Businesses warned over VoIP PBX security

FBI and security specialists have uncovered a flaw on some systems that could leave the PBX open to external attack.

Networking

IP PBX installations are potentially at risk from external hacking attacks following the discovery of a major security flaw.

The discovery was revealed by the US Federal Bureau of Investigation (FBI) and relates to the Asterisk open-source product that turns a Linux computer into a VoIP phone exchange.

Hackers are exploiting the vulnerability in order to hijack a company's PBX to use it for so-called vishing' attacks, whereby people are duped into calling a fake call centre, usually based on the hijacked PBX, where they are then tricked into handing over their sensitive data. At the same time, the company suffering the PBX hijack is usually left with a hefty phone bill.

The FBI didn't reveal which versions of Asterisk were vulnerable in order to limit the amount of information on offer to hackers. However, upgrading to the latest version of the software will apparently fix the issue.

Asterisk, like several other open-source VoIP PBX systems, is used extensively in the small business arena due to its low deployment cost and good reputation for reliability and ease of use.

"The problem facing small business users of VoIP PBX systems is that although the PBX is hooked up to the regular telephone network and a company's broadband connection, most firms' IT security resources do not extend their complete protective envelope around the PBX platform," said Rob Rachwald, director of product marketing at application vulnerability specialist Fortify.

"This means that users of VoIP PBX systems who think their telephone system is covered by, for example, a firewall application, can wake up with a nasty surprise on the phone bill front, after their PBX system has been compromised."

Rachwald added that a growing number of open source applications, including Asterisk, are being security tweaked and installed on more secure dedicated appliances, rather than repurposed PCs.

Featured Resources

Four cyber security essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

Recommended

Sopra Steria cyber attack costs to hit €50 million
Security

Sopra Steria cyber attack costs to hit €50 million

26 Nov 2020
Sophos warns customers of potential data leak
Security

Sophos warns customers of potential data leak

26 Nov 2020
Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron
Security

Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron

26 Nov 2020
Egregor ransomware could take up where Maze left off
Security

Egregor ransomware could take up where Maze left off

26 Nov 2020

Most Popular

80% of cyber professionals say the Computer Misuse Act is working against them
Security

80% of cyber professionals say the Computer Misuse Act is working against them

20 Nov 2020
Cisco acquires container security startup Banzai Cloud
Security

Cisco acquires container security startup Banzai Cloud

18 Nov 2020
Weekly threat roundup: Cisco, BlueKeep, Apache Unomi
Security

Weekly threat roundup: Cisco, BlueKeep, Apache Unomi

19 Nov 2020