An unsecured VoIP server is a common target for toll fraud — attackers who compromise weak extensions and use them to place expensive international calls at your expense. This guide covers essential protective measures.
Understanding the Threat
Automated scanners constantly probe the internet for exposed SIP servers with weak extension passwords — once compromised, an attacker can generate substantial charges by routing calls through your trunk to premium or international numbers, often discovered only after receiving an unexpectedly large bill.
1. Use Strong, Unique Passwords for Every Extension
Never use simple numeric passwords (matching the extension number, or "1234") — use genuinely strong, random passwords for every single extension, no exceptions.
2. Disable Anonymous/Guest Calling
[global]
allowguest=noPrevents unauthenticated SIP requests from being processed at all — a fundamental protection against unauthorized access.
3. Restrict SIP Access by IP Where Possible
If your extensions only ever connect from known, fixed locations, restrict SIP signaling access to those specific IPs via firewall rules — not always practical for remote/mobile users, but valuable wherever feasible.
4. Implement Fail2Ban for Asterisk
sudo apt install fail2ban -ysudo nano /etc/fail2ban/jail.local[asterisk]
enabled = true
filter = asterisk
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 3600Automatically blocks IPs showing repeated failed authentication attempts, similar to how Fail2Ban protects SSH — see How to Install and Configure Fail2Ban on Ubuntu & Debian for the underlying tool.
5. Restrict Outbound Calling Patterns
Configure outbound routes to block or require additional authorization for expensive destinations (premium numbers, specific high-risk international codes) your business doesn't legitimately need to call.
6. Set Up Call Rate Limiting
Limit the maximum number of concurrent outbound calls per extension/trunk — a compromised extension attempting to place many simultaneous fraudulent calls is contained rather than able to run up unlimited charges simultaneously.
7. Monitor Call Detail Records (CDR) Regularly
Review call logs periodically for unusual patterns — calls at unusual hours, to unfamiliar international destinations, or unusually high call volume from a single extension are all red flags worth investigating promptly.
8. Set Up Billing Alerts with Your SIP Trunk Provider
Many providers support spending alerts or hard caps — configure these as a financial safety net even if your technical security measures are solid, since they limit worst-case exposure if something is missed.
9. Change Default Ports Where Practical
Moving SIP signaling off the well-known default port (5060) reduces exposure to automated scanners specifically targeting that default, though genuinely targeted attackers can still discover non-default ports through broader scanning.
10. Keep Asterisk/FreePBX Updated
Apply security updates promptly — VoIP software vulnerabilities, like any software, are occasionally discovered and patched.
11. Disable Unused Features and Extensions
Remove or disable any extension, trunk, or feature not actively in use — every active component is potential attack surface.
Common Errors
Unexpectedly high phone bill — immediately review CDR logs for unfamiliar destinations/patterns, disable any compromised extension immediately, and contact your trunk provider about the situation.
Continue Reading
- How to Install and Configure Fail2Ban on Ubuntu & Debian
- How to Set Up SRTP and TLS Encryption for Secure VoIP
- How to Set Up Call Recording and Compliance Logging
Browse more articles in VoIP & Communication Servers.
