Don't be a victim of telecom theft
If you are reading this, you're probably like most of us... after many hours, or even several days of downloading software, setting up servers, configuring trunks and cracking open firewall ports, you finally achieve success - your PBX is working, and calls are passing. So, you wipe the sweat from your forehead, push away your ergonomic mesh-backed office chair (with lumbar support) and walk away pleased - not giving a second thought to security. Until one day, you log into your PBX and see the skull-and-boned call sign of a hacker that has decided to pay you’re perfectly running PBX a visit.
As a SIP trunking provider, our support team at IPComms sees this very scenario much more than we’d like to. For those PBX owners who are lucky, they’re only faced with hours of downtime and a complete system rebuild. However, unlike getting your personal computer hacked, getting hacked into your business PBX, gives the unscrupulous instant access into your virtual wallet via what is known as toll fraud. Using toll fraud, a well-informed hacker has the ability to siphon thousands of dollars in as little as one unsupervised night! With heavy volumes of wholesale phone traffic at the ready, a single hacked PBX can transmit thousands of minutes worth of calls to destinations with calling rates as high as five bucks a minute!
If your unsecured PBX is connected to a SIP trunking provider with outbound calling capability, a well-informed hacker can siphon thousands of dollars in as little as one night while you sleep blissfully. With heavy volumes of wholesale phone traffic at the ready, a single hacked PBX can transmit thousands of minutes worth of phone calls to destinations with calling rates as high as five bucks a minute or more!
Scared yet? Well, you should be! Especially, if you have just downloaded, installed and SIP trunked your first Asterisk PBX server without implementing even the most basic security. Trust us, it's not a question of if your PBX will be hacked, it's definitely a question of when it will be hacked! So, why not take a few minutes and finish your Asterisk installation, by adding basic PBX security. Ever heard the old adage, "an ounce of prevention is worth a pound of cure?". Well, we can almost guarantee you that the author was most certainly referring to PBX security!
PBX security - is not rocket science
Hopefully, you’re here proactively, and not after the damage has been done. But, if not, at least you have learned your lesson and plan to do things right this time.
While PBX security, like most other security, requires constant attention and is a continuous work-in-progress, there are some basic common sense steps that you can perform that will safeguard your system from the most common of attacks.
As mentioned in our “What is Telecom Fraud” blog, most hackers are not looking for a long drawn out hack and would much rather move on to easier targets if you would only put up a little fight. So we’ve put together a list of “11 steps to secure your Asterisk® PBX”. While this list speaks directly to Asterisk PBX owners, many of the steps can easily be carried over to most other IP PBX (VoIP) manufacturers.
Here are the 11 Steps to Secure your Asterisk PBX
- Physically secure your IP PBX and network hardware.
Physical security is very important and commonly overlooked. Be sure access to your hardware is limited to only those with appropriate access permissions, actually require access, and most importantly, know what they are doing! We tech's like to play around with stuff, but that's why we have labs.
- Never, Never, Never use the default passwords on any system. (Use Strong Passwords)
If you are truly concerned about PBX security, you will take this one piece of advice seriously! Password security is easy and by far the best way to stop the top 99% of all hacks as it is easily the most common way hackers enter IP PBX systems.
When installing your IP PBX, the very first step should be to replace both the username and passwords of any account with administrator access. Secondly, when creating user accounts, be sure not to use or allow easy to guess passwords like “1234”, “password”, “companyname1” etc.
Also, be sure to use a strong and unique password. This can't be stressed enough. As tempting and simple as it may be to use your business name with a single digit added to the end of it, don't do it. You would be surprised what these password detectors can figure out with just a little information.
- Never use the same Username and password on your extensions.
This is another VERY common issue, especially within the Asterisk community. Using password 101 for extension 101 is asking for big trouble. DON’T DO IT!
An example of what NOT to do on your extensions:
- Place your PBX behind a firewall
Lets’s face it, working on your PBX from home or allowing co-workers access to the system remotely is necessary and often unavoidable. However, doing it correctly can be the difference between security success and total and utter failure. VPNs are a good way to limit access and enable co-worker remote management. Placing your PBX behind a firewall and Restrict remote access to your IP PBX to specific IP Address will greatly discourage even the most determined hacker. While hardware firewalls typically provide the most security, software firewalls can be just as effective and much cheaper (many are free).
Firewalls, of course, are only as good as the rules defined within them. So be sure to only activate ports that are absolutely essential to run your PBX. Block anonymous WAN requests (P-I-N-G). Let's face it, if they can find you, they can hack you.
When possible, place your IP PBX on a LAN with Network Address Translation (NAT). NAT basically gives your IP PBX a private IP Address and makes it much more difficult to gain access to from the internet. While it may be easy to simply disable NAT for simplicity (especially when you run into that pesky one-way audio issue, don't do it. Take the time to set it up correctly, and you'll be glad you did.
- Use the “permit=” and “deny=” lines in sip.conf
Use the “permit=” and “deny=” lines in sip.conf to only allow a small range of IP addresses access to extension/user in your sip.conf file. This is true even if you decide to allow inbound calls from “anywhere” (default), it won't let those users reach any authenticated elements!
- Keep inbound and outbound routing separate (asterisk)
This is probably the biggest cause and source of toll fraud. By keeping your inbound call routing in a different context than your outbound routing, if an intruder does happen to make it into your system, he can’t get back out again.
- Limit registration by extensions to your local subnet.
Restrict the IP addresses your extensions can register onto the local subnet. Asterisk PBXs can use the ACL (permit/deny) in SIP.conf to block IP addresses. This can fend of brute force registration attempts.
- Disable channels and services that are not in use
Disable channels that you aren’t using like skinny and MGCP. For Asterisk PBXs, you can “unload” these modules in the /etc/modules.conf file like this:
noload => chan_mgcp.so
noload => chan_skinny.so
noload => chan_oss.so
- Make it harder for sip scanners (Set “alwaysauthreject=yes” )
Set “alwaysauthreject=yes” in your sip configuration file. What this does is prevent Asterisk from telling a sip scanner which extensions are valid by rejecting authentication requests on existing usernames with the same rejection details as with nonexistent usernames. If they can't find you they can't hack you!
Another way to make it hard for SIP scanners is to install a SIP port firewall. This will block “scanning” of port 5060 and 5061 and can disable the attempting endpoint for a specific time when it detects a violation.
- Limit and restrict routing and phone number dial plans
Restrict calling to high-cost calling destination and don’t allow calling to 0900 + Premium numbers)
- Audit your system security regularly
Once you’ve reached this point, it's not a bad idea to put your Hacker hat on, and have a try at your own system. Think like a hacker and try to look for weaknesses or holes in your system security. It is a good idea to review your system security regularly. Don’t sleep on security… you can guaranty that thieves aren’t.
The above steps mainly focus on PBX calling and traffic security and do not cover topics related to software protection (e.g. protection against Spyware, Trojans or viruses). These are also very important and should also be taken into consideration when securing & protecting your PBX.
Did you know...
By switching to a cloud-based PBX service, you can make the 11 steps to secure your IP PBX someone else's responsibility. Learn more about cloud-based PBX services.
Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames,