1 Formal Methods Demo Session Initiation Protocol (SIP) Vulnerability Testing

2 SIP Network in SDL

3 Call Hijacking – Possible Scenario SIP Proxy Registrar Covert Registrar/Proxy Routes the Call LAN Dial 1006 Re-Registered 3 2 1

4 Vulnerability to Call Hijacking IP Phone Tester (Registrar) REGISTER INVITE (someone wants to talk) OK (you are registered, no auth.) 180 Ringing Fail ! IP Phone in SDL w/fix REGISTER OK 403 Forbidden Pass ! Tester (Registrar) Corrected - Phone rejects unauthenticated Registrar Vulnerable - Phone accepts the Registrar without authentication

5Vulnerable REGISTER requests stop Cisco IP Phone 7940

6Corrected The SDL Model of the IP Phone authenticates the proxy

7 Formal Approach in Design and Testing Formal Languages and Methods (SDL, MSC, ASN.1, TTCN) –every statement is mathematically provable to be correct –every statement validated by trusted tools –standards and spacifications can be validated before approval Programming code generated by machine –no human intervention –no errors, no Trojan horses Trusted tools generate the implementation –tools based on formal techniques can be certified as trusted –implementation of a standard can be certified as trusted Tests generated from validated specifications –traceability to trusted design requirements and specifications