# PBX Hacking

## Summary


PBX (Private Branch Exchange) is a private telephone network that handles an organization's internal and external communications. For external connections, the PBX connects to the Public Switched Telephone Network (PSTN) using a Telecommunication Service Provider (TSP) or an Internet Service Provider (ISP). 

Hackers target PBX networks in ways that can impact the company. Using the PBX, they might place long-distance calls for free, leaving the company to pay the bills. Hackers might steal data or simply render the network unusable. Such hackers who specialize in hacking phone systems are called *phreakers*. 

PBX hacking was traditionally done on analogue PBX systems using various methods. When IP PBX systems were introduced in the 1990s, hacking methods were adapted to these newer networks. There are many best practices that companies can follow to mitigate the dangers of PBX hacking.

## Discussion

### Why is it important to know about PBX Hacking and its role worldwide?

PBX is a system connecting the communication lines such as switches, hubs, telephone adapters and routers. There are different types of PBX Systems from which digital PBX or IP PBX/VoIP PBX is preferred in the business phone systems. 

According to the survey done by CFCA(Communications Fraud Control Association), around 2013-2017the cases of PBX and IP-PBX was the top five frauds that you can see in the table given in fig.1. In France, the PBX toll fraud losses in companies estimate $220 million a year. Even before 2013, PBX Hacking cases has been there since the switchboards introduction to the world.

Tom Mulhall, in his paper “Where have all the hacker gone”,1997, states that though it might look like hacking cases has deteriorated while they have migrated from computer hacks to PBX/Voicemail attack. 


### How does PBX Hacking affect the company or an organisation?

PBX Hacking/PBX Toll Fraud or PBX Fraud are some terms mentioned concerning phreakers cracking loopholes of the PBX System.

In different types of PBX Systems, some functions are the same like managing calls with also being connected with companies' systems that contain sensitive data(call records of customers). The system hacked through viruses or worms results not only the loss of sensitive data but an extra charge to fix the system. Also, there’s a possibility where the hacker can listen to phone conversations or voicemails or shut down PBX entirely. 

After hacking PBX, phreakers usually make free long-distance calls or run call-sell operations from phone booths or private phones which builds a mode to generate funds illegally. By offering the calls for less than the actual cost to dial directly, the result is the companies owning that PBXs end up paying the bill. 

It is also difficult to track these call-sellers as they hide their activities from law enforcement officials by PBX-looping(using one PBX to place calls out through another PBX). 


### What are the ways the PBX System can be hacked?

DISA and voice mail are classic ways for phreakers to penetrate the organisation PBX System. Also, DoS acts as one of severe attacks towards the PBX System. 

    + Brute force attack: It is a trial and error method until the password or log-in credentials or encryption keys.
    + DISA and Voice Mails: DISA(Direct Inward System Access) is a service provided by PBX where the user’s dials into PBX and then give information for authorisation to use PBX service dial local user. The authorisation process comprises the user’s account, user’s password and callerID. Fraudsters with tricks and hacks try to obtain this information and retrieve it, which then helps them to use PBX to generate outbound calls. While in the voicemail, fraudsters plan to reach voicemail boxes, obtain passwords and retrieve them to gain access to the system.
    + Denial of Service Attack(DoS): The denial of service attack makes telephony service unavailable by causing physical damage or software strategies and denying telephones to place or receive calls. It works by flooding networks with fake traffic or server request generated by machines compromised by viruses and malware.

### What are the other famous ways for the PBX System to be hacked?

    + Internal Enemy: One such example to comprehend the internal enemy is when the employee of that organisation forwards their work number to their private number either overseas or in their country, where for per call the organisation foot up the bill. In some instances, revenge (due to a poorly treated employee) becomes the cause for them to turn against the company.
    + Poor Port Management: A poorly protected port linked with PBX can offer hackers a chance to create a “back door” into critical assets such as customer databases and business applications. Also giving them a path to target modem.
    + Social Engineering: It is a technique where hackers just by impersonating or manipulating the person or the entire organisation get the sensitive data. One such example is Frank Abagnale, who is known as the infamous social engineer in history.

### How the ‘SIP’ has an impact on IP-PBX?

SIP(Session Initiation Protocol) is a protocol that initiates a session in an IP network while aiming to provide functions(similar to traditional PSTN) over the internet. It deals with signalling messages, address resolution, user management and packet transfer and services and is as vulnerable as HTTP or any available service which is public on the Internet. 

It can be easily hacked through DoS attacks where :

‘SIP Register Flooding’ attack happens to create traffic by sending streams of SIP REGISTER messages and ‘Call Flooding’ attack which is a way of forming traffic by sending streams of the SIP INVITE requests. These attacks make it difficult to get any legitimate calls.

SIP Injection attacks are also a way where phreaker exploit the SIP by injecting malicious code where Buffer Overflow attack, RTP(Real-Time Transport) Injection Attack and SQL Injection Invites are some examples.

Due to SIP not enforcing any SIP source message validation mechanisms, it creates an opportunity for the attackers to have their request processed without authentication, making a path for spoofing or modification of the SIP control messages.


### How to analyse whether we have become the victim of PBX Hacking?

There are some indications to notify the victim whether they have been hacked:

    + Overload occurring in the incoming and outgoing trunks.
    + Sudden change of call patterns mostly the increase in international calls.
    + Any kind of lengthy calls or calls to premium rate services during late-night hours or weekends and holidays.
    + Any strange messages left in the voicemail boxes.
    + Any signs of war dialing like short calls or wrong number calls or any sign of social engineering.
    + Any kind leakage found with respect to the business secrets and sensitive data indicating that the phone conversations are intercepted(hacker listened to the phone conversation).And lastly, webcams and microphones activate automatically in the case of VoIP systems. 


