Subject: [BEHAVE] STUN relay server replay attacks

From: "Neil Deason" <[email-masked]>
Date: Mon, 15 Jan 2007 14:28:04 -0800

Hello Folks.

The use of long term credentials to authenticate STUN requests within relay
sessions opens a number of replay type attacks. For example:

- DoS on server by using up ports through replaying Allocate requests
- DoS on clients by replaying Send requests
- Session hijacking by replaying SetActiveDestination requests

Possible options to address this:

a) Add a sequence number in STUN messages

This could be a new extension attribute or possibly the transaction ID
could be used. The transaction ID could be used by reserving the last 4
bytes to be sequence number or alternatively within a relay session only the
first Allocate request uses a randomly chosen transaction ID and then
subsequent requests in the session increment it.

b) Add a nonce count for STUN messages authenticated with long term creds

Add an nonce-count attribute to record the number of times a nonce has been
used within requests. Client will need to include this count in every
request that carries the nonce, i.e. the first request sent carries a
nonce-count of 1, the next 2 etc. Servers then need to maintain their own
copy of this count and if the same value is seen twice it is a potential
replay.
_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave