Subject: [Sip] new Register DoS attack

From: "James Undery" <[email-masked]>
Date: Mon, 28 Jan 2002 16:21:00 -0000

Hi,

The recent (non normative) change to Registrar behaviour introduces a
new DoS attack against the registering UAC. There are a number of
variations of this attack, the attacker must be able to observe the UAC
REGISTER and send a re-REGISTER with an incremented CSeq. Next time the
UAC sends a REGISTER it will fail to update the bindings. The obvious
and lazy extension to this attack is to increment the CSeq by a larger
value (just within whatever a registrar will tolerate, bearing in mind
Proxy-Authentication may increase the CSeq legitimately in steps larger
than 1). 

James

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 30 Jan 2002 00:06:58 -0500

> Proxy-Authentication may increase the CSeq legitimately in steps larger

Obviously the front-line defense here is request authentication with
replay prevention, using something like nonce-count. I think this would
solve the problem for a passive attacker. Thus, to launch this attack,
you'd need to be a MITM, and that is a much harder attack to launch.
Assuming you are a MITM, you could simply discard all registrations you
receive, which has the same effect. 

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com