If a VoIP server is exposed to the public internet without proper firewalls, attackers can use scripts to guess usernames and passwords. Once compromised, these accounts are used to route high-cost international calls at the provider's expense. This necessitates the use of strong passwords and IP-based Access Control Lists (ACLs).