SIP Security 5

Question 1

What is the primary security function of the 'opaque' parameter in SIP Digest Authentication?

Accepted Answer

It allows the server to pass state information that the client must return unchanged

Answer

The 'opaque' parameter is a server-specified string that clients must return unchanged in subsequent requests, allowing the server to maintain state across authentication exchanges.

Question 2

Which attack exploits SIP's UDP transport by spoofing the source IP address of SIP messages?

Accepted Answer

SIP source address spoofing to bypass IP-based access control

Answer

Because UDP has no connection state, attackers can forge the source IP of SIP messages to bypass IP allowlist controls or impersonate legitimate endpoints.

Question 3

In a SIP 'call hijacking via re-INVITE' attack, what is the attacker's goal?

Accepted Answer

Redirect the media stream to an attacker-controlled endpoint by modifying SDP in a re-INVITE

Answer

By injecting a forged re-INVITE with modified SDP, an attacker can redirect the RTP media stream to their own endpoint, effectively intercepting the audio.

Question 4

Which IETF standard defines the use of DTLS-SRTP for securing media in WebRTC-based SIP scenarios?

Accepted Answer

RFC 5764

Answer

RFC 5764 defines the DTLS-SRTP key establishment framework, which WebRTC mandates for negotiating SRTP keys using DTLS over the media path.

Question 5

What is 'SIP vishing' and how does it exploit SIP infrastructure?

Accepted Answer

Voice phishing calls made over SIP with spoofed caller ID to deceive victims

Answer

SIP vishing (voice phishing) uses SIP's ability to spoof caller ID to impersonate legitimate organizations (banks, government) and trick victims into revealing sensitive information.

(SIP) Session Initiation Protocol Practice Test

(SIP) Session Initiation Protocol Practice Test

SIP Security 5