rafts spoofed SIP INVITE messages, placing the address of the victim in the requested URI, and sends them to the innocent SIP servers which will eventually forward them to the victim (see Figure 18.7). By maintaining a continuously growing number of incomplete INVITE trans- actions, the server will very soon become unavailable. Alternatively, the SIP servers could be replaced by innocent User Agents that respond to the spoofed INVITE requests, forwarding the responses to the actual victim, in a way similar to the TCP/SYN reflection attack. This attack can take various forms in SIP, depending on the type of the spoofed SIP message crafted by the Attacker SIP INVITE packet carrying Target SIP address Innocent Innocent server server Innocent Innocent server server Innocent server SIP target FIGURE 18.7 The INVITE reflection syndrome. © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security attacker. For instance, an alternative to the "SIP INVITE forwarding" sit- uation, described above, is to add the victim's address in the "via" header, thus having the reflectors to send their responses to the final destination via the victim. Finally, another way to pass the attack traffic through a spe- cific SIP server is to embed the Record-Route header in the SIP spoofed message. Up to now the focus was on flooding attacks against proxies and end-user terminals since they are considered as the most important SIP networks ele- ments. Nevertheless, similar attack scenarios could be employed against SIP redirect and registrar servers. Especially the registrar server should be con- sidered as a very probable target since it executes expensive cryptographic operations for authentication purposes. Therefore, a malicious user may send against any registrar a huge number of SIP REGISTER requests in order to incapacitate the registration service. 18.3.4 Signaling Attacks As signaling attack is considered any attempt to illegally modify and manip- ulate the signaling messages in order to: (a) gain unauth