Subject: [Sipping] comments on draft-kaplan-sip-baiting-attack-02

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 26 Feb 2008 20:45:51 -0500

Hadriel,

Excellent draft. I hadn't read prior versions.

I think the main point really is that its very difficult to truly bind a 
signature to a call, and that a lot of what we think are bindings can be 
copied into another call and things can still work, albeit with limited 
functionality.

One comment on the ICE bit. If you anticipate that the user that is 
beating baited is normally behind a NAT that is at least address 
restricted (as opposed to full cone), ICE will prevent bidirectional 
media. THe reason is that the attacker, who is presumably on the public 
side of the NAT, will not be able to send media to the user. THe media 
will be dropped at the NAT unless it matches a permission. Such a 
permission will not exist unless Alice sends a packet to the attackers 
IP address. With ICE, the checks will take place to the banks IP address 
and thus the permission is never created.

If, however, the NAT implements a SIP-ALG, the attack you describe would 
likely work.

Of course, if the call from the attacker passes through an SBC which 
modifies the SDP, the signature is verified by the SBC (since it is 
valid), removed, and resigned by the SBC. Assuming the SBC uses 
traditional latching for the media from the attacker and Alice, the 
baiting attack works perfectly and bidirectional media can flow.

Kind of interesting, that :)

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
Cisco Fellow                                   Edison, NJ 08837
Cisco, Voice Technology Group
[email-masked]
http://www.jdrosen.net                         PHONE: (408) 902-3084
http://www.cisco.com
_______________________________________________
Sipping mailing list  http://www.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Hadriel Kaplan <[email-masked]>
Date: Tue, 26 Feb 2008 23:27:57 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Jonathan Rosenberg
>

Yup. :(
And that's assuming the INVITE had SDP.  An offer-less INVITE scenario is worse of course.

> and thus the permission is never created.

What happens if Alice uses TURN as one of her candidates?  Wouldn't the TURN address be one the attacker could send the media to, to get through the restricted NAT?

> Kind of interesting, that :)

Oh, but it wouldn't!  Luckily the SBC would break the signature, preventing the malicious call from succeeding. ;)
(good point though really - I will add it to the next draft)

-hadriel