Sipera Systems reports that VoIP toll fraud continues to escalate, based on evidence uncovered in numerous VoIP and UC architectures. Across dozens of security architecture reviews and solution deployments, Sipera's security experts have discovered numerous cases of vulnerabilities commonly exploited for toll fraud, including confirmed fraud resulting in losses ranging from a few thousand dollars to hundreds of thousands of dollars.

The vulnerabilities affect both enterprises and service providers, and they stem from widespread gaps in insufficient VoIP and UC security architectures. Toll fraud occurs when unauthorized users, often external to the service provider or enterprise, exploit vulnerabilities to make toll calls to domestic or international locations. The unsuspecting enterprise or service provider is subsequently hit with extraordinarily high toll charges or call termination charges that have no clear cause.

The primary security architecture shortcomings leading to toll fraud include:

• Telecom Connectivity Vulnerabilities: Many enterprises have moved to SIP trunking for low-cost telecommunications connectivity. Unfortunately, these enterprises often rely on Session Border Controllers for security of real-time VoIP and UC traffic, making them highly vulnerable to toll fraud. In production security architecture analysis, Sipera has identified nine common configuration errors, vulnerabilities and functional limitations that leave enterprises using SBCs for VoIP security exposed to toll fraud risk.
• Application-Level Vulnerabilities: In many cases, application servers, voicemail systems, and other communication systems can be easily exploited by fraudsters because of weak passwords and authentication schemes. Furthermore, security policy enforcement mechanisms in such systems are often inadequate to stop fraudsters from using them to gain access to toll calling facilities.
• End-Point Vulnerabilities: Weak security on user devices and inadequate authentication schemes enable fraudsters to exploit these devices to pose as authorized users and gain access to toll calling facilities.

Along with partners like Vigilar, Sipera Systems and Sipera's VIPER Lab security research and consulting arm offer these solutions to customers seeking to improve their defenses against toll fraud:

• Security assessments: Sipera's VIPER Lab offers the industry's most advanced VoIP and UC security architecture consulting services, including VoIP penetration testing and comprehensive UC vulnerability assessments.
• Seamlessly integrated security appliances: Sipera's award-winning UC-Sec security appliances are the industry's only purpose-built, comprehensive security solutions designed for real-time VoIP and UC traffic. Used in dozens of deployments worldwide, UC-Sec prevents toll fraud in VoIP and UC via policy enforcement, access control, threat mitigation and encryption. UC-Sec fits flexibly into any security architecture to complement and enhance an enterprise's security posture.