Security: SIP/IMS - Attack Vectors & Vulnerabilities

🚩 Core Attack Sequences

1. REGISTER Hijacking (SIP 401 Race)

• Vector: REGISTER method.
• Method: An attacker monitors the Gm interface and waits for a 401 Unauthorized challenge. They then inject a malicious REGISTER with a higher CSeq number before the UE can respond with the valid credentials.
• Impact: Redirection of incoming calls and SMS to the attacker's terminal.
• Mitigation: Mandatory IPsec ESP (TS 33.203) established during the first registration phase.

2. P-Asserted-Identity (PAI) Spoofing

• Vector: SIP Header P-Asserted-Identity.
• Method: An attacker sends an INVITE with a spoofed PAI header. If the P-CSCF does not verify the header against the assigned subscriber profile, the recipient sees a trusted ID.
• Impact: Trusted identity spoofing for social engineering or premium rate fraud.
• Mitigation: Identity Header Validation and stripping of unverified PAI headers at the network border (SBC).

3. Toll Fraud (INVITE Routing)

• Vector: INVITE method and Route headers.
• Method: Injecting SIP sessions using specific Route headers that bypass the operator's charging Application Server (AS).
• Impact: Free international call routing at the operator's expense.
• Mitigation: Strict enforcement of Service-Route headers and validation of all routing paths at the S-CSCF.

4. Media Interception (SDP Hijack)

• Vector: Session Description Protocol (SDP) in 200 OK or INVITE.
• Method: Modifying the c= (connection) and m= (media) lines in the SDP body to point to an attacker's IP during the initial handshake.
• Impact: Eavesdropping or recording of voice/video calls (MITM).
• Mitigation: Use of SRTP (Secure Real-time Transport Protocol) with encrypted key exchange.

🛠️ Security Architecture Mapping

!CAUTIONSIP Header Complexity: Many SIP stacks are vulnerable to memory corruption via long or specially crafted headers (e.g., Via, Contact). Regular fuzzing of the S-CSCF is required to prevent remote crash vulnerabilities.