So I've finally been to AstriCon and I noticed a great increased interest amongst the attendees with regards to security, fraud and "hacking". The slides for my presentation titled "Just how vulnerable is your phone system" can be downloaded from this location.
So what are the changes and additions from the software developer's side?
- Asterisk 1.8 has been released touting TLS support for SIP and SRTP support too, plus a framework to make auditing easier
- 3CX have released a major security update with features to make it easier to set proper passwords
- I just received an email from Brekeke highlighting their security page on their wiki which was originally published on March 11, 2009
Plus the advise I heard again and again from developers for FreePBX-based systems was:
"Do not put your FreePBX / configuration available on the Internet, it is not designed for that!"
But if you do a simple scan for Asterisk boxes (using svmap.py for example), you'll notice many systems out there that do not heed this advice. Apart from that, as Blake Cornell showed in his presentation, there are many attacks on FreePBX-based systems that can be abused without direct access to the HTTP configuration interface.