VoIP security

VoIP networks comes with security risks, but your organization doesn’t need to fall victim to attacks from malicious hackers. Image source: Getvoip.com

For two days earlier this year, six telephone lines in a San Diego hospital emergency room went dead. Before the loss of service, a hospital employee answered the phone and was shocked to receive ransom demands from a malicious hacker. Next thing they knew, the phone lines went dead – all due to a DDoS (Distributed Denial of Service) attack on their VoIP system. All incoming callers, such as ambulance workers and patients’ loved ones, were confronted with the frustration and fear of constant busy signals. The hacker was able to take control of the hospital’s phone lines by exploiting the vulnerabilities in the VoIP and telephone system after demanding hundreds of dollars. The attacker then generated thousands of phone calls to the targeted phone system to tie up all the lines.

VoIP has been steadily growing in popularity over the last few years – it’s in our homes, offices, and our most critical community services. This technology provides a powerful networking capability by unifying voice communications and data networking. VoIP gives us substantial benefits over traditional phone systems as it is cost effective, easy to deploy, and does not require regular visits from a phone vendor. However, widespread use of VoIP has opened the doors for new security challenges because VoIP systems are more vulnerable to impersonation, identity theft, and toll fraud attacks.

We have heard in the news about DDoS attacks taking down websites by flooding the server with connection requests. This malicious attack hits even closer to home when DDoS attacks occur on phone systems of public agencies like hospitals or fire stations. This has become a cause for concern, and the US Department of Homeland Security is working on their response protocols for this type of attack on critical infrastructure.

Another company recently fell victim to a different type of attack on their VoIP network. In this case, hackers made 1,100 calls via the company’s VoIP system, running up a bill of AU$120,000 in just two days, making this one of the most expensive cases of toll fraud attack on record! This Toll Fraud attack occurs when the hacker hijacks the VoIP phone systems and pushes through charges that may total up to thousands of dollars per hour or more. In a VoIP system, you send your credentials to the device with which you want to communicate. The hacker is able to copy those credentials to their own equipment, allowing them to take control of the phone lines within a few hours. There is also the risk that hackers can capture phone conversations and use them to obtain sensitive personal information.

Thankfully, organizations using VoIP aren’t just a sitting duck. There are many known security measures being implemented in an ongoing arms race between hackers and VoIP providers. Organizations can deploy intrusion detection and prevention systems in VoIP networks to monitor the system and determine malicious activities. Implementation of strong encryption standards, firewalls, intrusion detection and prevention systems, in addition to proactive network monitoring, can reduce risks to your organization’s VoIP network. Frequently updated patches and security controls can better protect the VoIP system against new threats and vulnerabilities.

Mosaic NetworX can help your company make smart decisions regarding your VOIP solutions. Please contact us for knowledgeable guidance today.