SIP trunk flooding, SBC hardening, WebRTC leakage, Vishing botnets.
On 29 December 2008 at 25C3, Erik Tews, Ralf-Philipp Weinmann and Andreas Schuler of the deDECTed.org project showed that the secret security of DECT, the standard behind most cordless phones and many baby monitors and payment terminals, could be broken with cheap hardware.
Through 2009–2010, automated scanners swept the internet for SIP on UDP port 5060 and brute-forced extension credentials on exposed Asterisk and FreePBX systems; the SANS Internet Storm Center flagged the surge in July 2010, and in February 2011 the Sality botnet ran an internet-wide "sipscan" from about 3 million hosts. Compromised PBXs were used to pump calls to high-cost international and premium-rate numbers.
Daniel Roesler's 2015 proof-of-concept showed that the WebRTC JavaScript APIs in Chrome and Firefox let any web page collect a user's private LAN addresses and real public IP — even behind an active VPN. The behaviour had already been tracked by Mozilla as Bugzilla 959893 ("WebRTC Internal IP Address Leakage"); it was treated as a privacy design issue and received no CVE.
An attacker only had to ring a WhatsApp call. NSO Group's Pegasus implant was delivered to ~1,400 targets through a buffer overflow in the VoIP call stack — the victim never had to answer, and the missed-call log was the only trace.
In July 2023 Dutch firm Midnight Blue published TETRA:BURST, five vulnerabilities in the secret cryptography of TETRA radio used by police, militaries and critical infrastructure, including a TEA1 property that reduces its 80-bit key to 32 bits of effective entropy.