Toll fraud is alive and well

Fraudsters look to VoIP and unified communications as new attack vectors

Almost as long as there have been toll calls there has been toll fraud. From phone phreakers to corrupt insiders to external hackers, fraudsters have found a way to make crime pay. But three trends related to this old crime are bringing it to the forefront once again, creating headaches for enterprise managers.

One, it is increasingly obvious that toll fraud perpetrators are highly organized, operating multinational syndicates engaging in multi-million dollar fraud. Two, the widespread deployment of VoIP and unified communications (UC) is opening new attack vectors. And three, the victims of toll fraud are no longer primarily service providers, but enterprises of all types and sizes.

In June, the U.S. government announced it had broken up a $55 million toll fraud ring that was operating internationally and targeting enterprise PBXs. While details on the fraud are still emerging, according to a grand jury filing, the ring operated primarily out of Italy and Spain. The alleged ringleaders paid hackers in the Philippines to target enterprises in the United States and hack the companies' PBXs, often using techniques as simple as brute force password cracking.

The fraudsters then controlled the hacked PBXs and, through various methods, used them to make long-distance calls. They monetized the scheme by opening public long-distance calling centers in Italy and Spain, presumably charging individuals to make long-distance calls.

U.S. law enforcement officials say the fraudsters ran up 12 million minutes in telephone usage, which was estimated to represent approximately $55 million in fraudulent charges across the various enterprises and service providers affected by the scheme.

It is clear that technically sophisticated groups are making use of ubiquitous telephony and data infrastructures to raise the ease and frequency of these crimes to new levels. And they are finding increasingly creative ways to cash out as they exploit their victims.

Old Crime, new network, new targets

While the $55 million toll fraud ring appears to have targeted traditional PBXs, taking advantage of inadequate password practices, the new world of VoIP telephony poses equally new fraud risks.

In fact, a VoIP network that makes use of Session Initiation Protocol (SIP) trunks for PSTN connectivity can create greater potential for losses to toll fraud than traditional T1 TDM connectivity. For example, a compromised media gateway with two T1s could potential yield about 2,750 call minutes per hour for a fraudster to exploit. In contrast, a SIP trunk of roughly equivalent bandwidth and using a common compression algorithm could provide 6,000 call minutes per hour. So at a minimum, a SIP trunk provides at least double the amount of usage minutes to exploit, and perhaps several times more if bandwidth usage can be increased during off peak hours.

In the most basic scenario, a VoIP fraudster exploits a vulnerability to gain access to the IP-PBX or long-distance service, or both. There are four common configuration mistakes in VoIP and UC security architectures that can increase the risk of this type of exploitation:

1. Weak user authentication and access control. Many enterprises that deploy more robust forms of user authentication for data connectivity, such as token-based two-factor authentication, fail to extend this authentication to their telephony endpoints using the same converged infrastructure.

2. Relying solely on session border controllers or media gateways to provide security. Border controllers provide critical network interoperability and related demarcation functionality, helping to manage the boundaries between networks when terminating SIP trunks. However, the authentication, access control, encryption and threat mitigation functionality of border controllers and media gateways are lacking when it comes to protecting against application layer security issues. These issues will permit a fraudster to conduct reconnaissance and map internal systems to gain knowledge of extensions to exploit, and log-in using spoofed identities to gain access to the PSTN.

3. Inadequate virtual LAN separation and control. A common and necessary practice for enhancing security in a VoIP network is to create Virtual Local Area Networks to logically segregate voice and data traffic. However, as a security mechanism, VLAN separation is easy to defeat by a moderately sophisticated attacker. Furthermore, VoIP exploits have been discovered that enable an attacker to gain control over a PC running a VoIP soft-phone and compromise the entire VoIP and data network, including access to all telephony functions that can be exploited for toll fraud. VLAN separation, while necessary, should not be viewed as comprehensive security, but must be supplemented by other security controls.

4. Inadequate use of encryption. Faulty or spotty use of encryption is the top security issue in many security architectures. While encryption often is employed for communications that traverse the enterprise DMZ and cross untrusted networks such as the Internet, enterprises often turn encryption off on internal communications for troubleshooting purposes or because of performance issues. Many recent high-profile breaches of security and data in motion have stemmed from attackers gaining access to internal networks and sniffing unencrypted traffic. It becomes a simple matter for such an attacker to steal credentials to make toll calls.

None of these vulnerabilities implies that VoIP or UC are inherently any less secure than traditional TDM telephony. Rather, a proper VoIP security architecture is built on the recognition that classic approaches to data security and network security must be complemented by application-layer security that addresses the needs of the evolving communications applications.

Application-layer security in common configurations involves establishing a standard mechanism of monitoring all signaling and media for all VoIP and UC traffic entering the enterprise or accessing any core systems. Typical deployments of application-layer security systems will include functions such as signature-based threat detection and mitigation, security policy enforcement on a per-user or per-application basis, access control and authentication, and similar functions.

Enterprises also are proactively addressing toll fraud threats by conducting periodic VoIP and UC security assessments, including penetration testing where appropriate. These penetration tests are much like the data penetration tests used by enterprises to maintain compliance with privacy standards such as those used by the payment card industry for credit card processing. A VoIP or UC assessment can uncover security gaps that create openings for toll fraudsters to ply their trade.

Enterprise security practitioners and IT managers who recognize the changing security paradigm and rise to the challenge will be those best able to defend their enterprises against toll fraud. And they will be those least likely to be surprised by the unexpected $55 million bill in the mail.

Boone is vice president of marketing for Sipera Systems, a supplier of VoIP and unified communications systems. He can be reached at

Learn more about this topic

Beware of UC security threats

VoIP requires strict attention to best security practices

Confessions of a caller ID spoofer

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.
Now read: Getting grounded in IoT