Spam calls to your PBX A fraudster has discovered a free number that lands on your PBX. Unfortunately, the IVR is often poorly built (misconfigured) and doesn’t end the call after 3 failed attempts.  Fraudsters do this to map your PBX and discover applications like DISA, callback, voicemail callback, etc., that they can later exploit to interconnect calls to premium destinations.  Prevention tip: Mitigate spam calls to your PBX by… Building intelligent IVRs that terminate outsiders’ failed attempts into essential applications.  Creating strong passwords for your voicemail user accounts. Checking your CDRs to identify correlations from source PBX numbers. Blocking all source numbers from identified spammers.  2. Spam calls to your team member Fraudsters do this to identify the working hours of your company and staff so they can exploit vulnerabilities or attack your PBX without the supervision or observance of anyone on your work team.  Prevention tip: It’s important to provide consistent internal security awareness training to educate your staff on what to look out for and report suspicious activity.  Oftentimes the fraudsters use social engineering attacks (vishing) to manipulate employees to divulge information. The phisher makes phone calls to the user and asks the user to dial a number. This is to bypass a call, gain privileged access to another application or make a bigger attack elsewhere.  3. Spam calls directly to your devices Fraudsters can recognize that you use a device already out of its useful life, or with old firmware (software) with some vulnerabilities. They recognize this equipment through Open Source intelligence search engines like Shodan.  Once the target country and device version are searched, the attacker can identify from which IP address you’re connected to. Their next action would be to send you the spam (test calls) to try to exploit your device, bypassing calls to premium destinations.  Prevention tip: You can easily reduce or avoid spam calls to your devices by… Removing EOL devices from your network. The lifespan of most devices on the market is set to 5 years.  Keep a strict watch on the communications from your hardware providers. (i.e. security and productivity improvements and bug-fix announcements) Use a personal password on your device. Never use factory default settings and change your passwords every 6 months.  Separate your telephony network from the data network.