cks. 2. Modification attacks occur when an attacker intercepts the signaling path and tries to modify SIP messages in order to change some service characteristics. This kind of attack depends on the kind of security used. © 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security 3. Snoofing is used to impersonate the identity of a server or user to gain some information provided directly or indirectly by the attacked entity. 4. Finally, SIP is especially prone to denial of service attacks that can be performed in several ways, and can damage both servers and user agents. This attack technique may cause memory exhaustion and pro- cessor overload. Although the security mechanisms provided with SIP can reduce the risks of attacks, there are limitations in the scope of the mechanisms that must be considered. These limitations are discussed later in the chapter. The following security protection requirements should be considered as priority. They are to first ensure the protection of the registration process by ensuring confidentiality and authentication. Providing confidentiality is a harder requirement than authentication. End-to-end authentication ensures that the man-in-the middle security breaches are reduced. This can also limit denial of service attacks. This should be done for both random access and for repeat services. In addition to end-to-end authentication, end-to-end message confidentiality will create the required confidence in subscribers for SIP-based services. One open source of problem is the possibility of numerous INVITE messages that could be unsolicited. To limit this, SIP security should ensure that the INVITE messages are actually from valid IP addresses. 22.3.4 Security Vulnerabilities and Mechanisms The security mechanisms in SIP can be classified as end-to-end or hop-by-hop protection. The first provides long term and long reach security protection. The second provides intermediate and short-distance protection. 22.3.4.1 End-to-End Security Mechanisms The end-t