SSCA Security in SIP 5 — Questions and Answers
Question 1: What is a SIP 'man-in-the-middle' attack and which technology most directly prevents it at the signaling layer?
- An attacker intercepts and relays SIP messages between parties; TLS with certificate validation prevents it (Correct answer)
- An attacker floods the server with OPTIONS requests; rate limiting prevents it
- An attacker spoofs caller ID; SRTP prevents it
- An attacker hijacks RTP streams; Digest auth prevents it
Correct answer: An attacker intercepts and relays SIP messages between parties; TLS with certificate validation prevents it
A MitM attacker intercepts SIP signaling; TLS with proper certificate validation ensures messages are encrypted and the endpoint identity is verified.
Question 2: In the context of SIP security, what is 'media interception' and how is it mitigated?
- Capturing RTP audio/video streams; mitigated by encrypting media with SRTP (Correct answer)
- Capturing SIP headers; mitigated by TLS
- Redirecting calls to a rogue number; mitigated by Digest auth
- Injecting SIP BYE messages; mitigated by Via header validation
Correct answer: Capturing RTP audio/video streams; mitigated by encrypting media with SRTP
Media interception means capturing unencrypted RTP streams; SRTP provides confidentiality and integrity for the media plane to prevent this.
Question 3: Which RFC defines SIP Digest Authentication as adapted from HTTP Digest (RFC 7235)?
- RFC 3261 (Correct answer)
- RFC 4566
- RFC 3550
- RFC 5246
Correct answer: RFC 3261
RFC 3261 (the core SIP specification) defines SIP's use of Digest authentication, adapting the HTTP Digest mechanism for SIP.
Question 4: What is the security implication of SIP traversing a NAT without an SBC or ALG?
- Private IP addresses in SDP and Via headers become unreachable from the public internet, and media may fail (Correct answer)
- TLS certificates become invalid
- Digest authentication nonces expire prematurely
- SRTP keys cannot be exchanged
Correct answer: Private IP addresses in SDP and Via headers become unreachable from the public internet, and media may fail
NAT replaces source IPs in IP headers but not inside SIP/SDP bodies, leaving private addresses that external parties cannot route to, breaking media and sometimes signaling.
Question 5: Which SIP security best practice helps prevent unauthorized REGISTER requests from rogue devices?
- Requiring Digest authentication for all REGISTER requests (Correct answer)
- Using UDP instead of TCP to avoid session hijacking
- Disabling the Contact header in registrations
- Allowing registrations only on port 5060
Correct answer: Requiring Digest authentication for all REGISTER requests
Requiring Digest (or stronger) authentication for every REGISTER ensures only authorized users can create or update registrar bindings.
Question 6: What does 'SIP identity' (RFC 4474 / RFC 8224) provide that Digest authentication alone does not?
- Cryptographic verification of the From URI to prevent caller identity spoofing between domains (Correct answer)
- End-to-end media encryption
- Protection against DoS flooding attacks
- Integrity protection of the SIP body
Correct answer: Cryptographic verification of the From URI to prevent caller identity spoofing between domains
SIP Identity (updated by RFC 8224) uses digital signatures to assert that the From URI is authentic, enabling cross-domain verification of caller identity beyond what Digest auth provides.
Question 7: An enterprise wants to ensure SIP traffic between its PBX and a cloud provider is encrypted and authenticated. Which combination is considered best practice?
- TLS for signaling + SRTP for media (Correct answer)
- UDP for signaling + RTP for media
- TCP for signaling + RTP for media
- TLS for signaling + RTP for media
Correct answer: TLS for signaling + SRTP for media
TLS secures the SIP signaling channel while SRTP encrypts the RTP media streams, together providing comprehensive protection for both planes.
SSCA Security in SIP 5
What is a SIP 'man-in-the-middle' attack and which technology most directly prevents it at the signaling layer?