m (whether wired or wireless), the existence of several sophisticated eavesdropping tools, like Wireshark (http://www.wireshark.org), that are widely available on the Internet and the SIP's text-based message structure makes such an attack a very easy task to accomplish. For instance, during an eavesdropping attack the attacker may capture a SIP REGIS- TER message (see Figure 18.1) and thus become fully aware of the user's private information. On top of that, a group of SIP REGISTER captured messages could be exploited at a later time by the attacker for deferred traffic analysis [16], in an attempt to guess the password of the user; this can be realized by utilizing the data contained in the authorization header of each SIP REGISTER message. Even if the traffic is protected by a confidential- ity protection mechanism, the attacker may try to discover the corresponding cryptographic keys and gain access to the signaling data. Summarizing, eaves- dropping is an attack mainly violating privacy and confidentiality. 18.3.2 Parsing and Message Injection Attacks Every time that a SIP entity receives a SIP message it must parse it in order to convert it to the appropriate internal structure that will be used for further processing by the corresponding SIP proxy or the end device. Figure 18.2 illus- trates the typical steps taken by a SIP proxy in order to process an incoming message; depending on the SIP proxy vendor this procedure may slightly vary. C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security Proxy SIP Message receive Additional processing parser Internal structure FIGURE 18.2 SIP proxy general architecture. In most cases parsers are designed having in mind only the processing of nor- mal well-formed messages (see Figure 18.1). As a result, any alteration of the aforementioned normal procedure may severely affect the system stability and availability. This fact could be exploited by an adversary who may generate a large amount of malformed messages trying to cause: (a) DoS, 