Subject: [MMUSIC] RTSP and NAT - More issues found with symmetric RTP

From: Magnus Westerlund <[email-masked]>
Date: Thu, 13 Mar 2003 18:34:38 +0100

Hi,

When I wrote the slides for the presentation I identified one more 
problem in the RTSP and NAT draft. This concerns symmetric RTP.

What I found is that symmetric RTP has the same problems with different 
IP addresses that a STUN based solution would have. We must also enforce 
that media shall only be sent to an IP address that match the RTSP 
signaling connection. The attack that forces us to take this stand also 
for symmetric RTP looks like this:

This attack is how you can use the server to perform DDOS attacks. The 
attacker connects to the RTSP server and request that at session should 
determine source address based on symmetric RTP. Then the attacker 
knowing the shared secret sends RTP and RTCP binding packets to the 
server ports with spoofed IP addresses of the victim of  the DOS attack. 
Nice and simple and with minimum effort from attacker.

When we are on the topic of using RTSP to perform denial of service 
attacks: Couldn't RTCP be used to reduce the impact of these attacks. IF 
one requires to receive RTCP messages from the receiver one can limit 
which can perform this attack. If one needs to send RTCP about the media 
stream actually sent the attacker must be able to eavesdrop the media 
stream from server towards victim to be able to generate correct RTCP 
reports. The server would be responsible to cut the media stream if no 
RTCP receiver reports corresponding to recently sent packets are 
received. I know that this only provides partial security. Just fishing 
for possible solutions.

Best Regards

Magnus Westerlund 

Multimedia Technologies, Ericsson Research ERA/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic