thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Collaboration, Voice & AV · Advanced

SIP Registration Hijacking

An attack in which an adversary sends a forged REGISTER to bind a victim's SIP address to the attacker's device.

Definition

If a registrar accepts registrations without strong authentication, an attacker can redirect incoming calls for a user to their own endpoint, intercepting or blocking calls. Weak or default credentials, unencrypted signaling that exposes digest parameters, and lack of rate limiting increase risk. Mitigations include strong digest credentials, TLS, mutual certificate authentication and monitoring.

Example

An attacker brute-forces a SIP extension password and registers a softphone, receiving the victim's calls.

Exam tip

Registration hijacking redirects inbound calls; toll fraud abuses outbound calling.

Related terms