--- title: "ISPs & Voice Providers: Your CALEA Wiretap Platforms are Under Attack" description: US Voice and Internet Service Providers Lawful Intercept systems are targeted by foreign governments to spy on US Citizens. You can fight their attacks. image: https://www.ecg.co/hubfs/Dargon%20at%20desk%20with%20headphones%202.jpg --- [![ECG](https://www.ecg.co/hubfs/lp/cloud-migration/logo-vector.svg)](https://www.ecg.co) - Who We Are Company [**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers) Industries We Serve [**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers) - Technologies **Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect **Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling **Unified Communications & Collaboration** UC capabilities & platform expertise **Platform Reliability & Security** Infrastructure, capture & network fundamentals ### Carrier & Trunking Services Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording. [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) ### Compliance & Call Authentication Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling. [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) ### Unified Communications & Collaboration Modern UC capabilities backed by deep, hands-on expertise across every major voice platform. [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) ### Platform Reliability & Security The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day. [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) - How We Do It Services [**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering) - Resources #### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator) #### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library) #### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog) - [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) Who We Are [About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers) Industries We Serve [Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers) Technologies Carrier & Trunking Services [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) Compliance & Call Authentication [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) Unified Communications & Collaboration [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) Platform Reliability & Security [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) How We Do It Services [Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) Resources [Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog) [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) # ISPs & Voice Providers: Your CALEA Wiretap Platforms are Under Attack By: Mark Lindsey 4 min read Oct 9, 2024 [An article published October 4, 2024 by the Wall Street Journal](https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b) highlights how foreign-state bad actors are exploiting the unsecured nature of some American telecom networks, and the built-in surveillance capabilities. While telecom network staff who have to configure Lawful Intercept (LI) requests can see the capabilities as mundane, they're a rich source of data when misused for espionage operations. ## The Emergence\[y\] of Linux Malware At the same time, news just emerged about *perfctl,* an effective malware package targeting Linux servers. Most of the servers on service provides on the Internet, including ISPs and Voice Providers, are Linux servers. This fits the pattern ECG predicted in a[2017 ECG Research Report "The Coming Malware Storm,"](https://www.ecg.co/hubfs/White%20Papers%20and%20Ebooks/The_Coming_Malware_Storm.pdf)which focuses on risks to Linux servers operating in most US Voice Telecom firms. While Windows Servers have long been targeted, the targeting of Linux systems has only begin to emerge as a prominent threat. Linux servers often manage and control Lawful Intercept (LI) requests called "CALEA capabilities". These allow a network to be configured to collect data on individuals and send a copy of that data to a Law Enforcement Agency (LEA). But because the LEAs are so diverse - ranging in the US from local police departments to the federal government - there's no one universal mechanism, and no way to authenticate that the data is truly being sent to a legitimate LEA in response to a legal wiretap request. This isn't the first time LI mechanisms have been abused. [Twenty years ago, the "Greek Watergate" case involved LI used for illegal wiretap of elected officials.](https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305) The technology in that case were Ericsson telephone switches. US service providers are required to comply with lawful subpoenas and court orders for copies of the data sent through their networks. Subpoenas are generally used for historical information, like old call records, while a court may order the wiretapping or recording of all future calls. The [CALEA program is well supported technically by the FBI](https://ndcac.fbi.gov/calea/about-calea) and implemented in all the call-routing and switching platforms, such as Ribbon, BroadWorks, Metaswitch, NetSapiens. But despite their great power to harm privacy, the security on these platforms is often minimal. Some technology providers simply remove the CALEA documentation from their web sites, and require operators to open a ticket to find out how to use it. Under FCC and FBI rules, a single designated official is required to be available to implement CALEA wiretaps, so the entire organization need not know how to make it work. But "security through obscurity" - by hiding the CALEA documentation - is no security at all. Bad actors can discovery how to operate the wiretaps. To get access to the data and call switching, they need only to gain remote access to the networks used by normal system operators. That's right: if a telecom employee's PC is compromised, then the phone calls routing through that telecom network may be accessible to the attacker. PCs are regularly compromised by attacks where an email is sent to a user that contains malware. If the user can be tricked into open the email and the attachment, they can install malware that connects outbound to a Command-and-Control system. The malware may log the user's passwords, view their screen, or directly attack the Lawful Intercept platforms. Another approach taken by attackers is for an attacker to install malware on a device, such as an Android smartphone, and then to launch attacks from that malware once the mobile device is on the trusted part of the network.  ## Reducing the Risk Your Network is Used for Spying What are some ways proven to protect your call processing platforms against this kind of attacks? - ***Outbound Connectivity.*** The PC you use to access your Voice Core network does not necessarily need to be able to access the Internet. This restriction on outbound connections can radically reduce the ability of a Command-and-Control network to be established. Many of your core systems don't need to be able to initiate outbound connections, and blocking the arbitrary outbound connectivity can mitigate the impact of malware that does make its way to a core system. - ***Mobile Device Restrictions.*** Mobile devices, like Android devices and iPhones, do not need to be connected to the network in such a way they can send packets into the Voice core network. - ***Less Vulnerable PCs.*** MacOS and Linux desktops are generally targeted much less frequently than Windows desktops. This raises the complexity level for attackers. - ***One-Time Passwords.*** One-time-passwords, such as those using a Time-based One-Time Password (TOTP) Authenticator app, are a great way to protect access to sensitive equipment. Each time an administrator logs into a sensitive system, they can be prompted to enter the password from the TOTP app. The attacker would need to get access to the TOTP sequence as well as the remote network to be able to remotely access and control the platform. In the absence of TOTP, authentication using SMS push notifications can be a big deterrent. - ***Eliminate Remote Desktop.*** Platforms that allow a remote login to a management PC can make it easier for an attacker to gain the access they need. Unfortunately, Remote Desktop platforms are often left unsecured. - ***Eliminate "trusted network zones."*** The concept of "zero-trust networking" means that you minimize the "trusted zone" of your network. This can raise the difficulty of launching an attack substantially. In these attacks by China-linked actors against AT&T, Verizon, and others, the particular attack vectors (steps taken by the attackers) has not been announced yet. But you will not be wasting effort when you take steps to protect your customer's privacy -- and maybe national security at the same time. *ECG works with Internet and Voice Service Providers to update software on servers, VMWare hosts, replace and migrate firewalls, and improve your security posture.  Contact us if you need extra team members to get these projects done quickly.* ## Similar posts [![Google Next Big Service: Plain-Text Transcriptions Of Phone](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/77-google-next-big-service-plain-text-transcriptions-of-phone-call-podcast-and-youtube-videos) ### [Google Next Big Service: Plain-Text Transcriptions Of Phone](https://www.ecg.co/blog/77-google-next-big-service-plain-text-transcriptions-of-phone-call-podcast-and-youtube-videos) [![Net Neutrality: Nobody Wants an ISP To Mangle Their Data](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/110-net-neutrality-nobody-wants-an-isp-to-mangle-their-data) ### [Net Neutrality: Nobody Wants an ISP To Mangle Their Data](https://www.ecg.co/blog/110-net-neutrality-nobody-wants-an-isp-to-mangle-their-data) [![AT&T ](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/43-at-t-will-not-block-or-degrade-internet-traffic) ### [AT&T "will not block or degrade \[Internet\] traffic."](https://www.ecg.co/blog/43-at-t-will-not-block-or-degrade-internet-traffic) ## Need Help With Your Network or AI Project? Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies. [Let's Talk](https://www.ecg.co/contact) [![ecg-logo-white](https://www.ecg.co/hubfs/ecg-site/global/ecg-logo-white.svg "ecg-logo-white")](https://www.ecg.co/) 505 North Toombs St. Suite A Valdosta, Georgia 31601 USA #### Headquarters - 1.866.324.0700 US Toll-free - 1.229.244.2099 International - 1.229.244.2399 Fax - [info@e-c-group.com](mailto:info@e-c-group.com) #### Services - [Overview](https://www.ecg.co/services) - [Network Operations](https://www.ecg.co/services/network-operations) - [Custom AI Development](https://www.ecg.co/services/custom-ai-development) - [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support) - [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) - [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) #### Company - [About](https://www.ecg.co/about) - [Careers](https://www.ecg.co/careers) - [Blog](https://www.ecg.co/blog) - [Resources](https://www.ecg.co/resource-library) - [Events](https://www.ecg.co/events) © ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mark Lindsey", "url" : "https://www.ecg.co/blog/author/mark-lindsey" }, "dateModified" : "2025-03-31T08:24:06.882Z", "datePublished" : "2024-10-09T16:27:54.000Z", "headline" : "ISPs & Voice Providers: Your CALEA Wiretap Platforms are Under Attack", "image" : [ "https://www.ecg.co/hubfs/Dargon%20at%20desk%20with%20headphones%202.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.ecg.co/blog/oct-2024-attacks-on-calea-perftctl-linux-malware", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg" }, "name" : "ECG, Inc" } } ```