SIP Security 3 — Questions and Answers
Question 1: In SIP, what does 'SPIT' stand for and what threat does it represent?
- Spam over Internet Telephony — unsolicited bulk voice calls (Correct answer)
- SIP Protocol Interception Technique — call eavesdropping
- Session Protocol Integrity Testing — security auditing
- Secure Peer Identity Token — caller verification
Correct answer: Spam over Internet Telephony — unsolicited bulk voice calls
SPIT (Spam over Internet Telephony) refers to unsolicited bulk calls over VoIP, analogous to email spam but for voice communications.
Question 2: Which SIP header prevents a response from being replayed by an attacker to a different transaction?
- Via
- Call-ID
- CSeq (Correct answer)
- Contact
Correct answer: CSeq
The CSeq (Command Sequence) header contains a monotonically increasing number that ties responses to specific requests, preventing response replay across transactions.
Question 3: What is a 'SIP proxy poisoning' attack?
- Injecting false routing information to redirect SIP traffic through a malicious proxy (Correct answer)
- Overloading a SIP proxy with authentication requests
- Extracting credentials from a SIP proxy's configuration
- Modifying SDP offers at a proxy to insert attacker media endpoints
Correct answer: Injecting false routing information to redirect SIP traffic through a malicious proxy
SIP proxy poisoning involves corrupting routing tables or DNS records so that SIP traffic is redirected through an attacker-controlled proxy.
Question 4: Which field in the SIP Digest Authentication challenge is used to prevent cross-realm credential reuse?
- realm (Correct answer)
- nonce
- opaque
- algorithm
Correct answer: realm
The 'realm' parameter identifies the protection domain, ensuring that credentials generated for one realm cannot be reused in authentication challenges from a different realm.
Question 5: TLS in SIP provides security for traffic between which entities?
- Adjacent SIP hops (hop-by-hop) (Correct answer)
- Caller and callee end-to-end
- Only between UAC and the first proxy
- Only between the last proxy and UAS
Correct answer: Adjacent SIP hops (hop-by-hop)
TLS in SIP provides hop-by-hop security, encrypting traffic only between directly connected SIP entities, not end-to-end.
Question 6: What is 'toll fraud' in the context of SIP security?
- Unauthorized use of a SIP system to make expensive calls at the victim's expense (Correct answer)
- Fraudulent billing by a SIP service provider
- Intercepting premium-rate call content for re-sale
- Forging caller ID on international calls
Correct answer: Unauthorized use of a SIP system to make expensive calls at the victim's expense
Toll fraud occurs when attackers compromise a SIP PBX or account to make unauthorized calls, typically to international or premium-rate numbers billed to the victim.
Question 7: Which SIP response code indicates that the server has rejected a request because the credentials provided have expired?
- 401 Unauthorized (with stale=true in WWW-Authenticate) (Correct answer)
- 403 Forbidden
- 407 Proxy Authentication Required
- 491 Request Pending
Correct answer: 401 Unauthorized (with stale=true in WWW-Authenticate)
A 401 response with 'stale=true' in the WWW-Authenticate header indicates the nonce has expired and the client should retry with a fresh nonce using the same credentials.
SIP Security 3
In SIP, what does 'SPIT' stand for and what threat does it represent?