Subject: [Speermint] Security Threat Vectors

From: "Livingood, Jason" <[email-masked]>
Date: Tue, 29 Aug 2006 15:44:15 -0400

We've been discussing VoIP Peering security threats and the like.  I
expect we will soon see a draft or two on the subject to inform
discussion in the WG on this subject.  As discussed previously, once we
document the threats we can specify the defenses which would be
implemented / recommended in an upcoming BCP.

In the meantime, I was directed to this document by one of the attendees
of the last SPEERMINT meeting:

http://www.voipsa.org/Activities/VOIPSA_Threat_Taxonomy_0.1.pdf

Regards
Jason

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Saverio Niccolini" <[email-masked]>
Date: Wed, 30 Aug 2006 18:21:17 +0200

Dear all,

I have submitted yesterday a draft on VoIP Threats:
https://datatracker.ietf.org/public/idindex.cgi?command=id_detail&id=151
18

The document should be uploaded soon (the IETF web site still says: Page
not found)
and it is attached here for your reference.

As you can see from the acknowledgement section I already had a closer
look at VOIPSA document Jason is linking and I just made minor upodate
to the taxonomy part. The other parts are new.

I will let the chairs have a presentation describing this draft for the
interim
meeting, I will try to be present remotely by Jabber at least.

Please feel free to send comments on the draft.

Cheers,
Saverio

> -----Original Message-----
> From: Livingood, Jason [mailto:[email-masked]] 
> Sent: Tuesday, August 29, 2006 9:44 PM
> To: [email-masked]
> Subject: [Speermint] Security Threat Vectors
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 30 Aug 2006 20:08:27 +0200

Hi all,

why is it necessary to rehash standard VoIP security threats? The 
mentioned/described attacks have been investigated already for a couple 
of years. Countermeasures have been studied, proposed and already 
published as RFC (or are close to get published).

I hope that I am not the only person that is confused now.

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 30 Aug 2006 21:21:52 +0200

Hi Reinaldo,

Reinaldo Penno schrieb:
> Hello,
> 
> I was going to mention something similar. Reading about known attacks
> and VoIP security nomenclature is helpful because bring people up to
> speed and we all speak the same language

Maybe reading one of the many books or articles would also help.

  but I would be interested to
> understand the attacks that are _specific_ to SPEERMINT.

I fully agree.

  Impersonating a
> proxy? Malicious Reroute? DNS Hijacking attack when related to
> federations? etc,

I think that this is already going to far. I am not yet sure about the 
entire scope of the work in this group but DNS related attacks seem to 
be pretty relevant.

  These are just examples I just thought during the time
> it took to write this email.
> 

Ciao
Hannes

> Regards,
> Reinaldo
>> From: Hannes Tschofenig [mailto:[email-masked]]
>> Sent: Wednesday, August 30, 2006 11:08 AM
>> To: [email-masked]
>> Subject: [Speermint] Security Threats & Solutions
>>
>> Hi all,
>>

---

From: "Reinaldo Penno" <[email-masked]>
Date: Wed, 30 Aug 2006 14:29:38 -0400

Hello,

I was going to mention something similar. Reading about known attacks
and VoIP security nomenclature is helpful because bring people up to
speed and we all speak the same language but I would be interested to
understand the attacks that are _specific_ to SPEERMINT. Impersonating a
proxy? Malicious Reroute? DNS Hijacking attack when related to
federations? etc, These are just examples I just thought during the time
it took to write this email.

Regards,

Reinaldo

---

From: "Jeremy Barkan \(DigitalShtick\)" <[email-masked]>
Date: Thu, 31 Aug 2006 11:41:21 +0200

This sounds like an effort worth doing with VOIPSA.

-----Original Message-----
From: Reinaldo Penno [mailto:[email-masked]] 
Sent: Wednesday, August 30, 2006 8:30 PM
To: Hannes Tschofenig; [email-masked]
Subject: RE: [Speermint] Security Threats & Solutions

Hello,

Regards,

Reinaldo

---

From: "Saverio Niccolini" <[email-masked]>
Date: Thu, 31 Aug 2006 13:56:55 +0200

Dear all,

the draft was explicitly requested by WG chairs during last IETF.
I agree with you that this is a preliminar work and threats specific
to peering need to be in there, please read the sentences in the draft
where the objective is explicitly declared and it is inline with what
you request (moreover please note that there is no such study on VoIP
threats for peering out there and this need some time to be written),
I just wanted to submit before the interim meeting in order to
stimulate discussion since there are two slots on the topic
in agenda.

I am happy if you would like to input SPEERMINT specific threats that I
can classify and insert into the next version of the draft before the 
next IETF mmeting in San Diego.

Cheers,
Saverio

> From: Jeremy Barkan (DigitalShtick) 
> [mailto:[email-masked]] 
> Sent: Thursday, August 31, 2006 11:41 AM
> To: 'Reinaldo Penno'; 'Hannes Tschofenig'; [email-masked]

---

From: Jason Livingood <[email-masked]>
Date: Thu, 31 Aug 2006 10:48:25 -0400

Correct.  I recommend anyone with questions search the archives for
"security threat" or "threat vectors" to see the relevant discussion
history.

We have an upcoming deliverable on establishing identity & security at the
domain border.  In addition, we have an immediate need in the requirements
draft to identify security-related requirements.  Dave and I felt the best
way to begin discussion was to first identify the threats, then identify
requirements to address those threats.  But again, this and another upcoming
draft are simply starting points for discussion / to spur discussion.

I think that the points raised to deal with specific threats at domain
borders are fair, but sometimes you have to begin with a wide scope of
examination & analysis before you can narrow that scope and get more
specific...

Regards
Jason

---

From: "Reinaldo Penno" <[email-masked]>
Date: Thu, 31 Aug 2006 20:39:09 -0400

Saverio,

I hope you do not think people are undermining your work. As I said, it
has intrinsic value and as Jason mention it will stimulate discussion.
But I would like us to start thinking about speermint attacks. 

Now, I read your draft, and in the context of SPEERMINT I suggest the
following nomenclature. Let me know if you agree.

a. General SIP attacks that can also be used in the context of SPEERMINT

b. General SIP attacks that cannot be used in the context of SPEERMINT
but can be adapted for so.

c. New attacks that peering brings about. 

Thanks,

Reinaldo

> From: Saverio Niccolini [mailto:[email-masked]]
> Sent: Thursday, August 31, 2006 4:57 AM
> To: Jeremy Barkan (DigitalShtick); Reinaldo Penno; Hannes Tschofenig;
> [email-masked]