VoIP hackers strike Perth business

VoIP hackers strike Perth business

Summary: A hacker recently obtained unauthorised access to the IP telephony (VoIP) system of a Perth business, making 11,000 calls costing over $120,000, according to the Western Australian police.

TOPICS: Unified Comms, Legal

A hacker recently obtained unauthorised access to the IP telephony (VoIP) system of a Perth business, making 11,000 calls costing over $120,000, according to the Western Australian police.

(Credit: ZDNet.com.au)

The calls were made over a period of 46 hours, the police said, and the business only became aware of the imposition when it received an invoice from its service provider.

Thieves have always targeted PBX systems by finding numbers used for remote calling — for mobile employees or those requiring international call access outside of business hours — to make calls at the company's expense.

This has in the past been exploited for uses such as routing calls made on cheap international phone cards, according to Pure Hacking senior security consultant Chris Gatford.

However, police said they were more concerned with the increasing number of occurrences such as that in Perth where the thieves gained access to users' VoIP network. They have issued a warning to small businesses to ramp up their VoIP security.

"Business operators should invest in appropriate security software to protect their communication systems. Most businesses are prepared to install firewalls on their computers but fail to extend that level of security to their phone systems," detective sergeant Jamie McDonald said in a statement.

Pure Hacking's Gatford said that he saw fraudsters exploiting weak VoIP passwords as more of a threat than the older style targeting of PBX systems. "From a fraud perspective, an ISP-based VoIP gateway with a weak user name and password would be the bigger problem going forward in telephony," he said.

VoIP systems from companies such as Alcatel-Lucent, Cisco and Avaya were quite good, Pure Hacking's Gatford said, but were unlikely to be found in very small businesses due to the cost.

To prevent businesses landing in the same VoIP quagmire as the Perth company, Gatford suggested that businesses create strong passwords and change them regularly. He also said that businesses with "road warriors" needed to be aware of the wireless or hotel networks they were conducting their business from.

Topics: Unified Comms, Legal

Suzanne Tindal

About Suzanne Tindal

Suzanne Tindal cut her teeth at ZDNet.com.au as the site's telecommunications reporter, a role that saw her break some of the biggest stories associated with the National Broadband Network process. She then turned her attention to all matters in government and corporate ICT circles. Now she's taking on the whole gamut as news editor for the site.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • VoiP Hackers

    What always interests me in these incidents is that there are two groups who profit out of this type of fraud, the hackers/ fraudsters and the service providers.

    How come service providers get money , are able to profit from the fraud............ they haven't lost any goods other than some electricity and possibly some connection fees but they do always make money from fraud !
  • VoIP Hackers

    You would expect that the people who foot the bill are the insurance companies, who I'm sure really wouldn't have a problem finding the cash.

    I don't see why the service provider should have to waive the charges when they have actually provided the service - irrespective of how legitimate the user was!
  • Firewalls are useless.

    There is no meaningful deep packet inspection of VOIP traffic packets available.

    Some vendors claim to have "voip aware" firewalls but they are a waste of money.

    Anyway, this seems to be a case of a "hacker" merely running brute force attacks against a username/password combo.

    Whoever put the VOIP system in probably left the defaults in place.

    Typical amateurs !
  • Safeguard against VoIP hackers

    Business can generally avoid this kind of illegal activity by securing their PABX equipment as well as having management tools that alert users when unusual call behaviour occurs.

    For example; you can program them to email or SMS you if calls are made to a particular country or hit a certain call duration.

    Following on from other comments here, it's very secure as long as you have professional people setting it up and implementing a proper security policy around calls.
  • VoIP Hackers

    I am not sure that all users are conversant with PABX vulnerabilities both internal and external.

    Whilst I am no expert a point of access to a Telephon system that can be overlooked is a PABX's inbuilt modem [external support]. If you know that number you can become the all powerful genie.

    Good management practice requires PABX systems that are supported with software that provides management with real time exception reporting.

    Otherwise you pay's your money and takes your chances.....
  • You are looking at the wrong vector here

    Dial through fraud is very preventable. In most cases I have seen it is not the line side VOIP vector that gets passwords, opens hole into the router/PBX/Gateway then dials out over outbound trunks....it's the trunkside.....your PSTN edge that is the access vector. (via modems, DTMF altering, DISA code entry etc). Sometimes it is accessing the gateway due to poor implimentation but the cost in incurred by the PSTN dialout. (Which exists even when you move to IP Tel) You need an inline Policy based Trunkside Firewall and IPS which carriers and PBX vendors DO NOT provide. It is the forgotten edge so to speak. Yet every enterprise has one facing the un-trusted public voice network. With a Voice FW/IPS you can look at call types and attributes on the inbound and outbound call legs. And by combining the 2 (in and out) one can profile and mitigate/enforce the behavior in a very granular fashion. The cost is derived from the long distance egress that is incurred via their PRI, Analog, SS7 trunks. Not the VOIP line side handsets. There is a solution to this very old problem. The packet only security vendors do NOT address this which is a shame.
  • VOIP for funa nd prodit

    1. Setup a per-per-minute phone service in some offshore haven
    2. Hack someone elses VOIP system to dial the system on every possible outbound line and leave hte conenction open.. overnight... over the weekend
    3. Profit!

    Hopefully the 'victims' of this are clueful enough to analyse the DESTINATION of those calls
    • unfortunately its not that simple as they generally only establish the initial connection to open the line which is then connected to another companies PABX which has also been hacked and they are then used as "traffic gateways" they hop so many times and through so many countries that it is VERY difficult to track.....funny thing is that VoIP as a technology has very little to do with the problem as this was an issue well before VoIP!
  • Stop this problem dead

    My company also had this happen ! we lost $20,000 in a night. We didn't know that there is a PABX Firewall that can now stop. It costs about $450 and is well worth it. It has stopped 3 attemps to break through our phone system todate. The Firewall is phone system based. We got when we updated our phone system to a Panasonic. The software is called Control Phreak. I just wish we had this before our 1st loss.
  • If your going to run Asterisk, make sure you set it up properly. Get a linux guy to check your server. I've seen plenty of voip servers with things set to default when they shouldnt.
  • We use Trixbox (linux/Asterisk) with an encrypted IAX connection to the PSTN provider. All other connections are passworded and locked to IP addresses. Plus the PBX is port forwarded from the firewall to avoid attacks on the server. SIP connections are not firewall friendly and you have to be much more careful to set them up
  • The best way to overcome this issue is ask your VoIP provider if they have SIP security. Prodial a Aust company has this.
  • Acme Packet provides both Service Provider and Enterprise SBCs. I'm using one of those and never experienced any security issue
  • guys this is silly, if your PBX gets hacked, you dont have to pay for it, read the telecommunications act, it clearly states that the owner of a phone line doesnt need to pay for fraudalent calls and the ISP should consult their insurance, it's upto the ISP to lock down and detect hacks, not someone with a phone...

    if your vodafone mobile made calls to anonymous destinations because you left it on the bus, your not the one who has to pay (as much as you think you are) it's upto vodafones insurance company... however the ISP will chase you up and hassle you ALOT to make you think otherwise.
    • Youre half right.

      You have to prove first that the calls were fraudulent and not placed by yourself or your employees. Youre going to have a shit of a time proving that with your own personal mobile. If you dont do any investigations/logging/tracking/troubleshooting with your VOIP system, how are you going to uphold your right under the telecoms act if you have no way of proving that you didnt make the calls?