NetworkTigers discusses voice network attacks.
Voice network attacks are a growing threat to organizations large and small as hackers continue to adapt to a changing cyber landscape.
When most people hear the term “cybersecurity,” they think of cyber gangs, viruses used to hack into networks and criminals poring over lines of code in search of vulnerabilities or espionage opportunities.
While much of this may be accurate, methods of acquiring unauthorized access to targeted networks frequently involve a social engineering component that allows criminals to bypass much of the technical aspects of hacking. These tactics cause unwitting individuals to provide login credentials or other sensitive data to criminals, either by accident or after being tricked into doing so.
A voice network, or voice-over-internet-protocol (VoIP) attack, is the term used when a social engineering scam involves a phone call or when a cyberattack is levied against an internet-based phone network.
Common voice network attack types
With the Internet of Things (IoT) putting everything online, systems that were previously immune to hacking are now fair game. Voice networks are critical lines of communication, but they’re often overlooked with regard to cybersecurity. The following threats should be front of mind when it comes to considering the security of your voice network:
Vishing
Vishing is a term used to describe a phishing attack that is carried out over a voice call. These types of attacks may present as a trusted or local number through caller ID spoofing. However, they are carried out by criminals looking to pry login credentials from unsuspecting victims or lead them to download malicious code that can be used to stage more serious attacks against an organization’s infrastructure.
Criminals tend to target lower-level employees that they know are overworked or stressed out. Workers with high call volumes, such as those in customer service, are prime targets for hackers who impersonate higher-ups or manipulate the employee into giving access to data that they have no business viewing.
This type of social engineering is becoming a favored tactic among hackers. It is nearly impossible to protect against. No amount of firewalls, antivirus software or spam blockers can prevent a human employee from handing over valuable data.
Eavesdropping
A voice network that is compromised can be used to eavesdrop on conversations both internally and with external customers or contractors. In this way, criminals can gain information about the hacked company and anyone they converse with. The data gathered by hackers can be used for network penetration and blackmail. They may even sell it to a competing company.
Use of your number
If criminals gain access to your VOiP, they can use it to make robocalls and other fraudulent calls using your company’s phone number. This can be detrimental to businesses’ reputations, if they are associated with junk phone calls. More critical, however, is the fact that hackers can use a company’s phone number to impersonate them.
Combined with eavesdropping, this can lead to advanced social engineering maneuvers in which a hacker impersonates a company or person through caller ID, armed with proprietary knowledge. This can create a scenario in which a target has little reason to doubt the validity of the person they are speaking to and feels comfortable providing them with whatever information they ask for.
Toll fraud
When hackers make long-distance calls to other devices or phones through a hacked VOiP it is referred to as “toll fraud.”
Voice network attacks involving toll fraud are very common. According to a 2018 report from Trend Micro, toll fraud costs companies $27 billion. The actual figure is likely higher as not all transactions are reported. In the same report, the Communications Fraud Control Association (CFCA) indicates that some telecom carriers felt that up to 18% of their revenue may be due to traffic created by criminals.
DDoS attacks
Voice network attacks often come in the form of denial-of-service (DDoS) attacks. These attacks flood a targeted website or system with junk traffic that is usually produced by a botnet (a network of hijacked computers). The traffic exceeds the systems’ capabilities and paralyzes them.
This paralysis can be devastating for businesses. Attacks of this nature may also prevent access to emergency services and thus create a potentially life-threatening scenario.
DDoS attacks may be levied by disgruntled workers, hacktivists intending to send a political message or criminals planning to extort their victim by promising to end the attack once a ransom is paid.
How to protect against a voice network attack
Voice network attacks are common and effective. Thankfully, most of what you can do to protect yourself from one falls in line with standard cybersecurity best practices.
- Use a firewall. A properly configured firewall regulates and tracks the incoming and outgoing traffic on your VoIP. It can prevent spamming and stop malware from being injected.
- Password hygiene. Use passwords that are impossible to guess and at least 12 characters long. Because hacks often have far-reaching effects, change your password regularly in case it may have been exposed in a breach.
- Monitor your network. A network monitoring service can alert you to suspicious activity. For example, many hackers work on nights and weekends when they assume that fewer eyes will be on them. Automated network monitoring prevents these blind spots and keeps hackers from using a voice network attack to make calls or otherwise abuse when you aren’t there to stop them.
- Employee training. As cybersecurity has become more robust, criminals secure access information and login credentials via social engineering. The most secure network is only as strong as its weakest link. That link is usually a person who does not know that they are being manipulated or scammed. Employee training is imperative. Employees at all levels need to know how to spot a vishing scheme and protocols need to be in place in the event of an attempted attack.
