bin/bash
# /usr/local/bin/pbx-security-check.sh

# Count failed auth attempts in last hour
FAILED=$(grep "SecurityEvent=\"InvalidPassword\"" /var/log/asterisk/full | \
    grep "$(date -d '1 hour ago' '+%Y-%m-%d %H')" | wc -l)

if [ "$FAILED" -gt 50 ]; then
    echo "ALERT: $FAILED failed auth attempts in last hour" | \
    mail -s "PBX Security Alert" admin@yourcompany.com
fi

# Check for international calls (adjust country codes as needed)
INTL=$(asterisk -rx "core show channels" | grep -E "011|00" | wc -l)

if [ "$INTL" -gt 5 ]; then
    echo "ALERT: $INTL international calls active" | \
    mail -s "PBX International Call Alert" admin@yourcompany.com
fi

Immediate Steps

1. Disconnect from the network - Pull the ethernet cable or disable the network interface. Stop the bleeding.
2. Contact your SIP provider - Call IPComms support immediately. We can disable your trunk to stop outbound calls.
3. Document everything - Screenshot active calls, save logs, note timestamps. You may need this for insurance or law enforcement.
4. Change all passwords - Every SIP extension, admin interface, AMI, SSH, and database password must be changed.
5. Review CDRs - Identify which extension(s) were compromised and what numbers were called.

Recovery Process

1. Apply all security measures from this guide before reconnecting
2. Consider a fresh install if the system may have been rootkitted
3. Implement Fail2Ban and firewall rules before enabling SIP
4. Enable TLS/SRTP for all connections
5. Set up monitoring and alerts
6. Document the incident and update your security policy

Dealing with the Bill

Unfortunately, you are generally liable for fraudulent calls made through your system. However:

• Contact your carrier immediately - Some providers offer fraud protection limits
• File a police report - Required for insurance claims and may help with carrier negotiations
• Check your business insurance - Some policies cover toll fraud losses
• Document your security measures - Demonstrating reasonable security may help negotiations

As your SIP trunk provider, IPComms includes multiple layers of security to protect our customers from toll fraud and unauthorized access.