Displaying items by tag: PBX Security

Wednesday, 03 May 2017 21:27

What is Telecom Fraud?

What is Telecom Fraud?
...and how do I minimize my risk?

IT'S THEFT

So, you just received your monthly phone bill from your phone service provider.  What you expect to see is a total somewhere around 30 or 40 bucks.  However, to your amusement, you read "Total Due: $84,534.00" at the bottom of the bill.   After a lengthy conversation with a department that you didn't even know existed until now "The Fraud Management Department" you are informed that the bill is


accurate your IP PBX has placed more than 100,000 minutes of outbound calls to Cuba and North Korea.  Furthermore, they want to know when and how you plan to pay.

Unfortunately the scenario described above is not fictional and in no way exaggerated; more understated if anything.   As with anything connected to the public Internet these days, VoIP based phone systems are the ultimate find for internet thieves.  Actually, it is probably more accurate to label this activity as Organized Crime due to the amount of sophistication and organization that is needed to carry out these big hits with so much damage, so quickly.  Telecom fraud has become increasingly more common due to the growing popularity of IP PBXs.  

Unfortunately, this problem is only getting worse and continues to greatly impact VoIP service providers as well as individual businesses that operate through IPPBXs or Hosted Phone Systems. As the cost of ownership of IP PBXs decreases or even becomes free in the case of systems like Asterisk and 3CX, the quantity of systems being placed on the public internet also increases.  

HOW DOES IT HAPPEN?

Most commonly, hackers find holes in IPPBXs that are connected to the public internet by using SIP scanners and exploiting system weaknesses.  Typically these are default passwords being left in place, extensions being left unsecured, open SIP ports or incorrectly managed or non-existent of firewalls.  All of which are relatively easy to fix and usually free.  However, security is usually the last thing on the mind of your system integrator or that part-time PBX-Guru/buddy of yours that installed a free version of Asterisk for you (absolutely nothing wrong with Asterisk by the way!).  Once these hackers enter your system, they move quickly.  They operate undetected and terminate as many calls to the most expensive locations possible for as long as it takes for you or your service provider to recognize that your system just passed over a million calls to Cuba and North Korea. Never mind your issues with the State Department, you now have a  $90K+ phone bill on your hands.  And yes, your service provider will expect payment in full!

WHAT IS MY RESPONSIBILITY?

While your service provider may actively monitor its network for suspicious activity and traffic patterns, it is ultimately the responsibility of the customer to protect their own network.  Customers are responsible for all charges associated with their account whether fraudulent or not. It is the customer’s sole responsibility to take immediate action to prevent or block any fraudulent use.  As the IP PBX owner, you are responsible for the security and administration of your phone system.  This includes both physical security of the system and phones, as well as passwords, pins, remote users and network security.  Your service provider may have systems in place to help detect and notify you of hacking attempts and fraud as a courtesy, but you are responsible for any charges incurred.

WHAT CAN I DO TO PROTECT MY BUSINESS?

It is not an impossible task to secure your IP PBX from the top 99.9% of all intrusion attempts and minimize the damage done by any intruder that sneaks past your security.  Remember, Hackers are lazy (otherwise they'd have a real Job!), they are not going to spend hours trying to hack a system when they can just move on to another that is wide-open.

Here are some easy to implement procedures to help protect your IP IPBX from intruders:

  • BE SURE THAT YOUR IP PBX AND ACCESS TO YOUR NETWORK IS SECURE AND LIMITED ONLY TO THOSE WITH APPROPRIATE ACCESS PERMISSIONS.
  • NEVER, NEVER, NEVER USE THE DEFAULT PASSWORDS ON ANY SYSTEM.
  • NEVER USE THE SAME USERNAME AND PASSWORD ON YOUR EXTENSIONS.
  • PLACE YOUR PBX BEHIND A FIREWALL.
  • MAKE IT PRIVATE – NAT IS YOUR FRIEND!
  • KEEP INBOUND AND OUTBOUND ROUTING SEPARATE.
  • LIMIT REGISTRATION BY EXTENSIONS TO YOUR LOCAL SUBNET.
  • DISABLE CHANNELS AND SERVICES THAT ARE NOT IN USE.
  • MAKE IT HARDER FOR SIP SCANNERS
  • LIMIT AND RESTRICT DIAL PLANS
  • AUDIT YOUR SYSTEM SECURITY REGULARLY

For a more complete list of security steps, please see (11 steps to secure your IP PBX).

 

 

Published in Security
Wednesday, 03 May 2017 21:26

11 Steps to Secure Your PBX?

 

11 Steps to Secure Your PBX?
(don't be a victim to telcom theft)

 

An ounce of prevention...

If you are reading this, you're probably like most of us... after many hours, or even several days of downloading software, setting up servers, configuring trunks and cracking open firewall ports, you finally achieve success - your PBX is working, and calls are passing.   So, you wipe the sweat from your forehead, push away your ergonomic mesh-backed office chair with lumbar support and walk away pleased - not giving a second thought to security.  Until one day, you log into your PBX and see the skull-and-bones call sign of some hacker that has decided to pay you’re perfectly running PBX a visit. 

