(b) unstable operation, e.g., paralyze the proxy or the end device, (c) gain unauthorized access. A SIP message is considered as malformed if it does not fully conform to the SIP grammar defined in RFC 3261 [7]. For example, an aggressor may generate the malformed message depicted in Figure 18.3 and repeatedly send it to a SIP entity in order to crash it. The parser whenever receives such a mes- sage will try to parse the values of From and To headers respectively, which are intentionally both set to the NULL value. Any attempt of the parser to represent this NULL value to the corresponding internal structure, may cause instability or in the worst case a DoS. As mentioned elsewhere an attacker may craft a perfectly valid message in an attempt to hamper proper parsing [6]. For instance he may try to cause instability by including unnecessary headers and having a long message body. Alternatively the attacker may embed malicious SQL code [17] in the Autho- rization header of the SIP message in order to illegally modify legitimate users' accounting or registration data. An example of such a message is depicted in Figure 18.4. Further details for these types of attacks can be found else- where [17,18]. The reader may also refer to Wieser, Laakso and Schulzrinne for the demonstration of a testing framework utilizing SIP malformed messages against well-known SIP servers [13]. REGISTER I am trying to crash a sip proxy SIP/2.0 Via: SIP/2.0/UDP 81.0.7.124:5070 From: NULL To: NULL Call-ID: 3021094946@81.0.7.124 CSeq: 2 REGISTER FIGURE 18.3 An example of SIP REGISTER malformed message. © 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures REGISTER sip:dgentele.com SIP/2.0 Via: SIP/2.0/UDP 81.0.7.124:5070 From: <sip:3400001586@dgentele.com;user=phone>;tag=3199572059 To: <sip:3400001586@dgentele.com;user=phone> Call-ID: 3021094946@81.0.7.124 CSeq: 2 REGISTER Contact:<sip:3400001586@81.0.7.124:5070;user=phone;transport=udp>;expires=300 User-Agent: Cisco ATA 186 v3.1.0 atasip (040211A) 