Voip security seems to be non-existant in practice. I recently spent some time in popular Voip forums because of a planned roll-out here and heard a lot of conc

Voip security seems to be non-existant in practice. I recently spent some time in popular Voip forums because of a planned roll-out here and heard a lot of concerning things. It seems no one has any idea how firewalls work (Voip needs both TCP and UDP) and they just leave listening ports open to the world, instead of locking them down to their SIP trunk provider. Asterisk, and others, by default handle anonymous calls so anyone able top contact the voip port on your server can ring phones. Voicemail and automated attendant hacks are everywhere. The laziness of the community to handle these is frightening, not to mention none of this stuff was built with a security-first mindset, so every fix is just plugging another hole. There will always be more holes in Asterisk based systems. Every PBX is just a copy of the old school analog PBX systems, so everything is ugly and a configuration nightmare. I'm not even sure if its even possible to secure these things. PBX's have all the liabilities of the POTS system and a TCP/IP system. Obscure dial presses and IVR hackers are everywhere. No one really understands this stuff and making sure an attacker can't break out of the IVR is actually fairly difficult as these things are designed to do their best to route calls and there are so many ways to do that. The most popular PBX is FreePBX which runs on a dated CentOS distro where using yum to update breaks things, so everyone waits for a shell script released by Schmooze to do package updates. Of course, they will not be as fast as the distro mirrors so you have to wait for your managed updated while the hackers are loose with exploits for your platform. Then hope to Alexander Grahame Bell that the script doesn't break the Jenga-like system that is Asterisk-based PBX's. Spoiler: they usually do. Encryption is borderline non-existant as anything that can interfere with the precious jitter and latency limitations of voip is disregarded, so everything is plain-text and open to trivial sniffing. No IPS/IDS out of the box. No botnet filtering out of the box. No captchas on logins for users. No SELinux. No modsecurity. No OSSEC. No nothing really, these distos are not made by people who grok security. They seem to be made by ex-big iron phone cowboys who came from managed Cisco and Avaya environs and think linux is a magical unhackable black box. Spoiler: it isnt. I was going to write a security guide for the FreePBX distro but gave up when any little change broke something. Other than seriously firewalling these things off behind something that can run IPS/IDS and having Voip on its own vlan with nothing else, there's not much you can do. They're really delicate and easy to hack. Lastly, in regards to the article, there is zero proof that all these scammers are all using stolen voip servers. They probably are in some cases, but its trivial to sign up with an international provider and make calls from Mumbai to the USA for pennies per minute. The tolls are trivial compared to what you can get just out of one person scammed. Most hacked boxes seem to be lone hackers getting free long distance or small operators reselling that long distance to shady-market buyers using bitcoin.