Risks to VoIP phone systems
VoIP uses an open IP network for transmission. This means that voice communications share data streams with emails and websites.
- The greatest threat arises when a third party gains access to one of the components involved. If they succeed, many harmful scenarios are possible. Making calls at someone else’s expense, eavesdropping on calls, extracting call data, or accessing phone books.
- Attacks known as "Man in the middle" also pose a major risk. The attacker positions themselves unnoticed between the two parties communicating and has full control over the data traffic. They can view information and may even impersonate someone else.
- Harm can also occur indirectly. Recorded calls can later be used to generate entire dialogues, which can then be used, for example, to purchase goods through electronic ordering systems.
How to protect your VoIP system
- Watch for early warning signs
- If you have trouble retrieving voicemail messages or the line suddenly seems to be busy, don't ignore it. It's best to have a technician look into it and rule out misuse.
- Another possible warning sign of hacking attempts is when extensions ring repeatedly and briefly.
- It's also a good idea to review your system logs regularly. Many unusually short calls or many calls to premium-rate services may, but do not necessarily, result from tampering.
- Set unique passwords and PINs
After the system has been put into operation, all default passwords should be replaced with unique passwords. Avoid PINs that resemble an extension number or simple codes such as "12345". It is best to change mailbox passwords regularly. - Restrict access to system administration
This applies to businesses and, in principle, just as much at home. As few people as possible should have direct access to the telephone system. This includes both physical access and access to internal functions. The telephone system belongs in a lockable room. In businesses, only especially trustworthy and trained employees should be allowed to access functions for setting up the system or maintaining user data. At home, setting an administrator password helps. - Disable unused voicemail boxes
It is best to disable any VoiceMail boxes that are not assigned to a user or extension in your phone system. For businesses, this also means deleting an employee's voicemail box when they leave the company. - Turn off unnecessary features
Have any features you do not need turned off, or disable them yourself. This includes, for example, the feature included in many phone systems that lets you sign in from other locations. Features that allow remote access to the phone system or its core functions can also pose a security risk. - Use number lists
As with smartphones, you can limit potential damage by blocking the phone numbers or area codes of premium-rate services. Telephone systems generally let you create both allowlists and blocklists. A blocklist blocks only the numbers added to it. All other parties can be reached. Allowlists reject all phone numbers that are not on the list. - Turn off confirmation tones
If your system supports it, turn off the tones that confirm each keypress when you enter your PIN. If a Hacker records these tones, they can gain access to the voicemail relatively easily. - Install patches
The more up-to-date, the better. Install patches and updates provided by the manufacturer as soon as the manufacturer makes them available. This usually closes potential security vulnerabilities. - Secure the entire network
In businesses, the VoIP system is part of the corporate network. The entire network needs protection. This includes a properly configured firewall that works correctly with VoIP data. For tips at home, see the WLAN chapter.
