SSCA Security in SIP 4 — Questions and Answers
Question 1: In SIP Digest authentication, the 'algorithm' parameter in the challenge specifies what?
- The hash algorithm used to compute the response (e.g., MD5, SHA-256) (Correct answer)
- The encryption algorithm for TLS
- The key exchange method for SRTP
- The encoding format for the nonce
Correct answer: The hash algorithm used to compute the response (e.g., MD5, SHA-256)
The 'algorithm' parameter in the WWW-Authenticate header tells the UAC which hash algorithm (such as MD5 or SHA-256) to use when computing the Digest response.
Question 2: Which attack exploits the fact that SIP uses UDP by sending forged source-address packets to disrupt communications?
- IP spoofing / source address forgery (Correct answer)
- Man-in-the-middle via ARP poisoning
- DNS cache poisoning
- TLS certificate forgery
Correct answer: IP spoofing / source address forgery
Because UDP lacks connection state, attackers can forge source IP addresses in SIP packets to inject BYE or CANCEL messages to tear down legitimate calls.
Question 3: STIR/SHAKEN is a framework designed to combat which SIP security threat?
- Caller ID spoofing on telephone networks (Correct answer)
- SIP registration hijacking
- RTP media eavesdropping
- SIP denial-of-service flooding
Correct answer: Caller ID spoofing on telephone networks
STIR/SHAKEN uses digital signatures to verify that the calling number (Caller ID) matches the actual originating carrier, combating spoofed caller identity.
Question 4: What does 'topology hiding' in SIP security mean?
- Concealing internal network addresses and infrastructure details from external parties (Correct answer)
- Encrypting SIP headers so intermediaries cannot read them
- Hiding the SDP body from proxies
- Using randomized port numbers for SIP traffic
Correct answer: Concealing internal network addresses and infrastructure details from external parties
Topology hiding removes or replaces internal IP addresses, Via headers, and Route headers so external parties cannot map the internal network.
Question 5: When using TLS for SIP, what does the UAC verify to prevent man-in-the-middle attacks?
- The server's TLS certificate matches the expected domain (Correct answer)
- The SIP nonce in the 401 response
- The Contact header's IP address
- The Via header's branch parameter
Correct answer: The server's TLS certificate matches the expected domain
The UAC must validate the server's TLS certificate against the expected domain name, ensuring the connection is to the legitimate SIP server and not an impersonator.
Question 6: What is the purpose of the 'qop' (quality of protection) parameter in SIP Digest authentication?
- To indicate whether integrity protection and/or authentication are applied to the message body (Correct answer)
- To specify the TLS version required
- To define the SRTP cipher suite
- To set the session expiry timer
Correct answer: To indicate whether integrity protection and/or authentication are applied to the message body
The 'qop' parameter specifies the quality of protection — 'auth' for authentication only, or 'auth-int' to also integrity-protect the message body.
Question 7: Which SIP method, if not properly protected, allows an attacker to terminate an active call without authorization?
- BYE (Correct answer)
- REGISTER
- OPTIONS
- SUBSCRIBE
Correct answer: BYE
An attacker who can inject a BYE request with the correct Call-ID and tags can terminate a legitimate call; TLS and source authentication prevent this.
SSCA Security in SIP 4
In SIP Digest authentication, the 'algorithm' parameter in the challenge specifies what?