Vishing, SPIT and other VoIP security threats

Your voice traffic is digital data, and it faces many of the same hazards other data does once it leaves your network. As VoIP has gone from a niche option to a mainstream business phone system, it has picked up a vocabulary of security threats.

The first mass produced automobiles rolled off the assembly lines in the early 1900s, but it took a couple of decades before door locks were regularly installed. Nobody had needed them.

VoIP went the same way. Security wasn't a concern when it was first introduced. Providers and customers worried about cost and reliability. Now that those two are nailed down and VoIP is mainstream, it's time to put some locks on it. These are the threats VoIP users can face.

Vishing

We're already used to phishing. Now there's vishing. The most common version of this is tampering with the caller ID. Someone could set themselves up to look like your bank or another trusted organization. With VoIP, a visher can potentially send one message to thousands of recipients at the same time, creating a virtual number that can disappear without leaving any trace.

It's not necessarily your VoIP system that's at risk. It's your users. Any type of phishing used in email can be duplicated over VoIP. Are you really sure it's your bank calling just because you see their name on the caller ID? Never give out sensitive information over the phone, VoIP or otherwise. For a closer look at traceability, see whether VoIP can be traced.

Service theft

VoIP services can be stolen with a valid set of credentials, and hackers try to obtain these by eavesdropping. Once they have credentials for your VoIP network, they can make calls without paying, but that's usually not why they bother eavesdropping. They're after confidential information that might be stored in voicemail.

SPIT

Move over spam. VoIP has its own version, called SPIT, short for Spamming over Internet Telephony. You have a voicemail, and it's spam. It's a growing problem for some organizations using VoIP.

Every VoIP account has an associated unique IP address. Once obtained, spammers could send messages to an improperly secured voicemail. They can send a single spam voicemail message to thousands of IP addresses at the same time. It's a nuisance, and it can become an expense too, since you need more space to store all that junk.

DDoS attacks

VoIP needs the internet. A hacker with an axe to grind might try to carry out a Distributed Denial of Service (DDoS) attack by flooding your VoIP network with unnecessary SIP call signaling messages. Your service would be degraded. Why would they do this? Why do websites suffer DDoS attacks? Sometimes somebody out there just doesn't like you.

How to keep your VoIP secure

This may sound scary, but strong security takes most of the sting out. VoIP security is only as reliable as the network that supports it. Your provider handles much of the protection, from gateway security and firewall configuration to wireless security and system logins. Keeping some of that information safe on your end is up to you.

Know the threats and how to guard against them. Your VoIP provider will do most of the heavy lifting, but your people still need to know what to look out for. For a deeper look at the protections that should sit underneath your phone service, see our guide on VoIP security measures that safeguard your conversations, and review the rest of our security and IT articles for more ways to stay ahead of attackers.

Security starts with the network. CallSprout runs a cloud business phone system on a 99.999% uptime network, so your calls stay up and your data stays protected even when someone is trying to disrupt them. Our AI Voice Agent answers, transcribes and routes calls for you, so fewer voicemails sit around as targets for spam, and you get a searchable record of every conversation.

You can read more about our network reliability or contact our team to talk through securing your phones.