Editorial

Passwords Passwords Passwords

Published on:

April 26, 2013

Passwords remain a crucial vulnerability despite the best security measures. Even with technologies like TLS, SRTP, and certificates securing phone calls, weak passwords still expose systems to attacks. Hackers use automated scanners to find open SIP ports and exploit weak passwords. To address this, snom ONE 5.0.9 now highlights accounts with weak passwords and shows what's vulnerable. While the system can generate secure passwords, administrators must avoid “No Security” settings to prevent exposure. Implementing strong password policies is a key defense against unauthorized access and potential system misuse.

For those who have a flashback when they see the title: you are right. This is not the first time I'm writing about passwords.

But passwords remain a major problem. We add fancy things like TLS, certificates, SRTP, and all kinds of things to make phone calls as secure as possible, then users use passwords like “password”. Passwords remain the Achilles' heel of securing the system.

As long as you run the PBX in a trusted environment, trivial passwords are convenient and usually nothing happens. But once you expose the system to the public internet, things can change. There are scanners out there that act like sharks smelling blood. Once they find an open SIP port, they try out accounts - once they find one, they try out passwords - everything automated and password lists like “password”, “secure”, “verysecure” and so on. Once they're able to get access, they reprogram their least cost routers and route the traffic through your system. Innocent people making calls to some expensive destinations might be using your system.

In 5.0.9 we added a feature, and then improved it, that shows which accounts have weak passwords. We don’t only show which account may be exposed, but we also show what's vulnerable. This all depends on the password policy of the system. Again, if you decide to set that to “accept anything”, there isn't much the system can do.

We also have other features that make extensions secure - for example, a dropdown in the accounts view that generates long passwords and PINs that are difficult to guess. Also, when the system starts up, it generates initial passwords that are also quite random. Entering new passwords is governed by the global system setting of the password policy. This is set to “medium”. Administrators changing this to “No Security” must know they are potentially exposing the system to scanners, just for the convenience of entering simple passwords.

Large IT companies like Google are in discussions about introducing new authentication methods (such as two-factor authentication). If you think about how many email accounts a company has and how much work it will be to change the authentication for all of them, you'll understand how serious the problem is and how serious these companies take the problem. Passwords and PINs are something the PBX user knows; when it comes to something the user has, however, things get trickier in PBX environments. Many users have a VoIP phone with a certificate, and we are already using the certificate built into the phone to authenticate the device. So when a user is using a phone provisioned using a manufacturer certificate in the phone, and the user has to enter a PIN when making an international call, then we have a two-factor authentication. This can already be the reality today with snom ONE. It doesn't solve the problem, however, of customers using soft phones or phones that don’t have a certificate built-in. Also, realistically, entering a PIN for every outbound call would make a user's life harder than it has to be.

We will have to see in the future if we, for example, allow international calls only from devices with a built-in certificate. Or at least something like international calls can be made only from phones automatically provisioned and with a security token loaded into the device.

The bottom line for me is administrators should keep their password policy at “medium”. Strong passwords are a huge step in the right direction.

Latest Articles

View All

Vodia Announces Partnership with Comms Group Global

Vodia Networks has announced a strategic distribution partnership with Comms Group Global (ASX: CCG), aiming to expand the reach of its feature-rich cloud PBX solutions across APAC and EMEA. Through this collaboration, Comms Group Global will serve as an official reseller, providing businesses of all sizes with scalable, secure, and integrated telephony solutions. Customers will benefit from advanced call management features, Microsoft Teams integration, and robust security standards, while also gaining access to Comms Group’s SIP coverage in over 65 countries. The partnership enables a streamlined “one-touch” provisioning process, ensuring fast and seamless deployment for enterprises and SMEs seeking to improve efficiency.

September 8, 2025

Why Fax Still Matters in 2025 and How Vodia Makes It Easy

Although many consider fax outdated, it continues to play a crucial role in sectors where compliance, confidentiality, and legal proof of delivery are non-negotiable. Healthcare providers rely on fax to meet HIPAA requirements, while industries such as finance, law, and real estate depend on it for contracts and documents that require signatures or legally verifiable transmission. Unlike email, fax offers confirmation reports that serve as proof of receipt, along with time-stamped records that hold up in legal proceedings. With Vodia’s PBX, digital fax becomes faster, easier, and more accessible than ever before, enabling users to drag and drop documents, monitor transmission progress, and receive immediate confirmations.

September 5, 2025

The Vodia PBX and SAML Integration

Vodia PBX now supports SAML integration, offering a secure and standards-based method for enterprise users to access their phone system through single sign-on. SAML, or Security Assertion Markup Language, allows employees to authenticate in one system and access other systems without managing multiple passwords, improving both security and user experience. By exchanging digitally signed SAML Assertions between Identity Providers and Service Providers, Vodia ensures seamless authentication across internal and external applications. With this integration, IT teams can simplify user management, reduce login complexity, and maintain strong security controls for business communications.

September 2, 2025