Most attacks on phone systems are not about espionage; they are about money. Once attackers gain access to an extension or a trunk, they usually use it outside business hours to call international numbers or premium-rate lines that pay them a share of the revenue. This abuse (Toll Fraud) is often discovered the next business morning, through the bill or a drained trunk balance.
Where Do Attacks Come From?
- Scanning and guessing extension passwords: automated tools constantly scan the internet for open SIP ports and try simple passwords on common extensions.
- An exposed admin panel: the phone system’s web panel with a default password or outdated software.
- Forgotten features: capabilities such as DISA (getting a dial tone from outside to place outbound calls), callback from voicemail, or call forwarding to external numbers, protected by weak PINs.
- Phones: handset web interfaces with default passwords that leak SIP account details.
Layer One: Hide the Phone System from the Internet
- The admin panel is reachable only from the internal network or over VPN.
- SIP ports are open only to the trunk provider’s IP addresses.
- Remote workers and branches connect over VPN. If you must register extensions directly over the internet, use automatic blocking of attacking IPs, for example with Fail2ban, and TLS encryption.
- Anonymous, unauthenticated calls are not accepted.
Changing the SIP port from 5060 to another number reduces the volume of scans, but it is not security. Without access restrictions and strong passwords, you will simply be found a little later.
Layer Two: Passwords and Accounts
- Each extension password is long, random and unique; not the extension number and nothing like
1234. - The default password on the admin panel and on every phone’s web interface is changed.
- Voicemail PINs are not simple or the same as the extension number.
- Extensions belonging to employees who have left the company are disabled the same day.
Layer Three: Restrict Outbound Calling
Even if an account is compromised, these settings limit the damage:
- International blocking: if the company makes no international calls, block them completely; if it does, allow them only for specific extensions and required destinations.
- Extension permission levels: the lobby or warehouse extension has no need to call mobiles or other cities. Define outbound routes based on each group’s needs.
- Time restrictions: high-cost calls are blocked outside business hours.
- Concurrent call limits for each extension and trunk.
- Credit limit with the provider: if possible, set a daily or monthly spending cap.
Layer Four: Monitoring and Updates
Review call detail records (CDR) regularly, or better yet, set up automatic alerts for outbound calls in the middle of the night, calls to unusual prefixes, or a sudden jump in call volume. Check the logs of failed registration attempts too; a wave of failed attempts means someone is guessing passwords. Keep the phone system software, modules and phone firmware up to date, and keep a backup of the phone system configuration.
Common Mistakes
- Leaving DISA or external call forwarding enabled years after it was turned on for a temporary need.
- Assuming “our company is small and nobody will bother with us”; scanners do not pick targets, they try everyone.
- Having no restrictions at all on outbound routes.
Checklist
- The admin panel and SIP ports are protected from the internet.
- Extension, voicemail and phone passwords are strong and not left at defaults.
- International and high-cost calls are restricted or blocked.
- DISA and external forwarding features have been reviewed.
- Automatic alerts exist for unusual calls.
Phone system security is usually not taken seriously until the day the bill arrives. ITPlus724 engineers can review the security settings of your phone system and fix its weak points.