Subject: [Sipping] Bot net size estimate

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 17 Mar 2005 17:03:43 -0500

http://news.bbc.co.uk/2/hi/technology/4354109.stm

"More than one million computers on the net have been hijacked to attack 
websites and pump out spam and viruses."

"The largest network of so-called zombie networks spied on by the team 
was made up of 50,000 hijacked home computers."

(courtesy of Slashdot)

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Arjun Roychowdhury <[email-masked]>
Date: Fri, 18 Mar 2005 09:15:16 -0500

Interesting read.
I really wonder if any sort of protection that is applied to SIP will
really help this situation - likely not, since these sort of hijacks
approach it from a 'OS/privileged app vulnerability exploit'' - so its
really an attack from the inside (once the trojan gets installed) - so
whatever trust model has been established from my device will continue
to serve this sort of an attack.
Yay !

regds
arjun

-- 
Arjun Roychowdhury
Flextronics Software Systems

---

From: Arjun Roychowdhury <[email-masked]>
Date: Fri, 18 Mar 2005 09:23:52 -0500

Continuing the thought:
the current spam draft, I think, to the most part addresses situations
where you are the recipient of spam. since these IP phones use the
same infrastructure that is so prone to attacks in desktop PCs (aka
the internet), does it make sense to also discuss preventive measures
the SPAM control agent can take to identify possible hijacks where an
authenticated device is 'taken over' to become a spam generator ?
(detecting sudden increase of rate of outbound calls, IMs, or say
detecting that 100s of URIs are suddently targetted in a few
minutes...as an example )

regds
arjun

---

From: [email-masked]
Date: Fri, 18 Mar 2005 10:00:06 -0600

> does it make sense to also discuss preventive measures
>the SPAM control agent can take to identify possible hijacks 
>where an authenticated device is 'taken over' to become a spam 
>generator ?
>detecting that 100s of URIs are suddenly targeted in a few

Exactly!

Maybe this is the right point in time what the damage of a compromised SBC
may be? It seems that a compromised SBC can act not only as a spam generator
but also reveal the internal IP addresses of the attached private networks
of the customers of an unfortunate ISP. The intruder has only to read the c:
lines in the SDP payload.

Is this accurate for a compromised SBC?

Thanks, Henry

-----Original Message-----
From: Arjun Roychowdhury [mailto:[email-masked]] 
Sent: Friday, March 18, 2005 8:24 AM
To: Henning Schulzrinne
Cc: sipping
Subject: Re: [Sipping] Bot net size estimate

Continuing the thought:

regds
arjun

---

From: Arjun Roychowdhury <[email-masked]>
Date: Fri, 18 Mar 2005 11:26:45 -0500

Heh heh , Henry, your love for SBCs is evident. I know of some vendors
who are offering a mail in rebate - this is the right time to install
one in your network ;-)

Your comment is more to do with what happens with any centralized
server - not just SBCs. But ofcourse, you knew that ;-) I do agree
that this issue can indeed be serious considering the access/trust
control  an SBC has in relation to the protected network .

However, my initial thought was more with end systems that allow for
multiple intrusion mechanisms. Consider for example, my sip phone
running on my PDA - which also acts as an email client. The email
interface becomes a good conduit to install a trojan that can
potentially take over control of a well known phone application.
On the other hands, devices such as SBCs are dedicated to the best of
my knowledge and besides offering another control port do not open up
other interfaces
which could be remotely exploited. That is not to say they _cannot_ be
exploited - just that it is harder than exploting a general purpose
PC.

regds
arjun

regds
arjun

---

From: "Medhavi Bhatia" <[email-masked]>
Date: Fri, 18 Mar 2005 12:02:58 -0500

Here is an analogy I see with how IDSs are evolving. Typically, the Host
based IDSs are preferred over Network based IDSs for similar reasons that
security considerations implemented by individual SIP devices are harder to
manage and control than a network based SBC (cheaper solution). However we
still use a combination of both and (at least we think) it is more
effective. Whether a specific SBC is good or bad in doing its job
effectively is a secondary issue. 

The SBC is much more "intrusive" itself than IDSs though, since IDSs do not
terminate signaling. However that produces another limitation that an IDS
cannot necessarily tackle encrypted traffic which an SBC can. So there are
pluses and minuses of both as well as the individual SIP end user (host)
based security policies. I expect this trend to stay as it is.

> From: [email-masked] [mailto:[email-masked]] On Behalf
Of Arjun
> Roychowdhury
> Sent: Friday, March 18, 2005 11:27 AM
> To: [email-masked]
> Cc: sipping; Henning Schulzrinne

---

From: [email-masked]
Date: Fri, 18 Mar 2005 14:35:22 -0600

Arjun,

>That is not to say they _cannot_ be exploited - just that it 
>is harder than exploiting a general purpose PC.

This is very true. The SBC as target is however so much more rewarding for
evil doers than just breaking into a PC.

Thanks, Henry 

-----Original Message-----
From: Arjun Roychowdhury [mailto:[email-masked]] 
Sent: Friday, March 18, 2005 10:27 AM
To: [email-masked]
Cc: Henning Schulzrinne; sipping
Subject: Re: [Sipping] Bot net size estimate

regds
arjun

regds
arjun