Protection of voice telecommunications

Effective protection against TDoS attacks and Caller ID spoofing

A Telephony Denial of Service (TDoS) attack is an attempt to make the telephone system inaccessible to users by blocking incoming and/or outgoing calls.

Phone spoofing (Caller ID spoofing) is a malicious technique in which attackers falsify the phone number or name displayed on the subscriber’s device screen to impersonate a trusted source.

We protect your telephony from TDoS, load peaks, and Caller ID spoofing. We offer VoIP/SIP auditing, filtering and IVR, rate-limiting on SBCs, trunk backups across multiple carriers, and response and communication with providers and regulators.

Who is at risk?

Any business relying on calls is potentially vulnerable to TDoS attacks and Caller ID spoofing. However, certain types of businesses may face a higher risk due to the nature of their operations. Examples include:

What is a TDoS attack?

A TDoS (Telephony Denial of Service) attack is a form of cyber attack that aims to disrupt phone systems, such as those used by call centres or emergency services. The objective is to overwhelm the system with a high volume of traffic, rendering it unavailable. Typically, the attack involves automated calls or messages generated by bots or compromised systems, flooding the target system and causing service disruptions. This type of attack can result in significant financial and reputational damage.

To perform a TDoS attack, attackers overflow all available telephone resources, so that there is no free telephone line. Attackers often use TDoS, demanding a ransom to stop the attack. TDoS are also used to block bank notifications about unauthorised transfers of funds, etc. Sometimes TDoS attacks occur as a result of errors or peak loads of legitimate users. TDoS attacks can be short or last for several days. Regardless of the TDoS attack’s nature, we offer an effective remediation set for peak loads.

TDoS attacks can be classified into two categories based on their execution mode:

• Manual TDoS: These attacks are manually carried out by individuals or groups using tools like automated diallers to initiate a large number of calls or messages to the target system. Manual TDoS attacks are usually motivated by extortion, revenge, political or other reasons.
• Automated TDoS: These attacks involve automated tools like bots or malware, which can initiate a high volume of calls or messages to the target system without human intervention. Automated TDoS attacks are often driven by financial gain, as they can disrupt call centres or emergency services and demand ransom payments for service restoration.

Voice telecommunication protection methods

To mitigate the risk of TDoS attacks, businesses can employ the following prevention methods:

1. Network and infrastructure hardening: Strengthening network and infrastructure security by implementing such measures as firewall protection, intrusion detection systems, and network traffic monitoring.
2. Rate limiting and traffic shaping: Setting limits on the number of calls that can be made to a phone system within a specific period and prioritising certain types of traffic over others to restrict the impact of TDoS attacks.
3. Call blocking and filtering: Implementing mechanisms to block calls from known TDoS sources or suspicious numbers to prevent attacks at an early stage.
4. Incident response planning: Developing an incident response plan that includes steps to quickly identify and mitigate an attack, as well as procedures for reporting the attack to law enforcement and communicating with customers and stakeholders.
5. Other telecom-specific features: SIP level (INVITE/REGISTER rate-limit, protection against malformed SIP, TLS/SRTP, signaling and RTP separation, 603 Decline/486 Busy failure during overload, CAPTCHA/IVR questions before transferring to the operator), identification (RFC 8224, STIR/SHAKEN, including A/B/C attestation check on the provider side), operator measures (call gapping/overflow, call distribution across trunks, blocklist/traceback agreements, requirements for the provider’s presence in the Robocall Mitigation Database), architecture (PBX/SBC redundancy, geo-distribution, separation of test telephony from production), etc.

Voice telecommunication protection services

	Analysis and testing of telecommunication security A) PBX IP interface test in grey-box mode. Simulation of various attacks on VoIP. B) Configuration analysis in white-box mode. The report includes recommendations for addressing security vulnerabilities and configuration flaws.
	Implementation of call filtering and voice menu Development and implementation of a system for recognising suspicious incoming calls based on Machine Learning (ML). Building an Interactive Voice Response (IVR) where suspicious calls will be automatically redirected.
	Complex protection of telecom platform Analysis of the requirements of your jurisdictions and the capabilities of telecom operators. SIP-level measures, identification, operator measures, architecture. Development of a fault-tolerant platform with the use of several trunks to different telecom operators. Consultations on how to make arrangements with the operators so that they filter calls and put them in blocklists in addition to local protection.

Our experience

1. More than 80 projects on security assessment and penetration testing of IP networks.
2. Permanent delivery for the information security department of one of the leading national telecom operators.
3. Testing various kinds of mobile VoIP clients.
4. Testing of corporate IP-PBX phone systems.
5. Penetration tests of IMS operators, including 4G, with signalling via SIM over IPv6 and with traditional GSM/SS7 signalling.
6. Continuous cooperation with the cyber police and other government agencies.

Service summary

Check out our additional services and business cases. Send the form below to request telecommunication protection services. Get a free consultation.