epends on the combination of three factors: (a) the security countermeasures and repelling mechanisms that have been employed, (b) the existence of specific vulnerabilities in the underlying infrastructure, protocols etc, and (c) the attacker's particular skills and the tools used to realize the attack. Although real attack incidents in SIP environments have not yet been pub- lished, research work 3-6,12,13 has highlighted SIP's security flaws in test environments. A description of the possible attack categories against a SIP infrastructure is provided in the following sections. It is stressed that attacks stemming directly from the Internet, which may (also) affect SIP, are well documented in the literature and are thus outside the scope of this chapter. C 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures REGISTER sip:dgentele.com SIP/2.0 Via: SIP/2.0/UDP 81.0.7.124:5070 From: <sip:3400001586@dgentele.com;user=phone>;tag=3199572059 To: sip:3400001586@dgenele.com;user=phone> Call-ID: 3021094946@81.0.7.124 CSeq: 2 REGISTER Contact:sip:3400001586@81.0.7.124:5070;user=phone;transport=udp>; expires=300 User-agent: Cisco ATA 186 v3.1.0 atasip (040211A) Authorization: Digestusername="3400001586",realm="dgentele.com ce="426302039afdf717c6687e28f6c7d39c4fdb9f08", uri="sip:dgentele.com",response="af0d725596c8f06f370f8c80ade67b05" Content-Length: 0 FIGURE 18.1 A captured SIP REGISTER message (utilizing Wireshark). 18.3.1 Eavesdropping One of the most prevalent attacks against a communication system is eaves- dropping. Conversely to PSTN where only voice data are subject to this type of attack, in SIP-based VoIP services signaling is a common target too. SIP messages, which in fact are signaling data, contain information about the user's identity, contact addresses, security keys and other useful data required for establishing a session among two or more SIP participants. Normally this information should be kept private. However, the rather straightforward way to access the mediu