.png)
VoIP Toll Fraud: Why Default Device Credentials Create Risk
A simple configuration oversight on a physical phone or VoIP device can create an opportunity for unauthorized calling and unexpected charges. Here’s what organizations should review.
VoIP and cloud contact center platforms make communications easier to deploy and manage. But the physical devices connected to those platforms still need to be secured.
One risk organizations should pay particular attention to is the combination of exposed device identifiers and unchanged default credentials.
If an attacker obtains a valid identifier for a physical phone or another VoIP endpoint, such as a MAC address, the attacker may attempt to register a device using default authentication credentials. If that registration succeeds, the connection could be used to place unauthorized outbound calls.
The result can be toll fraud, including unexpected charges from international, premium-rate or other high-cost calls. Organizations may also experience operational disruption while investigating the activity, blocking calls and resetting credentials.
Verify that default credentials have been replaced with unique credentials before physical phones, gateways, SBCs or other VoIP endpoints are placed into production.
How This Risk Develops
The issue isn’t simply that someone knows a device’s MAC address. The larger risk occurs when that information can be paired with credentials or configurations that were never changed from their defaults.
A device identifier is exposed
A physical phone identifier may become visible through documentation, support records, screenshots, asset lists, labels, inventory exports or similar sources.
Default credentials are still active
The phone, gateway, SBC, base configuration or provisioning profile continues to use default authentication or administrative credentials.
An unauthorized registration is attempted
The exposed identifier and default credentials are used in an attempt to register a device against the VoIP or cloud contact center environment.
The registration is used for fraudulent calling
If successful, the unauthorized device may be used to place outbound calls, potentially creating significant toll charges.
Start With Default Credentials
Organizations using physical phones, gateways, session border controllers, or SBCs, and other VoIP endpoints should verify that default credentials have been replaced with unique credentials.
The review should include:
- Digest authentication credentials for physical phones
- Web and TUI authentication credentials
- Default administrator credentials on phones, gateways, SBCs and other physical devices
- Device provisioning templates and profiles that could reapply default settings
Whenever possible, use unique credentials for individual devices or tightly controlled device groups rather than relying on shared defaults.
Go Beyond Credentials
Limit unnecessary outbound calling
If employees or call flows don’t need to make international, premium-rate or other high-cost calls, restrict those destinations. Country- and prefix-based restrictions can provide another layer of protection.
Watch for unusual calling activity
Monitor for activity that doesn’t match normal calling patterns. This may include unexpected outbound volume, repeated short calls, unusual destinations and calling activity outside normal patterns.
Review registrations and administrative activity
Review available audit logs for new device registrations, authentication failures, configuration changes and unusual source IP addresses.
Administrative access should be limited to authorized personnel and approved management networks. Where supported, use single sign-on and multi-factor authentication for administrative portals.
Treat Device Information as Sensitive
A device identifier may seem harmless compared with a password, but it can become useful to an attacker when combined with weak or default authentication.
Maintain an accurate inventory of active phones and VoIP devices, and be thoughtful about where device information appears. That includes screenshots, tickets, shared documents, configuration exports and asset inventories.
Unused phones and inactive registrations should also be removed or disabled rather than remaining available indefinitely.
5 Questions to Ask About Your VoIP Environment
If you manage a contact center or VoIP environment, start here.
Do all production devices have unique, non-default credentials?
Do any provisioning templates or base configurations still contain vendor defaults?
Are international and premium-rate calls limited to the people and workflows that actually need them?
Are device identifiers protected in documents, tickets, screenshots and inventory records?
Have unused phones and inactive device registrations been removed or disabled?
Don’t Let a Default Setting Become an Expensive Problem
VoIP toll fraud doesn’t always require a sophisticated attack. Sometimes the opportunity comes from a basic configuration that was never changed.
Making unique device credentials part of the deployment process, limiting unnecessary dialing capabilities, monitoring unusual activity and maintaining an accurate device inventory can help reduce that exposure.
Not sure what’s exposed in your VoIP environment?
EDCi can help review your VoIP and contact center environment, identify potential gaps and determine where stronger security controls may be needed.
Contact EDCi