Three simple reasons VoIP abuse will grow

Cisco predicts more hackers will set their sights on Voice over IP. Three reasons why the technology is ripe for abuse

In its recent annual security report, Cisco predicted VOIP abuse as a potential area for cyber crime growth.

"Criminals use brute-force techniques to hack private branch exchange (PBX) systems to place fraudulent, long-distance calls; usually international," the report states. "These incidents, often targeting small or midsize businesses, have resulted in significant financial losses for some companies."

Also see VoIP security: The basics on

One of the most popular scams employed by VOIP-abusing criminals are vhishing schemes, which are telephone-based phishing ploys. The report points to one recent vhishing scam targeting the Federal Deposit Insurance Corporation. Vhishers called U.S. consumers on mobile and land-line phones to inform them they were delinquent in loan payments that had been applied for over the Internet or made through a payday lender. Criminals were able to collect personal information, such as Social Security numbers from victims, according to the report.

"What we've seen in the last couple of years is growing VOIP abuse around getting access to someone else system with baseline security hacks and then either using it for criminal purposes or selling it to other folks as long distance," said Patrick Peterson, Cisco fellow and chief security researcher."Some people have made money that way and some victims received huge telcom bills."

Peterson and Cisco technical manager Randy Birdsall explain why VoIP abuse has been on the upswing in recent years and appears poised for further growth.

It's widely deployed

According to market research firm In-Stat, almost 80 per cent of businesses will use Voice over Internet Protocol by 2013. And VoIP is in most enterprises in some fashion by now, according to Peterson. Whether it's fully deployed or still being tested, it's now pervasive, and therefore a target for criminals.

"Anytime there is a free, anonymous resource, criminals flock to it because that combination of free and anonymity is too good to be true," said Peterson. "What we've seen is an extraordinary increase in the last few years in the number of cracking attempts, and port scans, and attempts to log in with default admin passwords on various VoIP access points."

As VOIP has gained popularity, it's now a worthwhile endeavor from criminals because there is a large pool of potential victims to pull from. Birdsall said the concern among organizations using VoIP has changed, too.

"When I first started talking to companies a few years ago about VOIP security, the comments were 'Well, it's good to know it's available,'" he said. "Now the conversation is, 'We have had this incident happen. Now we want to know everything you can tell us so it doesn't happen again.'"

There are several ways to abuse it

While vhishing and SPIT (spam over internet telephony) get the most attention as VoIP problems, there are many ways criminals can take advantage of a VoIP network. Denial-of-Service attacks using VoIP technology are gaining popularity. In these attacks, criminals make the victims' phones ring constantly or sound busy.

"Organizations are deploying gateways that allow them to do SIP trunking to service providers as a way to save cost on telecom bills," explained Birdsall. "Now they are out on internet with a gateway that has the ability to do SIP trunking, and SIP is an open protocol. There is a lot that is known about that across the entire industry and that is a great thing. But it also allows more people to understand it to the point of manipulating it and using it doing things with it that are malicious."

Some of the other types of exploits Birdsall has seen include criminals routing calls through an organization's SIP trunk under the guise of being a telephony-service provider, therefore selling a service they never had to pay for. Criminals can also route their calls over the unsecured gateway to other sources, therefore bypassing long distance charges and international call charges.

"They can also redirect calls to 900 numbers, or other numbers that allow them to actually make money off of it," said Birdsall.

There is also the potential for hackers to breach your network and steal sensitive data using the gateway.

"One financial institution pulled me in when they noticed traffic coming from their product out to the internet. In that case, they (the criminals) had leveraged the IP-telephony network to gain access to a data path within their corporate enterprise. So the IP-telephony network was a way to get to the data side of things. That's another attack vector people may not have anticipated."

It's not well protected

"In a lot of mid-market organizations, VOIP systems are deployed to save money, but they dont have someone on staff who understands the security implications and knows what to look out for. They are leaving it wide open," said Birdsall.

Read more in Skype security: Is the popular VoIP service safe for business?

A VoIP network often shares the vulnerabilities of the operating system it runs on, yet the organization often fails to protect it with standard firewalls and security software. Many neglect to change the default manufacturer passwords that come with the system.

"Organizations deployed these systems several years ago and then just sort of forgot about security," said Peterson.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityvoiptelecommunicationCisco Systems

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joan Goodchild

Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?