SIPConfusion: Exploiting SIP Semantic Ambiguities for Caller ID and SMS Spoofing

SIPConfusion: Exploiting SIP Semantic Ambiguities for Caller ID and SMS Spoofing

Speakers: Qi Wang

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=7IC_CmVAlTs

Overview

The Session Initiation Protocol (SIP) underpins modern voice, video, and messaging infrastructure -- from VoIP (projected at $326 billion by 2032) to Rich Communication Services (RCS) with over 1 billion active users across 90 carriers in 60 countries. This talk introduces SIP Confusion, a new class of spoofing attacks that exploits semantic ambiguities between how SIP servers parse identity headers and how client devices display them. Using an automated fuzzing framework called SIP Camera, the researchers found that over 80% of server-client combinations are vulnerable. Testing against three major carrier networks serving billions of users, all three were vulnerable to caller ID and SMS spoofing via SIP Confusion -- including spoofing messages appearing to come from 911. When a victim's device doesn't support RCS, spoofed messages fall back to traditional SMS delivery across 2G, 3G, 4G, and 5G networks. Nine vendors acknowledged the findings, eight confirmed the vulnerabilities, six deployed fixes, and carriers formed dedicated teams to address the issues.

Background

▶ Watch: SIP architecture: how identity headers flow from sender to recipient (1:30)

SIP coordinates communication sessions by exchanging messages containing identity headers -- primarily the From header, P-Preferred-Identity, P-Asserted-Identity, and Remote-Party-ID. When Alice calls Bob, her SIP user agent sends an INVITE with her identity in these headers. The proxy server authenticates Alice and forwards the message. Bob's phone displays whatever identity it receives in the headers, trusting that server authentication ensures trustworthiness.

The fundamental vulnerability is that different SIP implementations parse identity headers differently. SIP has accumulated multiple overlapping identity headers over years of RFC evolution, each with complex syntax involving display names, addresses, parameters, and various delimiters. Servers and clients may disagree on how to interpret escape characters, semicolons, URL encoding, and header priority -- creating a gap between what the server validates and what the client displays.

Key Findings

▶ Watch: SIP Camera: grammar-guided fuzzing with spoofing validation (5:30)

Four categories of SIP Confusion vulnerabilities:

1. Identity header mismatch: SIP has multiple identity headers with different priority rules. Some servers authenticate based on P-Preferred-Identity but don't cross-validate the From header, allowing attackers to authenticate as themselves while pushing a spoofed identity in the From header that clients display.
2. Malformed identity headers: Complex From header syntax (display names, addresses, parameters, semicolons) is parsed differently by authentication modules and forwarding modules within the same server, enabling internal disagreements that produce spoofed output.
3. Domain confusion: URL encoding inconsistencies (e.g., %69 for i) cause servers to see a foreign domain (forwarding without authentication) while clients decode it to a local domain, displaying a trusted identity.
4. Header smuggling: Combining external domain bypass with injected identity headers (e.g., P-Asserted-Identity), which servers don't strip and clients trust as network assertions.

80%+ of server-client combinations vulnerable. Half of tested servers forward external domain requests without any authentication challenge.

Three major carrier networks vulnerable to RCS spoofing. All rejected naive From header spoofing but were vulnerable to SIP Confusion attack A4, enabling arbitrary phone number spoofing including emergency services (911). Spoofed RCS messages fall back to SMS for non-RCS devices.

Technical Deep Dive

▶ Watch: 80%+ of server-client combinations vulnerable (7:30)

SIP Camera is a grammar-guided fuzzing framework that extracts ABNF rules from SIP RFCs to generate protocol-compliant test cases. Unlike crash-focused fuzzers, its spoofing validator detects forgeries by analyzing whether attacker messages appear in the victim's message history with a forged identity. Feedback-driven mutation continues exploring variants when test cases pass server validation.

The test bed covers six open-source SIP servers (FreeSWITCH, OpenSIPS, Asterisk, Kamailio, FlexiSIP) and nine SIP user agents from popular softphone rankings. Commercial VoIP hardware from Motorola and Polycom and Session Border Controllers (SBCs) were also tested -- all vulnerable to some extent, even with SBCs specifically designed to secure SIP traffic.

Demo / Proof of Concept

▶ Watch: RCS spoofing on three major carriers affecting billions of users (13:30)

Real-world carrier testing demonstrated SIP Confusion against three major carrier networks serving billions of combined users. Attack A4 enabled sending text messages appearing to come from arbitrary phone numbers, including 911. The attacks work across RCS and fall back to SMS for non-RCS devices, affecting users on 2G through 5G networks. Commercial VoIP hardware was also vulnerable despite SBC protections.

Defensive Implications

▶ Watch: Responsible disclosure: 9 vendors acknowledged, 6 deployed fixes (15:30)

For telecom operators, SIP Confusion represents a critical trust boundary violation. Carriers should implement strict cross-validation of all identity headers, not just the primary authentication header. The fallback from RCS to SMS extends the attack surface to all mobile users, not just RCS subscribers. For enterprise VoIP deployments, even SBCs do not fully mitigate these attacks. SIP server configurations should be audited for external domain forwarding without authentication. For security teams, caller ID and SMS spoofing via SIP Confusion enables social engineering attacks that appear to come from trusted numbers including emergency services, banks, and internal company numbers.

Key Takeaways

• SIP Confusion exploits semantic ambiguities between how servers authenticate and clients display identity headers
• Over 80% of server-client combinations are vulnerable to some form of ambiguity-based spoofing
• Three major carrier networks vulnerable to RCS caller ID/SMS spoofing affecting billions of users
• Spoofed RCS messages fall back to SMS, extending attacks across 2G-5G networks
• Commercial VoIP hardware and SBCs are also vulnerable
• SIP Camera fuzzing framework is open-source on GitHub
• Nine vendors acknowledged, eight confirmed, six deployed fixes; carriers formed dedicated response teams

About the Speaker(s)

Qi Wang is part of the research team at Tsinghua University. The talk was presented by B. Chang from Fudan University. The research combines protocol analysis with automated fuzzing to systematically discover a new class of telecom spoofing attacks with industry-wide impact.