Free Newsletter
Register for our Free Newsletters
Access Control
Deutsche Zone (German Zone)
Education, Training and Professional Services
Government Programmes
Guarding, Equipment and Enforcement
Industrial Computing Security
IT Security
Physical Security
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor

Toll fraud escalates on back of inadequate VoIP security

Sipera Systems : 09 June, 2009  (Technical Article)
VoIP security architecture review by Sipera Systems unearths inadequacies leading to toll fraud exploitations
Sipera Systems has reported that VoIP toll fraud continues to escalate, based on evidence uncovered in numerous VoIP and UC architectures.

Across dozens of security architecture reviews and solution deployments, Sipera's security experts have discovered numerous cases of vulnerabilities commonly exploited for toll fraud, including confirmed fraud resulting in losses ranging from a few thousand dollars to hundreds of thousands of dollars.

The vulnerabilities affect both enterprises and service providers, and they stem from widespread gaps in insufficient VoIP and UC security architectures. Toll fraud occurs when unauthorized users, often external to the service provider or enterprise, exploit vulnerabilities to make toll calls to domestic or international locations. The unsuspecting enterprise or service provider is subsequently hit with extraordinarily high toll charges or call termination charges that have no clear cause.

"We'd expected a correlation between growing awareness of VoIP and UC vulnerabilities and security best practices, and a decrease in toll fraud activity. But we are finding the opposite, that toll fraud actually is on the rise," said Adam Boone, Vice President of Marketing at Sipera. "Our customers are being proactive and designing effective security architectures that prevent toll fraud. But fraudsters are aggressively figuring out how to exploit common security gaps found in many VoIP and UC deployments at enterprises and service providers that have not yet focused on this problem."

The primary security architecture shortcomings leading to toll fraud include:

* Telecom Connectivity Vulnerabilities: Many enterprises have moved to SIP trunking for low-cost telecommunications connectivity. Unfortunately, these enterprises often rely on Session Border Controllers for security of real-time VoIP and UC traffic, making them highly vulnerable to toll fraud. In production security architecture analysis, Sipera has identified nine common configuration errors, vulnerabilities and functional limitations that leave enterprises using SBCs for VoIP security exposed to toll fraud risk.

* Application-Level Vulnerabilities: In many cases, application servers, voicemail systems, and other communication systems can be easily exploited by fraudsters because of weak passwords and authentication schemes. Furthermore, security policy enforcement mechanisms in such systems are often inadequate to stop fraudsters from using them to gain access to toll calling facilities.

* End-Point Vulnerabilities: Weak security on user devices and inadequate authentication schemes enable fraudsters to exploit these devices to pose as authorized users and gain access to toll calling facilities.

"Toll fraud has been around in many forms for a long time. But VoIP and UC bring with them new security architectures that give fraudsters new openings to perpetrate this old crime," said Ryan English, Vice President of Product Management at Vigilar. "We are helping our clients to adopt proper security best practices to prevent toll fraud, and our work with our partner Sipera is helping to keep VoIP and UC security architectures well ahead of the fraudsters."

Along with partners like Vigilar, Sipera Systems and Sipera's Viper Lab security research and consulting arm offer these solutions to customers seeking to improve their defences against toll fraud:

* Security assessments: Sipera's Viper Lab offers the industry's most advanced VoIP and UC security architecture consulting services, including VoIP penetration testing and comprehensive UC vulnerability assessments.

* Seamlessly integrated security appliances: Sipera's award-winning UC-Sec security appliances are the industry's only purpose-built, comprehensive security solutions designed for real-time VoIP and UC traffic. Used in dozens of deployments worldwide, UC-Sec prevents toll fraud in VoIP and UC via policy enforcement, access control, threat mitigation and encryption. UC-Sec fits flexibly into any security architecture to complement and enhance an enterprise's security posture.
Bookmark and Share
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
   © 2012
Netgains Logo