orized access to the provided services and/or (b) modify the state of an established session. SIP's signaling attacks are linked to threats like Toll Fraud, Client and Server Imper- sonation and Service Disruption (see Table 18.1), while they take advantage of the fact that many SIP architectures feature inappropriate authentication and integrity mechanisms [3]. In order to launch such an attack a malevolent user should eavesdrop the session parameters that are required for matching the SIP messages with the corresponding session. The first point of attention for a signaling attack is the registration service. The malicious user will act as a MITM trying to impersonate the legitimate user. Under normal circumstances a legitimate user generates a SIP REGIS- TER message and sends it to the appropriate SIP Registrar. Depending on the Registrar's configuration, i.e., it may require authentication or not, the negotiation procedure unfolds as depicted in Figure 18.8. Register Unauthorized* End -User Register, Credentials* Registrar 200 OK *this message is only generated if the Registrar requires authentication FIGURE 18.8 Registration procedure in SIP. © 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures Let us now assume that a malicious user can intercept and modify the mes- sages of the standard registration procedure by performing a MITM attack (this situation is illustrated in Figure 18.9). Specifically, the malicious user will either alter the contact address of the SIP REGISTER message, in order to be able to receive and put calls on behalf of the legitimate user, or he will set the value of the expiration header to "0", in order to violently dis- connect the legitimate user from the service. Note, that the attacker may even force the legitimate user to create the appropriate SIP REGISTER mes- sage, including his credentials, by forwarding to him the unauthorized message generated by the Registrar. This is the case depicted in Figure 18.9, except that the first SIP REG