 Delay and ByeDrop, the MITM attacker drops the SIP BYE message sent by the legitimate user (caller or callee) to the proxy and sends back to the (legitimate) user a spoofed 200 OK response message. This will give the impression to the service provider that the session is still active, whereas the legitimate user thinks that the session has been successfully terminated. In the same way a malicious user may impersonate the redirect server, forcing the legitimate one to pass its traffic via unauthorized proxies, in order to gain access to the signaling data. Moreover, an attacker may deliberately inject signaling messages for termi- nating or modifying [3] the state of an established session or, even, affect the accounting service. Figure 18.11 illustrates an example of an illegally termi- nated session. The attacker eavesdrops on session parameters and after the session has been successfully established he forwards to the proxy a session ter- mination message (SIP BYE) on behalf of the callee. The proxy forwards the Malicious user INVITE (1) INVITE (2) 200 OK (4) Caller 200 OK (3) Callee ACK (5) ACK (7) Proxy media- FIGURE 18.11 The SIP BYE signaling attack. © 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures SIP BYE to the caller who, eventually, terminates the media session without realizing that the callee has not generated the SIP BYE message. The same procedure could be followed for: (a) illegally canceling an SIP ses- sion in progress by injecting in the network a SIP BYE or CANCEL message before the caller sends its final ACK (message 5 in Figure 18.11) and (b) mod- ifying SIP session parameters by generating a SIP re-INVITE or UPDATE message-for instance if the contact address is modified the aggressor may forward the session to a malicious user. 18.3.5 Social Attacks Social attacks, also known as social engineering, are methods exploited by attackers in order to manipulate naive users' trust or goodwill for collecting confidential information. For example, an a