Your PBX has been hacked

>They are operating from overseas and can’t be traced.

Not to ad-hominem, by this guy doesn't know what he's talking about. (I've seen his posts before.)

The real problem is that no one cares to push any investigations. I've had many many cases of customers sending "illegal" calls through my network. It's not my customers, it's someone down the line. I'm not going to do anything without a warrant. And when an upstream vendor gets a complaint, you know what they ask for, every single time? "Please block this traffic."

I've even written back and told them, hey, if this is oh-so-serious, please have your customer follow up. Have them get a subpoena, court order, etc. They never do. No one cares.

Even with fake IRS calls, the "investigator" wouldn't bother doing the paperwork. The FCC doesn't seem to care either (look at their moronic anti robo dialing contest). The FCC has teeth, they're just very selectively deployed.

Oh, you can't go back to knowing who is allowed to send what number. Things are too mixed up, and it'd break many services. Including many uses of 9-1-1. It's far more difficult than, for instance, preventing spoofed IP source addresses.

If the FCC really wanted to fix it, they just need to do so. Start fining and being aggressive. Actually go after things, hunt the money down.

Finally, if you're relying on caller ID as anything other than a weak hint of authentication, you're doing it wrong, full stop.

CDRs are kept for quite a while, so it's possible/easy to track these calls down. There are a bunch of intermediaries (I ran one), and each time you need to get them to release customer information. The FCC doesn't care enough; no one investigates.

Maybe with dedicated fiber links that carry no other traffic, sure. But the vast, vast majority of voip routes tend not to measure up to their circuit switched counterparts. Why do you think things like T.38 and RFC-2833 exist?

Voip security seems to be non-existant in practice. I recently spent some time in popular Voip forums because of a planned roll-out here and heard a lot of concerning things. It seems no one has any idea how firewalls work (Voip needs both TCP and UDP) and they just leave listening ports open to the world, instead of locking them down to their SIP trunk provider. Asterisk, and others, by default handle anonymous calls so anyone able top contact the voip port on your server can ring phones. Voicemail and automated attendant hacks are everywhere. The laziness of the community to handle these is frightening, not to mention none of this stuff was built with a security-first mindset, so every fix is just plugging another hole. There will always be more holes in Asterisk based systems.

Every PBX is just a copy of the old school analog PBX systems, so everything is ugly and a configuration nightmare. I'm not even sure if its even possible to secure these things. PBX's have all the liabilities of the POTS system and a TCP/IP system. Obscure dial presses and IVR hackers are everywhere. No one really understands this stuff and making sure an attacker can't break out of the IVR is actually fairly difficult as these things are designed to do their best to route calls and there are so many ways to do that.

The most popular PBX is FreePBX which runs on a dated CentOS distro where using yum to update breaks things, so everyone waits for a shell script released by Schmooze to do package updates. Of course, they will not be as fast as the distro mirrors so you have to wait for your managed updated while the hackers are loose with exploits for your platform. Then hope to Alexander Grahame Bell that the script doesn't break the Jenga-like system that is Asterisk-based PBX's. Spoiler: they usually do.

Encryption is borderline non-existant as anything that can interfere with the precious jitter and latency limitations of voip is disregarded, so everything is plain-text and open to trivial sniffing. No IPS/IDS out of the box. No botnet filtering out of the box. No captchas on logins for users. No SELinux. No modsecurity. No OSSEC. No nothing really, these distos are not made by people who grok security. They seem to be made by ex-big iron phone cowboys who came from managed Cisco and Avaya environs and think linux is a magical unhackable black box. Spoiler: it isnt.

I was going to write a security guide for the FreePBX distro but gave up when any little change broke something. Other than seriously firewalling these things off behind something that can run IPS/IDS and having Voip on its own vlan with nothing else, there's not much you can do. They're really delicate and easy to hack.

Lastly, in regards to the article, there is zero proof that all these scammers are all using stolen voip servers. They probably are in some cases, but its trivial to sign up with an international provider and make calls from Mumbai to the USA for pennies per minute. The tolls are trivial compared to what you can get just out of one person scammed. Most hacked boxes seem to be lone hackers getting free long distance or small operators reselling that long distance to shady-market buyers using bitcoin.

Not that I have any love for Asterisk, but modern versions can handle that load. As can FreeSWITCH despite its... interesting... threading model, as can OpenSIPS. On top of that, who cares what a single process can run? It's better to run one per core anyways. I had several servers, each running several FS instances and scaling wasn't really an issue.

I even ran a 5 nines 9-1-1 service off Asterisk, as embarrassing as that is. We missed one call in 18 months during a hard maintenance cutover, but handled it manually, but of course it was only one part and relied on the rest of the PSTN.

With a SIP proxy in an HA setup, almost surely the biggest downtime is going to be operator error or IP connectivity issues. Or someone changing their signalling subtly, but OTOH 5ESS and DMS aren't totally identical in behavior either.

(Though fair enough, the "software" guys haven't shown the same uptimes, overall, as the old style switching, true.)