SIP trunking security best practices

What toll fraud is

Toll fraud is the unauthorised use of a phone system or SIP account to place calls that the owner pays for. The usual pattern is international revenue share fraud: an attacker gains the ability to make calls through your system and directs them to international or premium-rate numbers from which they, or someone they work with, receive a share of the call charges.

Attacks are typically automated. Internet-facing SIP services are scanned continuously for open ports, default passwords and weak extension credentials. Once access is gained, calls are often placed in parallel, outside business hours or at weekends, so that the activity runs for as long as possible before anyone notices.

Under most service agreements, calls placed with your credentials or from your system are chargeable to you, whether or not you authorised them. Check your own contract. Prevention therefore matters more than recovery, and no single control is enough; the measures below are designed to work in layers, so that a failure in one is contained by the next.

Who controls what

Security is shared between you and your provider. It helps to be clear about which controls sit where, because a provider cannot patch your PBX, and you cannot see traffic patterns across the provider’s network.

PBX controls

The PBX is the most common point of compromise, and the controls on it are entirely in your hands.

• Keep it patched. Apply security updates to the PBX software, operating system and any modules or add-ons. Remove modules you do not use.
• Remove default credentials. Change every default password on the PBX, its web interface and the handsets’ own admin pages before the system is connected to the internet.
• Use strong SIP secrets. Extension and trunk passwords should be long, random and unique. Never use the extension number, or anything derived from it, as the password.
• Restrict where extensions can register from. Where the PBX supports it, limit each extension to the networks it should connect from.
• Do not expose the admin interface. The web administration page should be reachable only from your internal network or over a VPN, never from the open internet.
• Disable unused services. Turn off protocols, transports and features you do not need, such as unused SIP ports, guest calling or remote access features.
• Lock down outbound permissions. Give each extension only the destinations it needs. International and premium-rate dialling should be enabled for named users, not for everyone.

Network controls

The network layer decides who can reach the PBX at all. Done properly, it removes most of the automated scanning traffic before it reaches the phone system.

• Firewall allow-list. Permit SIP signalling only from your provider’s published addresses and from known remote sites. Block SIP from all other sources.
• Automatic blocking. Use a tool that bans addresses after repeated failed registrations or authentication attempts, in the manner of fail2ban or the equivalent built into many PBXs and firewalls.
• Remote workers over VPN or an SBC. Rather than opening SIP to the internet for home and mobile users, connect them over a VPN or through a session border controller that authenticates and filters traffic.
• Review SIP ALG. Router SIP ALG features rarely add security and frequently break calls. Disable them unless there is a specific reason to keep them.

Changing the SIP port from 5060 to a non-standard port reduces log noise from casual scans but is not a security control on its own. Treat it as a convenience, not a substitute for an allow-list.

Trunk controls

Controls on the trunk itself limit what an attacker can do even if the PBX is compromised. They are applied by the provider, so ask which of them are available and how they are configured for your account.

• IP authentication. If your PBX has a static public IP, IP authentication means calls are accepted only from that address. Stolen credentials alone are not enough to use the trunk.
• Channel limits. A concurrent call limit close to your genuine peak caps how many fraudulent calls can run at once.
• Destination restrictions. Restrict outbound calling to the countries you actually call. Many organisations need only their home country and a handful of others.
• International and premium-rate blocking. Block premium-rate, satellite and other high-cost number ranges unless there is a business need.
• Spend and usage alerts. Where offered, set thresholds for daily spend, call volume or unusual destinations, with alerts sent to someone who will act on them out of hours.

Encryption

Standard SIP over UDP or TCP sends signalling and audio unencrypted. On a private network this may be acceptable; over the internet it means call details, and potentially audio, could be read by anyone able to intercept the traffic.

• TLS encrypts SIP signalling, usually on port 5061. It protects call setup details and any credentials exchanged during the call.
• SRTP encrypts the audio itself. It is normally used together with TLS, because the media keys are exchanged in the signalling.

Both require support on your PBX and on the provider’s side of the route, and certificate handling must be set up correctly. Use them where supported. Encryption protects confidentiality; it does not on its own prevent toll fraud, which depends on the access controls above.

User practices

Some of the routes into a phone system are features that users configure themselves.

• Voicemail PINs. Weak or default voicemail PINs can let an attacker change greetings, retrieve messages or, on some systems, use voicemail features to place outbound calls. Enforce PINs of a reasonable length and reject obvious ones such as the extension number or repeated digits.
• Call forwarding. If users can forward their extension to any external number, an attacker who gains access to an extension or a voicemail menu can forward it to an international number and then call it. Restrict forwarding to national or mobile numbers unless there is a clear need.
• Remote access features. Features that let a caller dial in and obtain a dial tone, often called DISA, should be disabled unless essential and, where used, protected with strong PINs.
• Leavers and unused extensions. Remove or disable extensions when staff leave, and do not leave unused extensions configured with simple passwords.

Monitoring and response

Controls reduce risk; monitoring shortens the time between a compromise and its discovery. Review call records regularly for calls to unexpected countries, calls outside business hours, unusually long calls and spikes in concurrent calls. Watch PBX logs for repeated failed registrations, which indicate that someone is trying.

Incident response checklist

If you suspect fraudulent calls, act in this order:

1. Contact your SIP provider immediately and ask them to suspend outbound calling or restrict destinations on the trunk.
2. Block outbound international calling on the PBX and, if necessary, disconnect the trunk.
3. Identify the source: which extension, trunk credential or feature placed the calls, and from which IP address.
4. Change all affected passwords and PINs, and any shared credentials, including the trunk password if registration is used.
5. Apply outstanding patches and close any exposed services before restoring outbound calling.
6. Preserve call records and logs for the period, and record what happened and what was changed.
7. Review the controls in this guide and agree with your provider which additional restrictions or alerts to put in place.

Write this checklist down before you need it, with the provider’s support contact and the name of the person authorised to request a suspension. During an incident, minutes matter.