Voice Security

Attackers gain access to a VoIP platform — through credential theft, SIP brute force, or PBX compromise — and generate large volumes of calls to premium-rate or international numbers they control or profit from. The terminating operator pays the attacker a revenue share before the fraud is detected, often days later. IRSF is one of the largest fraud categories in telecom by volume, with average attack durations measured in hours and losses measured in tens of thousands of dollars.

SIP INVITE messages carry the CLI (Calling Line Identification) in the From and P-Asserted-Identity headers. Without strict validation at the originating carrier, any number can be presented. Attackers spoof bank numbers, government agencies, and emergency services to conduct social engineering at scale. The lack of a universal cryptographic CLI authentication standard makes this a persistent, widespread problem.

In deployments where SRTP is not enforced end-to-end, the media stream (RTP) is transmitted in cleartext. Any network element with access to the transport path — a compromised router, a malicious employee at a transit carrier, or a positioned attacker — can capture and reconstruct voice calls. This is particularly relevant on SIP trunks between enterprises and operators, where SRTP negotiation is often omitted for compatibility reasons.

IMS core elements (P-CSCF, S-CSCF, I-CSCF) expose SIP stacks that are subject to well-known vulnerabilities: SIP REGISTER flooding, malformed header injection, authentication bypass via expired nonces, and registration hijacking. SIP's verbosity and flexibility make it difficult to defend with simple firewalls, and many operator deployments lag several years behind in patch cycles.