VoIP security best practices: what actually gets exploited

Voice systems get attacked for one simple reason: calls cost money, so a compromised trunk converts directly into cash for the attacker. The attacks are not exotic. The same three categories account for most real-world losses, and all three have straightforward defences.

1. Toll fraud

• Set destination allow-lists: most businesses never legitimately call high-risk premium routes.
• Cap spend per trunk per day, and alert well before the cap.
• Watch for velocity anomalies: hundreds of short calls to one destination at 3 a.m. is never organic traffic.

2. Registration attacks

• Long random SIP credentials, unique per device. Extension 100 with password 100 still exists in the wild.
• Rate-limit and geo-fence registration attempts; fail2ban-style blocking stops the background scanning noise.
• Prefer IP-authenticated trunks for fixed infrastructure, and TLS for everything that roams.

3. Unencrypted signalling and media

Plain UDP SIP and RTP can be read by anyone on the path. TLS for signalling and SRTP for media are supported by effectively every modern PBX and phone, and the performance cost is negligible. If a vendor tells you encryption is an enterprise add-on, that is a vendor signal, not a technical one.

The boring fundamentals

Patch your PBX like the internet-facing server it is, keep management interfaces off the public internet, and review call logs monthly. Most incidents in post-mortems were visible in the logs for weeks first.