About this question
An nmap scan against an IP address shows that port 5060 is open. I know that 5060 indicates that this is SIP traffic. Also, 5060 indicates that this is unencrypted traffic, where if the port was 5061, then the traffic would be encrypted.
I also have a hunch that 5060 tunnels through to a PBX-based phone system (possibly Asterisk). I think that the router is listening on 5060 and forwarding any inbound traffic pointed at port 5060 at this IP address to this Linux-based phone system for the purpose of receiving calls. Calls made come out through port 5060 at this IP address.
What problems would this setup cause from a security point of view? How could an attacker take advantage of this information?
