Security Solutions Featured Article

If you’re a business owner and you’re noticing a bunch of unexplained long distance charges on your phone bill, it could be that you’ve been a victim of VoIP toll fraud, which is where hackers get access to your corporate phone system in order to secretly and routinely make long distance calls.

Toll fraud even happens to the major carriers: For example, earlier this year four men in Texas were arrested by the FBI for allegedly stealing more than 120 million minutes of telephone service from AT&T and Verizon and reselling those minutes to consumers. Other hackers have tapped into the networks of major carriers and stolen minutes as well – and in most cases the carrier didn’t notice until it was much too late.

According to Sipera Systems, a provider of VoIP and unified communications security solutions, VoIP toll fraud continues to escalate, based on evidence it has uncovered in numerous VoIP and UC architectures. The company claims that losses incurred from these incidents -- which affect both enterprises and service providers -- range from a few thousand dollars to hundreds of thousands of dollars.

The hackers are increasingly exploiting vulnerabilities in VoIP and UC security architectures -- including telecom connectivity vulnerabilities. For example, many enterprises have moved to SIP trunking for low-cost telecommunications connectivity, thus they are relying on Session Border Controllers for security of real-time VoIP and UC traffic. But depending on how they are deployed, this architecture can sometimes make organizations vulnerable to toll fraud.

In production security architecture analysis, Sipera (News - Alert) has identified nine common configuration errors, vulnerabilities and functional limitations that leave enterprises using SBCs for VoIP security exposed to toll fraud risk.

There are also application-level vulnerabilities to consider. In many cases, application servers, voicemail systems, and other communication systems can be easily exploited by fraudsters because of weak passwords and authentication schemes. Furthermore, security policy enforcement mechanisms in such systems are often inadequate to stop fraudsters from using them to gain access to toll calling facilities.

There are end-point vulnerabilities to think about as well. Weak security on user devices and inadequate authentication schemes enable fraudsters to exploit these devices to pose as authorized users and gain access to toll calling facilities.

"We'd expected a correlation between growing awareness of VoIP and UC vulnerabilities and security best practices, and a decrease in toll fraud activity,” said Adam Boone (News - Alert), Vice President of Marketing at Sipera, in a release. “But we are finding the opposite, that toll fraud actually is on the rise.”

“Our customers are being proactive and designing effective security architectures that prevent toll fraud,” he added. “But fraudsters are aggressively figuring out how to exploit common security gaps found in many VoIP and UC deployments at enterprises and service providers that have not yet focused on this problem.”

“Toll fraud has been around in many forms for a long time. But VoIP and UC bring with them new security architectures that give fraudsters new openings to perpetrate this old crime," added Ryan English, vice president of product management at Vigilar, a Sipera partner that offers information security solutions and services. “We are helping our clients to adopt proper security best practices to prevent toll fraud, and our work with our partner Sipera is helping to keep VoIP and UC security architectures well ahead of the fraudsters.”

With companies like Vigilar (News - Alert) and Sipera Systems, organizations can improve their defenses against toll fraud. Sipera's VIPER Lab offers advanced VoIP and UC security architecture consulting services, including VoIP penetration testing and comprehensive UC vulnerability assessments. Meanwhile Sipera's UC-Sec security appliances are purpose-built, comprehensive security solutions designed for real-time VoIP and UC traffic. Used in dozens of deployments worldwide, these solutions prevent toll fraud in VoIP and UC via policy enforcement, access control, threat mitigation and encryption.

In May, Sipera Systems (News - Alert) announced availability of a distributed workforce communications solution, Sipera Business Continuity Communications Solution (SBCCS), which enables enterprises to establish a comprehensively secure voice over Internet protocol (VoIP), video, messaging, collaboration and other UC for a geographically extended and dispersed employee base.

Sipera Systems also announced in March that its UC-Sec Teleworker solution is now compliant with IP telephony solutions from Avaya.