Subject: [Ecrit] Comment on Security Threats Draft: Single IP source as potential DoS indication

From: "Haluska, John J" <[email-masked]>
Date: Wed, 19 Oct 2005 14:39:17 -0400

There are several places (4.2.1.1 and 4.3.1.1) in
draft-taylor-ecrit-security-threats-00.txt where the origination of a
large number of emergency calls or mapping queries from a single IP
address is equated with a potential DoS attack. I would suggest that
there should be a caveat here that _sometimes_ this is perfectly
legitimate. 

For example, an emergency could occur in an office building where a
single large device handles many lines, then all the signaling and media
could come from the same IP address for all the calls. Or a Call Agent
(e.g. PacketCable CMS in a cable MSO) handling many subscriber lines
might utilize an all-IP emergency service, then all mapping queries and
signaling might come from the same address, and some large media gateway
or session border controller  might generate lots of media streams with
the same source IP address.

 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 27 Oct 2005 15:10:43 +0200

hi john,

thanks for your feedback.
please find a response below:

Haluska, John J wrote:
> there should be a caveat here that _/sometimes/_ this is perfectly 
> legitimate.

i hope we did not give the impression that a large number of emergency 
calls from the same ip address might be an indication of a dos attack.

i agree that the term 'ip address checking' in section 4.2.1.1 is 
proably not well chosen. the text in this paragraph  should also be 
rephrased.

this particularly relates to the following paragraph:

"
    IP address checking: Some types of attacks can be limited to a single
       instance per attacker by tracing the signaling request of the
       caller.  This may well be effective in preventing some kinds of
       DDOS attacks as well as the attempt of a single attacker to place
       multiple emergency calls in succession.  This remedy may be
       limited if the attacker is able to "launder" signaling or media
       packets through a variety of intermediaries.  IP address tracing
       may also be helpful in apprehending a malcreant later.  Thus,
       signaling protocols should try to capture as much of the request
       history, including the source of the mapping request, as possible.
"

i think that the text should be phrased in a way that it stresses the 
ability to use ip trackback mechanisms to learn more information.

the same applies to the following section:

"
4.3.1.1.  Countermeasures

    Generic DoS attacks, such as SYN flooding, can be handled by using
    best current practices and hence it is not discussed here.  To avoid
    launching DoS, the mapping server should be capable of limiting the
    queries from a single IP, especially when an anonymous mapping is
    requested, at a particular time.  This limit should consider the
    proxy case.  It may also log the relevant information like IP
    address, query information from the requests in order to indicate the
    query flooding.

    Dealing with all sorts of denial of service attacks against the
    emergency infrastructure and at directory servers is difficult.
    Protection needs to be provided at different protocol layers and also
    at different locations in the network.  Additionally, it is essential
    to ensure that directory queries submitted by adversary towards the
    directory server do not cause a major performance impact for the
    server with the consequence that potentially genuine requests may
    need to be rejected due to overload and a timely response is not
    possible.
"

i am also not convinced that mechanisms enforced at the psap or the 
mapping server should be based on IP addresses. i think that it would 
even be harmful to block requests from certain IP addresses.

> the same source IP address.
i fully agree with you. the same would happen if you have a large 
network behind a nat. for the entity outside this network, such as a 
psap or a mapping server, all requests might have the same address 
(depending on the type of nat).

my conclusion: the text needs to be fixed. thanks for pointing to this 
issue.

ciao
hannes