SIP Security 2 — Questions and Answers
Question 1: Which SIP header field is used to carry authentication credentials from a client to a server?
- Authorization (Correct answer)
- WWW-Authenticate
- Proxy-Authenticate
- Security-Client
Correct answer: Authorization
The Authorization header carries the client's credentials in response to a WWW-Authenticate challenge from a UAS.
Question 2: What does the 'nonce' parameter in SIP Digest Authentication prevent?
- Replay attacks (Correct answer)
- Man-in-the-middle attacks
- DNS spoofing
- TLS downgrade attacks
Correct answer: Replay attacks
The nonce is a server-generated unique value that prevents replay attacks by ensuring each authentication exchange is unique.
Question 3: Which protocol provides end-to-end encryption of SIP message bodies but NOT the SIP headers?
- S/MIME (Correct answer)
- TLS
- IPsec
- SRTP
Correct answer: S/MIME
S/MIME encrypts the SIP message body end-to-end, but SIP headers remain visible to intermediaries.
Question 4: A SIP 'registration hijacking' attack occurs when an attacker:
- Registers a fake binding for a legitimate user's AOR (Correct answer)
- Intercepts SIP INVITE messages in transit
- Floods a SIP server with REGISTER requests
- Modifies the SDP body to redirect media
Correct answer: Registers a fake binding for a legitimate user's AOR
Registration hijacking involves an attacker registering their own contact URI under a victim's Address of Record, redirecting calls to the attacker.
Question 5: Which SIP security mechanism uses the 'Identity' header to provide cryptographic proof of caller identity?
- RFC 8224 (STIR) (Correct answer)
- Digest Authentication
- TLS mutual authentication
- S/MIME signing
Correct answer: RFC 8224 (STIR)
RFC 8224 (STIR - Secure Telephone Identity Revisited) uses the Identity header containing a JWT token to cryptographically assert caller identity.
Question 6: What is the purpose of the 'qop' (quality of protection) parameter in SIP Digest Authentication?
- It specifies whether authentication, integrity, or both protections are applied (Correct answer)
- It sets the encryption algorithm for the SIP session
- It determines the length of the nonce value
- It defines the maximum number of authentication retries
Correct answer: It specifies whether authentication, integrity, or both protections are applied
The qop parameter indicates the quality of protection applied, with 'auth' providing authentication only and 'auth-int' adding message integrity protection.
Question 7: Which attack targets SIP infrastructure by sending a high volume of crafted SIP messages to exhaust server resources?
- SIP flooding (DoS) (Correct answer)
- Toll fraud
- Eavesdropping
- SPIT (Spam over Internet Telephony)
Correct answer: SIP flooding (DoS)
SIP flooding attacks send massive volumes of SIP messages to overwhelm a server's processing capacity, constituting a Denial of Service attack.
SIP Security 2
Which SIP header field is used to carry authentication credentials from a client to a server?