A VICIdial server is a telephony system on the public internet with the ability to place calls that cost money. That combination attracts automated attacks continuously, and the scanning starts within hours of the server being reachable, not weeks later.
The threat that matters is not someone reading your leads. It is toll fraud: an attacker using your system to place calls to expensive destinations, usually overnight or across a weekend, and running up a bill that your carrier will still expect you to pay.
How the attacks actually work
The common patterns are unglamorous and effective:
- SIP registration brute force. Automated attempts against extension numbers with weak or predictable secrets. Extensions named after their number with a matching password are the classic gift.
- Administration interfaces exposed to the internet. A login page reachable from anywhere gets attacked from everywhere, and default or reused credentials turn that into a compromise.
- Old software. Known vulnerabilities in unpatched components, found by scanners that do nothing else all day.
- Over-permissive dial plans. Routes that allow calls to any destination, so a single compromised extension can reach the most expensive numbers on earth.
None of this requires a sophisticated attacker. It requires an unhardened server, which describes most default installs.
The controls, in order of value
1. Cap the damage at the carrier
This is the control most people skip and the one that saves the most money. Ask your carrier for a spend limit, a concurrency limit and a restriction on destinations you do not call. Most will do it.
Everything else reduces the probability of a compromise. A carrier limit decides what a compromise costs. Only one of those is guaranteed to help you on the night it happens.
If you never call premium or high-cost international destinations, having them blocked upstream means that even a total compromise of your server produces a small bill rather than a catastrophic one.
2. Restrict who can reach the administration interface
The admin interface has no business being open to the whole internet. Restrict it to your office addresses, or put it behind a VPN. This single change removes an entire category of attack, and it costs nothing.
3. Strong, unique secrets per extension
Long, random, different per extension, and never matching the extension number. Registration brute force works because this is so often ignored, and the fix is entirely within your control.
4. Rate limiting and automatic banning
Repeated failed attempts should result in the source being blocked automatically. This will not stop a determined targeted attack, but the overwhelming majority of what hits your server is automated and gives up when blocked.
5. Restrict destinations in the dial plan
Your outbound routes should permit the countries and number ranges you actually call and nothing else. Defence in depth: even if an extension is compromised, the damage is bounded by what the dial plan allows before the carrier limit is even reached.
6. Patch, and know what you are running
Unpatched telephony software on the public internet has a shelf life. This includes the operating system, the web stack and the database, not just Asterisk and VICIdial. If nobody can tell you when the server was last updated, that is your answer.
Detection, because prevention is not enough
Toll fraud is usually run outside working hours precisely so that nobody sees it in progress. By the time someone notices on Monday, the calls have been made and the money is gone. Detection therefore matters as much as prevention:
- Alert on outbound call volume outside your normal hours
- Alert on calls to destinations you do not normally call
- Alert on concurrent channel usage exceeding your normal peak
- Review failed registration attempts periodically, since a spike often precedes a successful attempt
- Ask your carrier what fraud monitoring they offer, because many have it and will not enable it unless asked
An alert that wakes someone at 2am is unpleasant. Discovering an unexpected five-figure bill on Monday is considerably worse.
Do not forget the data side
Toll fraud is the expensive risk, but your dialer also holds a great deal of personal data: contact details, call recordings, dispositions and notes. That carries obligations under whichever data protection regime applies to you, and recordings are particularly sensitive because people say things on calls that were never entered on a form.
The practical work is the same regardless of regime: know what you hold and where, limit who can reach it, delete it on a defined schedule rather than keeping it forever, encrypt backups, and keep logs good enough to establish what happened if something goes wrong.
The uncomfortable question
If your dialer was compromised tonight, how much could be spent before anyone noticed, and how would you find out? For most installs the honest answers are "an unbounded amount" and "the carrier would tell us". Fixing the first is a phone call to your carrier and an afternoon of configuration, which makes it the best-value security work available to you.
We harden VICIdial installs as part of building and operating them, and we are called in after incidents as well as before. See call centre setup, or book a free consultation for a straight assessment of what your current install is exposed to.