A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / Scanning, hijack, and toll fraud

Scanning, hijack, and toll fraud

Scanning, registration hijack, and toll fraud are classes of abuse. The response is authentication, exposure control, and alerting.

Learn in 5 minutes

  1. Recognize unsolicited SIP as scanning pressure on an open listener
  2. Describe registration hijack as a replaced Contact binding
  3. Treat toll fraud as unauthorized call completion

Visual

A REGISTER that should have been challenged · study drawing · cyphermonkeylabs.com Unknown sourceRegistrar REGISTER 200 INVITE 403

SVG HTML PNG

Each row is a failure mode a defender looks for. None of these rows is a procedure.

Worked example

Read an unchallenged REGISTER result Dissect the 200 OK. The Contact is 192.0.2.40 and there was no digest challenge.

  1. Press Dissect.
  2. Read Contact.
  3. State the control that was missing.

Fault

Calls to +15551212 complete from 203.0.113.10, which is not on the trusted peer list, and usage charges appear.

Authorize who may place calls. The CME toll-fraud guide is the product document for that control, and FCC call authentication addresses a different problem, spoofed caller identity.

Quiz

Unsolicited INVITE and REGISTER from unnamed addresses are


Registration hijack, as a class, means


Toll fraud, as a class, means


The FCC call-authentication page is cited here because


A REGISTER stored with no challenge is


This lesson includes attack steps


Ecosystem

Glossary, sister systems, and the integration seam for this room.

AI omni-channel agents A voice bot still needs a session. SIP creates, modifies, and ends sessions. Omni-channel, in the contact-center sense, means the same contact can also live on chat or another digital channel. Those channels do not replace the voice session. On Amazon Connect the platform owns the managed PSTN voice channel. Bridging an outside carrier into Connect with a Chime Voice Connector is not a supported pattern unless AWS reviews it. When an SBC forks the voice leg to a recorder, that fork is SIPREC, a different plane from the customer dialog.

AI agents A voice bot still needs a session. On Amazon Connect the platform owns the managed PSTN voice channel. Bridging an outside carrier into Connect with a Chime Voice Connector is not a supported pattern unless AWS reviews it. The FreeSWITCH manual page also describes SignalWire, founded by the FreeSWITCH team, as a hosted platform with AI agents behind REST APIs and SWML.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper