Audience: Tegsoft partners and system administrators
Scope: All Tegsoft Contact Center and IP PBX installations
Overview
IP-based telephony systems offer stronger security features than traditional PBX systems. However, because they can be reached remotely, they are much easier targets for attackers. Most of the damage from an attack can be prevented by making sure an attacker has nothing to gain.
We strongly recommend that you review every customer system in your portfolio against the checklist below.
Any system connected to an IP network will be targeted at some point. Being targeted is not the problem; a successful attack is. Taking the necessary precautions is a shared responsibility of Tegsoft, our partners and our customers.
What is toll fraud? Attackers gain unauthorised access to a phone system and use it to place large numbers of calls, usually to premium-rate international numbers. The attacker profits from these calls, and the system owner is billed for them.
1. Keep the software up to date
Every Tegsoft system must run a version that Tegsoft released within the last three months. Current versions include the latest security fixes and firewall improvements.
2. Configure the firewall correctly
2.1 Always keep the Tegsoft firewall enabled
The firewall in the Tegsoft Server Settings must always be enabled (Active), whether or not the customer's network has its own firewall.
2.2 Define trusted IP addresses
If the system is used only on the local network, you can allow all private IP ranges by adding the following blocks to the trusted IP addresses. You don't need to ask the customer for their exact addresses:
IP block | Description |
|---|---|
| Private network range |
| Private network range |
| Private network range |
If the system communicates with external networks (remote agents, branch offices, SIP providers and so on), add only the specific external IP addresses or blocks that need access.
⚠️ Never do the following:
Add
0.0.0.0to the trusted IP addressesAdd
5060(the SIP port) to the allowed portsEither setting has the same effect as turning the firewall off and leaves the system open to attacks from the internet.
2.3 Check how the customer's firewall handles NAT
Some customer firewalls are not configured correctly. When the customer's firewall performs NAT, it must preserve the original external (source) IP address when it forwards traffic to the Tegsoft server.
If the firewall forwards external traffic using its own internal IP address instead, Tegsoft cannot tell whether the traffic comes from the internet or from the local network. Tegsoft's IP-based protection then stops working.
2.4 Check the firewall status over SSH
Connect to the server over SSH and run:
bash
[root@tegsoftsipserver ~]# service iptables status
Firewall is stopped.If the output says Firewall is stopped. even though the firewall is set to Active in Server Settings, the firewall is not actually running. In that case, update the system to the latest Tegsoft version, check again, and contact Tegsoft Support.
3. Passive security: the last line of defence
Attacks are usually carried out from professional infrastructure with gigabit internet connections. Call charges are the main cost of an attack, but the attack can also saturate the customer's internet connection and make it unusable. If the measures above are applied correctly, both bandwidth abuse and unauthorised call costs can be prevented.
Passive security measures keep the customer from facing high call charges even when a problem outside your control occurs.
3.1 Trunk-to-trunk calls are blocked by default
Attacks always aim to place calls through an extension. Tegsoft's routing system does not allow trunk-to-trunk calls (calls from one external connection to another) unless they are explicitly authorised. This means the system is protected by default, even if an attack comes through an external connection that is considered trusted.
3.2 Restrict extensions to specific IP blocks
You can restrict extensions so they only register from trusted networks. On the extension definition screen, under the Advanced section, replace the default dynamic value in the IP setting with the allowed network blocks.
Examples:
Value | Result |
|---|---|
| The extension can register only from the 192.168.1.0 network |
| The extension accepts traffic only from the 192.168.1.0 and 172.24.5.0 networks |
Requests from any other IP address are rejected. Even if an attacker reaches the system, they cannot use that extension to place calls.
3.3 Limit outbound call permissions
Blocking unnecessary outbound traffic prevents most problems:
An extension that has to register from outside the network should be allowed only internal calls, or at most domestic calls.
Attacks are almost always aimed at premium-rate international numbers. Don't grant international calling permission unless it is needed.
For international calls, define an outbound prefix that attack tools cannot guess, such as
9800, instead of the standard00. Automated attack tools try standard prefixes, so a non-standard prefix stops the attack from reaching its goal.
3.4 Additional recommendations
Use strong passwords: Give every extension a long, complex, unique password. Never use passwords that match the extension number or are easy to guess.
Disable unused extensions: Deactivate or delete extensions that are not in use.
Set a spending limit with the carrier: Ask the telecom provider to set a credit limit or international call restriction on the line.
Restrict calls outside business hours: Where possible, limit international and long-distance calls at night and on weekends.
Monitor call records regularly: Review Call Detail Recording (CDR) data for unusual call volumes, unexpected destinations and calls made outside business hours.
4. Use trusted applications
Free SIP softphone applications from unknown sources are often used to develop attack methods against target systems. The attackers are professionals who prepare carefully, so take precautions on every front. Use only trusted SIP endpoints and applications that the customer's IT team has approved.
5. Contractual protection
Despite all your warnings and precautions, a customer may create a security gap you could not have prevented. They may also meet a business need in a way that unknowingly exposes the system. To protect yourself and the Tegsoft brand, always sign a Sales Agreement with your customers. The agreement should set out:
Who is responsible for security configuration
Who is liable for costs caused by changes the customer makes
That the customer has been informed of the recommended security measures