SIP security is a vast and somewhat challenging field.

• Authentication: Can users steal other users identity?
• Integrity: Is the SIP message received the same as the one sent?
• Confidentiality: Is someone else listening on your SIP call setup?
• Privacy
• Non-repudiation: Making sure we can trace callers

In addition, the RTP media stream, the actual conversation audio, may need to be confidential.

Client security

• Replay

Server security

• Denial of service attacks

IETF RFCs

• RFC 3329 Security Mechanism Agreement for the Session Initiation Protocol (SIP)
• RFC Draft SIP digest authentication relay attack

Books

• http://sipsecurity.org SIP Security

Additional Reading

Multimedia services using SIP face a range of challenges including traversing Firewalls which were never designed to be VoIP aware, exposing a publicly accessible address for a client which invited hacking and so on. Some of the basic issues surrounding SIP and security are examined in a White Paper from Newport Networks: SIP, Security and Session Controllers

• Cisco.com whitepaper: VOIP Security in SIP-Based Networks

Tools

http://www.dumaisnet.ca/index.php?p=asteriskapp#astban This is a simple tool that allows to ban hosts (using iptables) if they send too much SIP traffic which could possibly indicate a brute force attack.

See also

• Asterisk security
• Asterisk security through geographic IP address restriction
• Hacking Tools - How to install some hacking tools
• VoIP Consultants - VoIP Consultants who may provide security services or referrals outside their main line of business
• VoIP Security - VoIP Security Information
• VoIP Security Consultants - Consultants who offer various security services
• VoIP Security Training - Security Training Providers
• VoIP Security Vulnerabilities - Security Vulnerabilities that have been publicly disclosed in VoIP products
• VoIP Security Forum - Forum dedicated to VoIP security issues
• SIP Security discussion by OnSIP

---

• Back to SIP