As a SIP trunking provider, our support team at IPComms sees this very scenario many more than we’d like to.  For those PBX owners who are lucky, they’re only faced with hours of down time and a complete system rebuild.  However, unlike getting your personal computer hacked, hacking into a PBX’s offers instant access to your wallet for anyone who enters in the form of free phone calls. Giving a well-informed hacker just a single night inside your unsecured PBX, and you could easily loose thousands. 

PBX security - is not rocket science

Hopefully, you’re here proactively, and not after the damage has been done.  But, if not, at least you have learned your lesson and plan to do things right this time.

While PBX security, like most other security, requires constant attention, and is a continuous work-in-progress, there are some basic common sense steps that you can perform that will safeguard your system from the most common of attacks. 

As mentioned in our “What is Telecom Fraud” blog, most hackers are not looking for a long drawn out hack and would much rather move on to easier targets if you would only put up a little fight.  So we’ve put together a list of “11 steps to secure your Asterisk® PBX”.  While this list speaks directly to Asterisk PBX owners, many of the steps can easily be carried over to most other IP PBX (VoIP) manufactures.

 

11 Steps to Secure your Asterisk PBX

 

  1. BE SURE THAT YOUR IP PBX AND ACCESS TO YOUR NETWORK IS SECURE AND LIMITED ONLY TO THOSE WITH APPROPRIATE ACCESS PERMISSIONS.
    Physical security is very important and commonly overlooked.

  2. NEVER, NEVER, NEVER USE THE DEFAULT PASSWORDS ON ANY SYSTEM.
    This is probably the most common way hackers enter IP PBX systems. When installing your IP PBX, the very first step should be to replace both the username and passwords of any account with administrator access. Secondly, when creating user accounts, be sure not to use or allow easy to guess passwords like “1234”, “password”, “companyname1” etc.  

  3. NEVER USE THE SAME USERNAME AND PASSWORD ON YOUR EXTENSIONS.
    This is another VERY common issue especially within the Asterisk community.  Using password 101 for extension 101, is asking for big trouble.  DON’T DO IT!

    Example of what NOT to do on your extensions:
    ; sip.conf  
    [101] 
    username=101 
    secret=101
    host=dynamic 

  4. PLACE YOUR PBX BEHIND A FIREWALL
    Lets’s face it, working on your PBX from home or allowing co-workers access to the system remotely is necessary and often unavoidable.  However, doing it correctly can be the difference between security success and total and utter failure.  VPNs are a good way to limit access and enable co-worker remote management. Placing your PBX behind a firewall and Restrict remote access to your IP PBX to specific IP Address will greatly discourage even the most determined hacker.  While hardware firewalls typically provide the most security, software firewalls can be just as effective and much cheaper (many are free).  

    Firewalls, of course, are only as good as the rules defined within them.  So be sure to only activate ports that are absolutely essential to run your PBX. Block anonymous WAN requests (P-I-N-G).  Lets face it, if they can find you, they can hack you.

  5. MAKE IT PRIVATE – NAT IS YOUR FRIEND!
    When possible, place your IP PBX on a lan with Network Address Translation (NAT).  NAT basically gives your IP PBX a private IP Address and makes it much more difficult to gain access to from the internet.  

  6. KEEP INBOUND AND OUTBOUND ROUTING SEPARATE (Asterisk)
    This is probably the biggest cause and source of toll fraud.  By keeping your inbound call routing in a different context than your outbound routing, if an intruder does happen to make it in to your system, he can’t get back out again.  

  7. LIMIT REGISTRATION BY EXTENSIONS TO YOUR LOCAL SUBNET.
    Restrict the IP addresses your extensions can register on to the local subnet.  Asterisk PBXs can use the ACL (permit/deny) in SIP.conf to block IP addresses.  This can fend of brute force registration attempts.

  8. DISABLE CHANNELS AND SERVICES THAT ARE NOT IN USE
    Disable channels that you aren’t using like skinny and MGCP.  For Asterisk PBXs, you can “unload” these modules in the /etc/modules.conf file like this:

    noload => chan_mgcp.so
    noload => chan_skinny.so 
    noload => chan_oss.so

  9. MAKE IT HARDER FOR SIP SCANNERS
    Set “alwaysauthreject=yes” in your sip configuration file. What this does is prevent Asterisk from telling a sip scanner which are valid extension numbers. Install a SIP port firewall.  This will block “scanning” of port 5060 and can disable the attempting endpoint for specific time when it detects a violation.

  10. LIMIT AND RESTRICT DIAL PLANS
    Restrict calling to high-cost calling destination and don’t allow calling to 0900 + Premium numbers)

  11. AUDIT YOUR SYSTEM SECURITY REGULARLY
    Once you’ve reached this point, its not a bad idea to put your Hacker hat on, and have a try at your own system.  Think like a hacker and try to look for weaknesses or holes in your system security.  It is a good idea to review your system security regularly.  Don’t sleep on security… you can guaranty that thieves aren’t.

The above steps mainly focus on PBX calling and traffic security and does not cover topics related to software protection (e.g. protection against Spyware, Trojans or viruses).   These are also very important and should also be taken into consideration when securing & protecting your PBX.

 

Published in Security