### What can we do to prevent them?

    + A regular audit must happen in the organisation to assess its vulnerability to fraudulent exploit.
    + In case of securing DISA, Call Detail Recording help in identifying call activity linked with individual authorisation codes, while also keeping limited print copies of these records.
    + Always change security codes regularly, and give access limit of the administration of authorisation codes to some carefully chosen employees of the company or organisation.
    + With help of control functions within the firewall control the traffic covering the subsystem, which will protect network resources and confidentiality of all traffics, also encrypting signal and media streams will increase the security level.
    + A strong Firewall to evaluate SIP message contents for attacks and block non-SIP traffic.
    + Regular maintenance and analysis of logs.
    + Give PBX users Security advice like never leaving phone-set unlocked, not sharing any type of security codes and regular change of security codes should be done and never having any kind of sensitive data in the phone’s memory.
    + Having strong passwords are always recommended.
    + Channels or services that are not in use should be disabled.
    + Further securing system VPN (in case of VoIP PBX) for remote access and enable endpoint filtering.

### What techniques or tools do PBX vendors use to mitigate hacking?

Some of the PBX vendors have already working on providing any network security in their systems such as Network firewalls, DDoS(Distributed Denial of Service) prevention, network posture assessments and encryption during data transfer, while at the time while purchasing they try to brief all the risk of hacking and the ways you can avoid it.

There are certain analyses to see whether the provider is doing their part such as checking for accreditations(certificates to show whether the industry meets the security standards) like TEC certification, and prevention measures in the system to prevent hacking, also whether the regular updates are available and are they up to date and also look for call encryption. 

## Milestones

1878

At a time when telephone calls are routed via **manual switchboards**, two switchboard operators of the Bell Telephone Company intentionally disconnect or misdirect calls. Historically, this is probably the first attempt at hacking telephone networks. Hackers in these early days are simply practical jokers who don't cause serious damage. These operator hacks disappear once switchboards get automated in the 1890s via electro-mechanical switching. 

Nov  
1963

MIT's student newspaper, *The Tech*, features an article titled *Telephone Hackers Active*. It describes how student hackers are occupying tie-lines between MIT and Harvard, or making long-distance calls for free. A PDP-1 computer searches for outside lines by listening for a dial tone. Some students are even expelled for this. Subsequently, the MIT phone system is updated to prevent calls over tie-lines. 

1968

In the U.S., a community of phone hackers begins to take shape during 1968-1969. About this time, the term **phone freak** comes into use. By the end of the decade, whistles and flutes are readily available to aid hackers. For instance, since the mid-1960s, Cap'n Crunch whistle that came with a box of cereals was used by hackers. It emitted 2,600 Hz, a useful tone for hacking. Years later, phone companies install digital filters to block this and other specific tones. 

1971

In June, a newsletter of the Youth International Party Line, uses the word **phreek** in its first issue. In October, an Esquire article titled *Secrets of the Little Blue Box* uses the term **phreak** in what may be the first published use of the term. The article describes how toll-free 800 numbers and a tone at 2,600 Hz could be used to occupy tandem lines and place long-distance calls for free. 

1972

**Semiconductors** are used in PBX equipment and switching. Through the 1970s, dropping cost of hardware and lower operational expenses make PBX attractive. More and more companies install PBX systems.  This also implies more opportunities for phreakers.

Apr  
1992

For greater awareness, the NIST publishes **NISTIR 4816**, *PBX Administrator’s Security Standards*. This discusses the different techniques that PBX hackers use and what PBX administrators can do to mitigate them. These include setting passwords, educating users, protecting voicemails, monitoring PBX options, reviewing billing records and limiting outgoing international calls. A related publication from 2001 is **NIST 800-24**, *PBX Vulnerability Analysis*. 

1993

In the U.K., the National Computing Centre includes in its regular survey report a new item name "PBX hacking" that has cost organizations £10,000. Although computer hacking dropped from 29.7% (1987) to 8.8% (1993), it's clear that hackers have simply moved to hacking PBX and voicemail systems. This is the result of traditional PBX systems giving way to **IP PBX systems**.

Nov  
2011

Four hackers in the Philippines are arrested for PBX hacking funded by a terrorist organization. The phreakers used PBX systems to call Premium Rate Service (PRS) numbers. The revenue from this was split between the phreakers and the terrorists. One of the phreakers had previously hacked PBX systems by exploiting default passwords and unused extensions. He and his associates then offered long-distance call services to customers at low rates, placing calls worth $55 million during 2005-2008. 

Dec  
2014

A Pakistani national named Qasmani is arrested for scamming American telecom companies to the loss of $19.6 million during 2008-2012. Qasmani has been an active phreaker since the late 1990s. He and his associates exploited unused extensions of PBX systems and placed calls to pay-per-minute PRS numbers that they had set up. In June 2017, he's sentenced to four years in prison. 

2019

A survey of Communications Service Providers (CSPs) by the Communications Fraud Control Association reveals that the estimated global loss in 2019 due to communications fraud is $28.3 billion. Of this, PBX hacking and IP PBX hacking account for $1.82 billion each.