Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies

guest · Nov 5, 2020

Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies
November 5, 2020
https://thehackernews.com/2020/11/premium-rate-phone-fraudsters-hack-voip.html

Cybersecurity researchers today took the wraps off an on-going cyber fraud operation led by hackers in Gaza, West Bank, and Egypt to compromise VoIP servers of more than 1,200 organizations across 60 countries over the past 12 months.

According to findings published by Check Point Research, the threat actors — believed to be located in the Palestinian Gaza Strip — have targeted Sangoma PBX, an open-sourced user interface that's used to manage and control Asterisk VoIP phone systems, particularly the Session Initiation Protocol (SIP) servers.

"Hacking SIP servers and gaining control allows hackers to abuse them in several ways," the cybersecurity firm noted in its analysis. "One of the more complex and interesting ways is abusing the servers to make outgoing phone calls, which are also used to generate profits. Making calls is a legitimate feature, therefore it's hard to detect when a server has been exploited."
Click to expand...

Check Point's research found that the attack exploits CVE-2019-19006 (CVSS score 9.8), a critical vulnerability impacting the administrator web interface of FreePBX and PBXact, potentially allowing unauthorized users to gain admin access to the system by sending specially crafted packets to the affected server.
Click to expand...

Check Point Research: Who’s Calling? Gaza and West-Bank Hackers Exploit and Monetize Corporate VoIP Phone System Vulnerability Internationally

Hackers have targeted Sangoma and Asterisk VoIP phone systems at nearly 1,200 organizations worldwide in past 12 months

Main purpose of hacking campaign is to sell phone numbers, call plans, and live access to compromised VoIP services.

Losses from global telecoms fraud exceed 28 Billion USD, according to CFCA (Communications fraud control association), with VoIP PBX hacking being one of the top 5 fraud methods used.

Asterisk is one of the most popular VoIP PBX systems, used by many Fortune 500 companies for their telecommunications.

Click to expand...

guest · Nov 5, 2020

Full Research:
INJ3CTOR3 Operation – Leveraging Asterisk Servers for Monetization

Recently, Check Point Research encountered a series of worldwide attacks relevant to VoIP, specifically to Session initiation Protocol (SIP) servers. Based on information provided by our global sensors, there appears to be a systematic exploitation pattern of SIP servers from different manufactures. Further exploration revealed that this is part of a large, profitable business model run by hackers.

During the first half of 2020, we observed numerous attack attempts on sensors worldwide. We exposed the attacker’s entire attack flow, from the initial exploitation of CVE-2019-19006 to uploading encoded PHP files that leverage the compromised system.
In this article, we first examine the infection vector used by the attacker, as well as the vulnerability exploited. We then investigate the threat actors behind the specific campaign. Lastly, we explain their modus operandi.
Click to expand...

Log in or Sign up

Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies

guest Guest

guest Guest

Log in or Sign up

Premium-Rate Phone Fraudsters Hack VoIP Servers of 1200 Companies

guest Guest

guest Guest

Useful Searches