Protect your IP PBX - safety guidelines

Protect your IP PBX - make sure nobody can access your system
Due to the wide usage of IP PBX-based solutions by a large range of customers and existing security issues with different PBX's especially Asterisk we kindly ask you to pay closer attention to such customers of yours or your own IP PBX environment. Also a 3CX IP PBX already has been compromised.

These security issues can lead to big losses caused by "brute force" attacks and generating calls to extremely expensive destinations or premium numbers like Austria Premium, Somalia, Ethiopia, Sierra Leone, etc.

Calls to these destinations mostly take place during night time with unusually high ASR (close to 90%) and ACD (over 15 minutes) parameters.

Due to this and to protect our (and your) customers, XeloQ blocked certain problematic destinations but it is impossible to block all destinations because sometimes it are normal calling destinations.

If you make use of local PBX's and use XeloQ to terminate your traffic, then make sure that your local IP PBX solution can't be hacked.
Change all standard passwords and protect your environment with available tools and tighten your firewall rules and remote access to these systems.

Please follow the guidelines below as well.

---

More tips to make the use of your IP Telephony system more secure
(for both resellers & XeloQ customers)

1. Clean up your PC and make sure usernames / passwords of your system and your customers' SIP accounts are not stored in your email.
   Your PC should be free and cleaned from viruses, Trojans, backdoors, keyboard loggers or other phishing methods to catch usernames / passwords.
   
   Take the right steps and use Lavasoft Ad Aware, JV16 Power Tools, Eset NOD32, Norton, McAfee or other similar software to perform these tasks. Advice your customers to do the same with their PC's / mail systems.
    
    
2. Do not give any unauthorized individual access to your Reseller system or customers' accounts and store usernames / passwords in a safe place.
   Each user / reseller is responsible for the correct use of it's own account information as stated in our terms & conditions since 2002.
    
    
3. Request a new password for your reseller system by email; we will tell you the new password by telephone or email after your email system is fully secured. You can tell us the preferred method when contacting support@xeloq.com ; we prefer informing you by telephone. 
    
    
4. Make sure your Customer accounts do not hold 1000's of Euro's but moderate amounts up to Eur 200 - Eur 300 maximum.
    
    
5. Change SIP accounts' passwords of your customers where needed. Customers can also change this themselves when they login to their account.
    
    
6. Limit the concurrent number of calls to the REAL limit that your customer needs. Do NOT set it at 0 (unlimited).
    
    
7. Request IP Authorization for your IP PBX of those from your customers. Then only traffic from that specific IP address is allowed to make calls.
   You can send IP authorization requests to support@xeloq.com if you feel you or your customers need that and if the used IP PBX is capable of doing so.

Please follow up on these precautions as soon as possible.