Subject: [Sip] comments on draft-johns-sip-outbound-middialog-draft-00

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 06 Jul 2006 18:41:20 -0400

Kevin,

Thanks for taking a crack at this. The mid-dialog case is a nasty hard 
problem and one we really do need to solve.

I'm not sure the mechanism you propose has the necessary security 
properties, however. The attack I'm worried about is where an attacker, 
who is a valid but malicious user in the system, registers to the 
network and includes an instance ID and reg-id matching that of another 
user, the target. In this case, the edge proxy creates the same flow ID, 
and probably replaces the binding between that flow ID and the flow on 
which the register was received. Thus, an attacker will hijack incoming 
calls targeted for the target.

Another big part of the problem is how the edge proxies construct a URI 
whose domain part happens to resolve to the actual two proxies which 
happen to be the ones that the client registered through. With current 
sip-outbound neither edge proxy knows what the other edge proxy is, so 
how could you construct such a URI? (note I've just posted an 
alternative solution for outbound discovery which will make this possible).

Thanks,
Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Kevin Johns" <[email-masked]>
Date: Fri, 7 Jul 2006 09:26:18 -0600

Jonathan,

Thanks for taking the time to read the draft and provide comments.

To your first point, I agree this is a problem but do not think it is
limited to the approach I propose. Thinking about it some more, I think
the same security risk is present in the current outbound procedures.
For your use case, the edge proxy will create a new flow II however, the
registrar will replace the existing registration with the new one given
that the instance ID and reg-ID match an existing registration. This
will essentially have the same effect of hijacking incoming calls.

The only way I could think of to mitigate this is through the
authentication framework. If the registrar challenges the registration
requests it can verify that a user is allowed to register a given AOR.
If it is allowed, then the malicious user is hijacking the registration
from themselves. If they are not allowed to register against a given AOR
then the registration request should fail and protect from malicious
users.

As for your second point, I will need to go back and read your proposal.
My initial thought was that this was configured and managed via the
service provider.

Thanks again for the comments.
Kevin

-----Original Message-----
From: Jonathan Rosenberg [mailto:[email-masked]] 
Sent: Thursday, July 06, 2006 4:41 PM
To: IETF SIP List
Subject: [Sip] comments on draft-johns-sip-outbound-middialog-draft-00

Kevin,

alternative solution for outbound discovery which will make this
possible).

Thanks,
Jonathan R.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol Use
[email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip