 Quality of Service Performance 1. Sending ambiguous requests to proxies. 2. Exploitation of forking proxies. 3. Listening to a multicast address. 4. Population of 'active' addresses. 5. Sending messages to multicast addresses. 6. Contacting a redirect server with ambiguous requests. 7. Throwaway SIP accounts. 8. Misuse of stateless servers. 9. Anonymous SIP servers and back-to-back user agents. 10. Exploitation of messages and header fields structure. 22.3.2.1 Threats from SIP's Optional Recommendations This category of threat exploits the registrar servers. A registrar server is responsible for receiving REGISTER requests and updating location infor- mation into the location service for the domain it controls. It is the front end to the location service for a domain. As such, it could query the location service to gather information for specific registrations. The registrar server could be fooled. A SPITter could issue a dictionary attack, or submit a query with special characters to a registrar and get a list of URIs. The authentica- tion of a user to any proxy server, including the registrar is not defined as a mandatory requirement. Therefore this form of attack can be mounted. More specifically, the SIP specification does not dictate proxy servers to authenti- cate each user. Therefore, without any authentication between a UA and a proxy server several vulnerabilities might occur, including impersonation of a legitimate user. 22.3.3 Attacks and Threat Models SIP security mechanisms must be defined and combined properly to obtain a trusted network scenario. Attackers on the network may be able to modify packets (perhaps at any compromized intermediary). Attackers may wish to steal services, eavesdrop on communications or disrupt sessions. SIP commu- nications are susceptible to several types of attacks: 1. The simplest attack in SIP is snooping, which permits an attacker to gain information on users' identities, services, media and network topology. This information can be used to perform other types of atta