2 of 4 | Next in series →
INTRODUCTION
The evolution of telecom exploitation
In 1971, phone phreaking was an analogue craft. A plastic whistle from a Cap’n Crunch cereal box emitting a precise 2600 Hz tone could trick AT&T’s multi-frequency (MF) switches into dropping trunk lines and granting access to operator modes for free long-distance calls. Today, as the UK reaches the final stages of the national PSTN switch-off led by Openreach, corporate telecom infrastructure has fully converged onto IP networks.
Yet, the core objective of the phreaker remains unchanged: manipulating call control signals for unauthorised access, toll abuse, or covert surveillance. Modern phreaking no longer relies on physical line taps, acoustic couplers, or acoustic DTMF tones. Instead, it targets Session Initiation Protocol (SIP) endpoints, Session Border Controllers (SBCs), unencrypted Real-time Transport Protocol (RTP) media streams, and cloud-hosted IP-PBX platforms.
Voice is no longer an isolated, circuit-switched media line; it is an open UDP/TCP service running on enterprise networks—and often left far less defended than traditional web applications or email gateways.
The modern VoIP attack surface
To exploit a contemporary Unified Communications (UC) environment, threat actors take advantage of the decoupling between signalling and media streams inherent to RFC 3261 (SIP).
[Attacker / Botnet] ---> (SIP INVITE / Brute Force: UDP 5060)
|
v
[Session Border Controller]
|
v
[Cloud / On-Prem IP-PBX]
|
+-----------+-----------+
| |
(IRSF Toll Fraud) (RTP Audio Eavesdrop)
| |
v v
[Premium Rate Destination] [Interception / Deepfake]
1. Automated SIP scanning & digest authentication exploitation
Automated botnets continuously sweep IPv4 blocks, scanning for default SIP signalling ports—predominantly UDP/TCP 5060 and TLS 5061. Attackers issue OPTIONS or REGISTER requests to map active extensions, software versions, and user agents (e.g., Asterisk, FreePBX, Cisco Unified Communications Manager).
Once an endpoint responds, automated tools run high-speed brute-force attacks against SIP Digest Authentication. Because many softphone deployments and remote SIP extensions rely on weak credentials without Multi-Factor Authentication (MFA), accounts are routinely compromised within hours of deployment.
2. International revenue share fraud (IRSF) & toll fraud
Toll fraud remains the primary financial engine of modern phreaking, causing billions in global losses annually. Once an attacker compromises a SIP extension or administrative API, they deploy automated dialling scripts targeting high-cost premium international number ranges—often located in small island nations or jurisdictions with high termination rates.
The Long-Weekend Attack Pattern: Attacks are routinely launched on Friday evenings or before UK bank holidays. Attackers flood the compromised trunk with hundreds of concurrent calls to premium numbers operated by accomplice shell companies. By the time network operations teams return on Tuesday morning, the organisation has racked up tens of thousands of pounds in unbudgeted carrier charges.
3. Media plane interception & RTP eavesdropping
While signalling (SIP) sets up the call, media transmission relies on the Real-time Transport Protocol (RTP) running on dynamic UDP ports. In misconfigured environments where Secure RTP (SRTP) is not enforced, attackers positioned on local network segments, compromised VPNs, or rogue switches can easily intercept clear-text RTP streams.
Using tools like Wireshark or dedicated VoIP sniffing frameworks, attackers decode raw audio payloads from G.711 or Opus codecs in real time. This yields:
- Direct interception of confidential corporate, legal, or financial discussions.
- Extraction of 2FA voice verification PINs delivered by banking systems.
- High-fidelity audio collection used to train AI voice-cloning models.
4. AI voice cloning & real-time deepfake injection
The cutting edge of VoIP phreaking pairs WebRTC pipelines with generative voice synthesis models. By ingesting public executive audio (earnings calls, conference calls, podcast appearances), attackers train low-latency synthetic voice models capable of conducting interactive phone conversations over active SIP calls. These synthetic agents call corporate finance departments or IT helpdesks directly, spoofing executive caller IDs to request urgent wire transfers or credential resets.
Technical threat matrix & hardening controls
| Attack Vector | Underlying Mechanism | Impact | Primary Engineering Control |
| SIP Registration Hijacking | Weak SIP Digest authentication on exposed UDP 5060 | Inbound call interception & outbound call spoofing | Enforce SIP over TLS (port 5061) with mutual certificate authentication (mTLS). |
| Toll Fraud / IRSF | Unrestricted outbound dial-plans on IP-PBX / SIP Trunk | Severe carrier billing exposure and financial loss | Hard destination rate-limiting, international call restrictions, & SBC fraud triggers. |
| RTP Media Eavesdropping | Cleartext RTP audio streams on dynamic UDP ranges | Eavesdropping & 2FA passcode extraction | Mandate Secure RTP (SRTP / DTLS-SRTP) across all endpoints and PBX interfaces. |
| SBC State Exhaustion / DoS | Malformed SIP headers flooding state tables | Telephony outage & voice service degradation | Deploy enterprise Session Border Controllers with deep packet inspection (DPI) & rate-limiting. |
| Vishing & CLI Spoofing | Manipulation of From: / P-Asserted-Identity headers | Executive impersonation & social engineering | Enforce STIR/SHAKEN caller ID validation & mandatory out-of-band call verification. |
Defensive engineering checklist
To secure modern voice infrastructure, network teams must apply zero-trust principles to communication architectures:
- Treat SIP as an Untrusted API: Abandon unencrypted UDP 5060. Require TLS for SIP signalling (SIPS) and enforce strong, unique secrets or OAuth 2.0 tokens for extension registration.
- Deploy and Enforce Session Border Controllers (SBCs): Position enterprise SBCs at the network edge to manage topology hiding, Back-to-Back User Agent (B2BUA) isolation, and automated rate-limiting against rogue INVITE bursts.
- Enforce Strict Outbound Dial-Plan Rules: Restrict international and premium-rate dialling by default. Apply call-per-minute limits per extension to mitigate automated IRSF scripts.
- Encrypt the Media Plane: Mandate SRTP across all internal softphones, hardware handsets, and trunk interfaces to ensure captured packets remain unusable to sniffers.
- Implement Real-Time Telephony SIEM Integration: Forward SIP, SBC, and IP-PBX syslog streams into central SOC monitoring. Set real-time alerts for high off-hours call volumes, rapid concurrent outbound calls, or repeated authentication failures.
Conclusion
Phone phreaking has evolved from a 1970s analogue subculture into an automated, multi-billion-pound cybercrime enterprise. In an era where corporate voice runs entirely over IP networks, telephony security can no longer be treated as an isolated infrastructure silo. Securing modern telephone systems requires applying the same rigorous defence-in-depth principles used for cloud APIs, web applications, and enterprise networks.
Continue the series
In the next article, we explore how compromised VoIP infrastructure can become a gateway into the wider enterprise network, looking at how attackers exploit provisioning files, Voice VLANs, dual-homed IP-PBXs and vulnerable management interfaces to gain initial access and move laterally through corporate systems.