ISTER message, generated by the legitimate user, is missing. As illustrated in Figure 18.10, an attacker could follow a similar approach in order to impersonate an entity when a SIP session is in progress. According to this scenario the malicious user modifies the SIP INVITE message, i.e., its Malicious user Register (1) Register modified (2) Unauthorized* Unauthorized* (3) modified (4) Register, Credentials Register modified, End-User Credentials (6) 200 OK, modifed (8) 200 OK (7) Registrar *this message is only generated if the Registrar requires authentication FIGURE 18.9 Man-in-the-Middle attack during registration phase. Malicious user INVITE (1) INVITE modified (2) INVITE modified (3) Busy (6) 200 OK (5) 200 OK (4) Caller ACK (7) ACK Modified (8) Callee ACK Modified (9) Proxy Media FIGURE 18.10 Man-in-the-Middle attack during call establishment. © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security contact header, and forwards it to the SIP proxy. The proxy sends the request to the callee who, assuming that he accepts the call, generates a "200 OK" response message which is finally passed to the malicious user. Upon receiving it, he replaces it with a "busy" message and forwards it to the legitimate user who acknowledges the spoofed busy response and terminates the session. However, the conversation between the malicious user and the callee has been successfully established. Similar attack techniques that are known as Fake Busy, Bye Delay and ByeDrop, are discussed in detail elsewhere [12]. The difference between the aforementioned scenario and the Fake Busy one is the existence of another malicious user acting on behalf of the callee. This aggressor intercepts the SIP messages and generates a "200 OK" response message in order to make his IP address available and thus establish a media session with the malicious user placed on the side of the caller. In this case the (legitimate) callee is unaware of the incoming invitation. For the rest of the attack scenarios, i.e., Bye