Subject: RE: [Sipping] Bot net size estimate

From: Richard Fogel <[email-masked]>
Date: Fri, 18 Mar 2005 11:33:45 -0500

Last month I submitted an informational draft that describes a SIP Edge Proxy, a perimeter device that combines the functionality of a SIP Proxy Server, SIP-aware firewall, and a Session Border Controller (http://www.borderware.com/sip_edge_proxy.php). This device is designed to prevent spam, DOS, malformed messages and the threats that have been discussed in this thread. I had assumed this would be of interest to this WG (as evidenced by this thread), and was surprised that there was not more interest in the Edge Proxy.

Since then we have had discussions with people at the Minneapolis IETF and realize that there has been a misunderstanding with this draft that is explained by a misunderstanding of the word "proxy". The Edge Proxy is a proxy in the Firewall sense, not the SIP sense, in that the Edge Proxy is an edge device that has the ALG capabilities to deal with the mentioned threats such as spam and zombies. Please have a look at the draft again now that this has been clarified.

Richard Fogel,
Chief Architect VoIP Products,
BorderWare Technologies

-----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of [email-masked]
> Sent: Friday, March 18, 2005 11:00 AM
> To: 'Arjun Roychowdhury'; 'Henning Schulzrinne'
> Cc: 'sipping'
> Subject: RE: [Sipping] Bot net size estimate
>

> > does it make sense to also discuss preventive measures the SPAM
> >control agent can take to identify possible hijacks where an
> >authenticated device is 'taken over' to become a spam generator ?
> >(detecting sudden increase of rate of outbound calls, IMs, or say
> >detecting that 100s of URIs are suddenly targeted in a few
> >minutes...as an example )

>
> Exactly!
>
> Maybe this is the right point in time what the damage of a compromised

> SBC may be? It seems that a compromised SBC can act not only as a spam

> generator but also reveal the internal IP addresses of the attached
> private networks of the customers of an unfortunate ISP. The intruder
> has only to read the
> c:
> lines in the SDP payload.
>
> Is this accurate for a compromised SBC?
>
> Thanks, Henry
>
> -----Original Message-----
> From: Arjun Roychowdhury [mailto:[email-masked]]
> Sent: Friday, March 18, 2005 8:24 AM
> To: Henning Schulzrinne
> Cc: sipping
> Subject: Re: [Sipping] Bot net size estimate
>
> Continuing the thought:
> the current spam draft, I think, to the most part addresses situations

> where you are the recipient of spam. since these IP phones use the
> same infrastructure that is so prone to attacks in desktop PCs (aka
> the internet), does it make sense to also discuss preventive measures
> the SPAM control agent can take to identify possible hijacks where an
> authenticated device is 'taken over' to become a spam generator ?
> (detecting sudden increase of rate of outbound calls, IMs, or say
> detecting that 100s of URIs are suddently targetted in a few
> minutes...as an example )
>
> regds
> arjun
>
> On Fri, 18 Mar 2005 09:15:16 -0500, Arjun Roychowdhury
> <[email-masked]> wrote:

> > Interesting read.
> > I really wonder if any sort of protection that is applied to SIP
> > will really help this situation - likely not, since these sort of
> > hijacks approach it from a 'OS/privileged app vulnerability
> > exploit'' - so its really an attack from the inside (once the trojan

> > gets installed) - so whatever trust model has been established from
> > my device will continue to serve this sort of an attack.
> > Yay !
> >
> > regds
> > arjun
> >
> >
> > On Thu, 17 Mar 2005 17:03:43 -0500, Henning Schulzrinne
> > <[email-masked]> wrote:

> > > http://news.bbc.co.uk/2/hi/technology/4354109.stm
> > >
> > > "More than one million computers on the net have been hijacked to

> attack

> > > websites and pump out spam and viruses."
> > >
> > > "The largest network of so-called zombie networks spied on by the
> > > team was made up of 50,000 hijacked home computers."
> > >
> > > (courtesy of Slashdot)
> > >
> > > _______________________________________________
> > > Sipping mailing list
> > > https://www1.ietf.org/mailman/listinfo/sipping
> > > This list is for NEW development of the application of SIP Use
> > > [email-masked] for questions on current sip Use
> > > [email-masked] for new developments of core SIP
> > >

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Brian Rosen" <[email-masked]>
Date: Fri, 18 Mar 2005 11:48:10 -0500

If the device is not a SIP user agent or proxy server, as defined in
RFC3261, then it is not of interest to the SIP/SIPPING working group.

There are working groups dealing with firewalls, nats and other middleboxes.
Midcom comes to mind.  You might try there.

Generally, here we deal, among other things, with the mess such boxes create
for people attempting to communicate with SIP, but as always, your mileage
may vary.

Brian
________________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Richard Fogel
Sent: Friday, March 18, 2005 11:34 AM
To: [email-masked]
Subject: RE: [Sipping] Bot net size estimate

Last month I submitted an informational draft that describes a SIP Edge
Proxy, a perimeter device that combines the functionality of a SIP Proxy
Server, SIP-aware firewall, and a Session Border Controller
(http://www.borderware.com/sip_edge_proxy.php). This device is designed to
prevent spam, DOS, malformed messages and the threats that have been
discussed in this thread. I had assumed this would be of interest to this WG
(as evidenced by this thread), and was surprised that there was not more
interest in the Edge Proxy.

Since then we have had discussions with people at the Minneapolis IETF and
realize that there has been a misunderstanding with this draft that is
explained by a misunderstanding of the word "proxy". The Edge Proxy is a
proxy in the Firewall sense, not the SIP sense, in that the Edge Proxy is an
edge device that has the ALG capabilities to deal with the mentioned threats
such as spam and zombies. Please have a look at the draft again now that
this has been clarified.

Richard Fogel,