Is it possible our VoIP calls being redirected from our intended phone number to another phone number unknown to us? Our VoIP number is currently forwarded to mobile phones and computer phones. Would this be an issue with our VoIP provider? Our local network or our mobile phones?

  • While your question contains kind of claims about stolen calls it provides no kind of actual events or even evidence which can be analyzed. Insofar it is hard to decide what's really going on. It is widely reported though how locksmith advertise with fake locations in order to steal customers from each other - which is the reason Google makes it harder to advertise for them. Given the lack of any kind of details or evidence I propose to close the question as too broad. – Steffen Ullrich Jun 18 '18 at 3:55
  • Kind of sounds like you need a digital Magnum PI or something. Like @SteffenUllrich said, for those of us that aren't in the know, we have no idea how much of what you said is anecdotal vs proven statistics vs someone is out to get you specifically. – YetAnotherRandomUser Jun 19 '18 at 23:40
  • This is not something new. It has been going on for years but has become worse recently. ALOA has published articles on it and it is a known problem. It affects us in only a few locations but other companies deal with it on a larger scale. I am setting up a VPN, better security and making other changes trying to isolate the problem. – Patty Jun 21 '18 at 6:44

In a situation like this, you don't know what attack vector is being used, but it seems that you may have some anecdotal evidence from customers?

The best solution is to log all occurrences and then attempt to determine the threat(attack) vector. You may have to reach out to the companies that provide your phone service or the client's. This is very dependent on how the attack takes place, considering multiple client's are potentially vulnerable with an unknown breach. Once you have a log of what user's are doing, and what results they are getting, you can quickly identify what companies are doing it and can, with the help of ISP's or phone companies, determine where the attacks are coming from.

You can start by testing using google voice numbers or track phones you activate and call or attempt to contact yourself with.

I would also invest in a VPN service and turn off location services while you do this so that an attacker might not know that you are the one making the calls if they have you blacklisted for the malware.

Once you have even a small record of where the attack is coming from, you can begin to figure out how it is happening. Vague suspicion isn't enough to figure out what is actually happening.

The more specific the threat, the more specific the solution will be.

| improve this answer | |
  • When you say "log" do you mean a system generated event log or do you mean a manual log ? We have been trying to get information from RingCentral for years now. They are no help at all. We have provided detailed events along with the call log entries and they will not acknowledge any possible issue. – Patty Jun 18 '18 at 17:55
  • I meant both, but I was mainly referring to identifying the situation by manually noting the date and time and then comparing it to any logs you have. Another option, if you have done this and the company refuses to work with you, is to file an incident report with DHS. They would be very interested in it and the issue would either likely cease completely if it is an advanced persistent threat or the DHS will figure out how it is done. – David Kamer Jun 19 '18 at 18:43
  • Here is the form to use if the company refuses to assist you and you want to take it to someone else: us-cert.gov/forms/report – David Kamer Jun 19 '18 at 18:44
  • Thank you for this link. We have reported specific incidents numerous times. We were able to video a call to one of our numbers that was answered by another locksmith company. When we tried again from the same number a recording saying, “..this number does not accept calls from your area”. Similar to what someone receives when a number has been blocked. They simply emailed me a few days later asking if we were still having problems receiving calls from that specific number. I have received great information and guidance from asking this question. I will update as I go. – Patty Jun 21 '18 at 7:06

It's not a common practice, but I happened to solve three cases of the exactly that problem. Without a detailed information and a closer look I can't tell you what has happened exactly in your case, but here are the most common pinpoints: the phone firmware, the software phone exploit, mitm for the VoIP client and the PBX exploit. If you want further help - I will need to take a way deeper look at the case

| improve this answer | |
  • Is there a resource available that will let me know what exactly I am looking for? Is there specific information I can provide that may help rule out some areas so we can concentrate on others? – Patty Jun 18 '18 at 17:41
  • as to my knowledge, there're no special ones, at least I haven't seen them even when looked for them. The roots are in SIP - that's how most of the phones are working with VoIP ISP/PBX. The information required is sensitive, so it's not for open discussion. Contact me on Facebook - the address is in my SE profile, so I'll ask you all the questions needed. – Alexey Vesnin Jun 18 '18 at 17:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.