SIPVicious-Era SIP Brute-Force Toll Fraud Wave Against Asterisk & FreePBX PBXs
Through 2009–2010, automated scanners swept the internet for SIP on UDP port 5060 and brute-forced extension credentials on exposed Asterisk and FreePBX systems; the SANS Internet Storm Center flagged the surge in July 2010, and in February 2011 the Sality botnet ran an internet-wide "sipscan" from about 3 million hosts. Compromised PBXs were used to pump calls to high-cost international and premium-rate numbers.
02Deep-Dive Technical Analysis
Attackers used SIP scanning tools — above all the SIPVicious suite (`svmap` / `svwar` / `svcrack`, whose default User-Agent is `friendly-scanner`) — sending SIP `OPTIONS`, `REGISTER` and `INVITE` requests across UDP port 5060. Because default installations of Asterisk and FreePBX frequently lacked brute-force throttling or used predictable numeric passwords (e.g. extension `1000` with password `1000`), attackers authenticated as PBX extensions and looped outgoing SIP calls over the enterprise's PSTN trunks to high-cost International Revenue Share Fraud (IRSF) termination numbers, often over weekends, accumulating large carrier toll charges per victim. The activity persisted for a decade: Check Point's 2020 INJ3CTOR3 report documented the same monetization model against Asterisk/FreePBX servers.
03Vulnerability & Exploit Flow
Automated SIP dictionary brute-forcing over UDP port 5060 and PBX trunk toll bypass.
04Recommended Defense & Mitigation Protocol
Deploy Session Border Controllers (SBCs), change default SIP UDP port, enforce strong SIP secrets, and configure real-time IRSF call-velocity velocity limits.
05Security Impact & Geopolitical Consequence
Exposed the critical security vulnerabilities of unauthenticated, internet-facing corporate SIP PBXs, prompting the widespread adoption of SIP-aware Session Border Controllers (SBCs), Fail2ban rate limiting, and complex alphanumeric SIP authentication.
06Authoritative Standards & External References
- 01SANS Internet Storm Center — Targeting VoIP: Increase in SIP Connections on UDP port 5060 (July 2010)
- 02ACM IMC 2012 (Dainotti, King, Claffy, Papale, Pescapè; CAIDA) — Analysis of a "/0" Stealth Scan from a Botnet (the February 2011 Sality sipscan)
- 03USENIX ;login: — Anatomy of SIP Attacks (Ceron et al., 2012)
- 04Check Point Research — INJ3CTOR3 Operation: Leveraging Asterisk Servers for Monetization
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.