FBI unveils International toll fraud organization

A cross continent toll fraud operation was uncovered by FBI and national law enforcement agencies in Italy, Philippines and other countries.
The investigation has been ongoing since 2006 and relates to conduct ranging from October 2005 through December 2008.

The scam financiers, Pakistani nationals residing in Italy hired the services of professional crackers-for-hire and paid the amount of $100 for each PBX they could break into. Those financiers allegedly used the compromised systems to transmit over 12 million minutes of telephone calls valued at more than $55 million over the hacked networks of victim corporations in the United States alone.

Canadian IT company hit with $52,000 bill on toll fraud

SG Magazine bring the same old story we've heard before. misconfigured PBX, voice mail system with default or easy to guess PIN codes, unneeded options turned on (dial out via voice mail system TUI) and one or more individuals eager to make calls to Bulgaria on the expense of the unsuspecting Winnipeg-based HUB Computer Solutions.

Canadian SMBs suffer huge losses on toll fraud

The Hamilton Spectator reports that several small businesses on the Hamilton Mountain suffer huge loses due to voice mail toll fraud. now these cases are a few month old, but I'll still post it for reference.

The phreaker exploited weak/default PIN codes protecting the voice mail system and were able to dial in to the voice mail system and originate an outgoing international call, in similar to DISA or call forward exploits. it is also a reminder that toll fraud was here long before IPT.

These cases really sums up the recipe for a good toll fraud:

1. PBX and added value components configured in an insecure manner
2. Unneeded services and options are left on by default
3. Weak authentication meathods, default or easy to guess PIN codes
4. No monitoring of system utilization, call logs, abnormal events
5. And finally one or more indeviduals with the passion to call some exotic far away place or simply to make money on an unsuspecting PBX owner expense.

Exploited Asterisk servers are to blame for recent vishing attacks

Recent vishing attacks have been conducted by criminal taking advantage of a known bug in older Asterisk PBX systems. According to an FBI advisory published on The Internet Crime Complaint Center the attackers exploited the known bug to gain unauthorized access to numerous Asterisk PBX systems and later used these systems as mass auto-dialers. The attackers generated thousends of calls to victims in which they attempted to extract sensitive information from the victims.
PCWorld has more information

FEMA phones hacked

According to EILEEN SULLIVAN with AP, unauthorized calls to the middle east were placed over the FEMA phone system causing an estimated damage of $12,000 in call charges to organization - A part of homeland security Dept.
The organization is blaming the undisclosed contractor/integrator of the newly installed voicemail system for not securing the system.
I'm just guessing here, but it sounds like someone left an unprotected DISA access or didn't enforce user PIN codes policy allowing the phreaker to user default vendor PIN codes to configure call forward to the middle eastern destination number.