 modify the signaling data in order to illegally terminate either an established session or a session in progress [3]. Last but not least, critical services like VoIP suf- fer from deception incidents exploiting social engineering methods [14]. In this case the malicious user reveals sensitive private information by deceiving innocent users who are aware of the common security practices. Table 18.1 summarizes the potential threats, the vulnerabilities exploited by each threat and the most common attacks in a SIP-based VoIP environment. 18.3 Attacks against the SIP According to Oxford Reference an attack is defined as "An attempt to over- come the security provisions of a computer network" [15]. More specifically, an attack epitomizes a threat by exploiting one or more vulnerabilities in order C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security TABLE 18.1 Potential Threats, Vulnerabilities, Attacks and Their Impact in an SIP-Based VoIP Environment Threat Vulnerability SIP attack Affects Unauthorized Lack of confidentiality Eavesdropping Confidentiality access to mechanisms SIP traffic communication Easy access to the medium Unauthorized Lack of integrity SIP message Integrity, mechanisms tampering availability modification Easy access to the SIP malformed medium messages Client Inadequate SIP signaling Confidentiality, impersonation authentication attack authenticity mechanisms SIP Man-in- the-Middle Server Lack of server SIP Man-in- Authenticity, impersonation authentication the-Middle integrity Toll fraud Inadequate SIP signaling Authenticity, authentication attacks integrity mechanisms Lack of integrity SIP message mechanisms tampering Service Parsers' implementation SIP malformed Availability disruption Eerrors messages SIP flooding Inadequate SIP signaling authentication and attacks integrity mechanisms Social Lack of education Phising Confidentiality, engineering authenticity for the attacker to achieve his goals. The effectiveness of the attack, or the rate of success, d