I would like to understand below SIP DoS attacks
On the other hand, I came across with five different attacks on Register, Invite, Update, Cancel, and Bye. My question is on those five attacks: which of the above three DoS attacks can they be classified as?
Read this article and get all of the answers thoroughly.
Survey of network security systems to counter SIP-based denial-of-service attacks
As described in the above paper:
SIP message payload tampering: The first class of attacks is based on tampering with the actual SIP message or more specifically, the SIP payload. SIP is a text- based protocol and messages are transported usually in clear text. Attackers can try to inject harmful content into a message, e.g. by entering meaningless or wrong information with the goal of exploiting a buffer overflow at the target. Also, such messages can be used to probe for vulnerabilities in the target. Harmful code that will be executed in an unforeseen context can be introduced into the payload. An example is SQL code injection, which allows the attacker to execute SQL code within a database.
SIP message flow tampering: A special case of DoS attacks in real time communication networks are attacks that disturb the ongoing communication between users. Common internet services like web browsing or email communication have an asynchronous time model i.e. a requested web page is directly delivered to a user. The user will read it without further communication to the web server. The same applies to email – a user downloads the email and studies it independently of a server connection. In contrast, in SIP real time communication networks two communicating users establish a constant connection with each other whereby content is transmitted continuously between both parties. An attacker can now target this connection by introducing fake signalling messages into the communication channel. Several different SIP signalling messages can be misused for this task. A BYE message with the right credentials can prematurely terminate a session.
SIP message flooding: When talking about a DoS attack, one generally means flooding attacks that overwhelm a victim’s resources. There are three main resources that can be targeted in a SIP flooding attack: bandwidth, CPU, or memory.
Source: Ehlert, Sven, Dimitris Geneiatakis, and Thomas Magedanz. "Survey of network security systems to counter SIP-based denial-of-service attacks." Computers & Security 29.2 (2010): 225-243.
