Specific advice for preventing “attacks” and fraud incidents on business telephone exchanges.
In order to prevent telecommunications fraud carried out against business telephone exchanges through “attacks” that exploit potential security gaps, the Cybercrime Subdivision recommends the following:
With regard to security gaps in telephone exchanges, the following measures are proposed:
- Disable the pre-installed access codes on the PBX maintenance ports.
- Have the access codes on the PBX maintenance ports changed periodically by certified engineers.
- Choose passwords of at least 7 characters combining letters, digits and symbols.
- Every device must have its own independent password, rather than sharing one across extensions.
- Install and enable logging of incoming and outgoing calls (CDR logging software).
- If the PBX does not need internet access, disable it. If the exchange does need internet access, the use of firewalls is advisable.
- Where deemed necessary, it is advisable to restrict the source IPs that can access the exchange’s open ports.
- In the case of an IP PBX, allow access only from clearly predefined terminals.
- Manage authorised codes correctly in order to block outgoing calls.
- Configure the equipment so that no connection to external networks, call forwarding and the like is permitted, other than those identified as absolutely necessary for the operation of each user’s services.
- Disable the ability to programme call forwarding to numbers abroad.
- Create groups on the telephone exchange with specific capabilities according to each need.
- Disable “allow guest” in the SIP configuration.
- Enable remote access only when it is considered necessary; otherwise keep it disabled.
- Inform users about potential risks.
- As regards the installation of telephone exchanges, secure access to the communications room is important, for example:
- Installing a security door.
- Issuing access keys only to authorised personnel involved in the maintenance of the equipment.
- Keeping entry and exit logs for the room.
- As regards the services provided by carriers:
Carriers allow their customers, on request, to block call forwarding to destinations abroad. - Carriers check at regular intervals the daily unbilled traffic of the current month generated by each telephone exchange, so that unusually high charges are detected in good time and customers are then informed.
- In the event of fraud, the carrier allows the customer to activate a temporary or permanent block on outgoing calls to the specific destinations to which the disputed calls were found to have been made.