Subject: Re: [Sip] outbound: question on flow token algorithms

From: Cullen Jennings <[email-masked]>
Date: Sun, 4 Mar 2007 09:26:47 -0800

On Nov 27, 2006, at 11:12 PM, Fredrik Thulin wrote:

> Hi
>
> Outbound (-06) "5.2  Generating Flow Tokens" says
>
>   "A proxy can use any algorithm
>    it wants as long as the flow token is unique to a flow, the flow  
> can
>    be recovered from the token, and the token can not be modified by
>    attackers."
>
> and then goes on explaining two stateless algorithms that both, if  
> I understand them correctly, would generate a static flow token for  
> a given flow (static for as long as the proxy is running).
>
> Can you please explain what attack scenarios this is meant to avoid?

Imagine an attacker can modify the traffic between the edge proxy and  
the registrar, and Alice has registered and also the attacker has  
registered a UA. If the attacker replaces the flow token in Alice's  
registration with the flow token in his request, now all of Alice's  
calls will be forwarded to the edge proxy with the wrong token the  
edge proxy will forwarded the calls to the attackers UA instead of  
Alice. Alice's phone has been hi-jacked.

>
> Algorithm #1 MUST NOT be used if SIPS isn't being used between the  
> edge proxy and the registrar, but I don't really see which attacks  
> would be possible if algorithm #1 was used without SIPS, that would  
> not also be possible with algorithm #2 without SIPS.

The attacker could modify the flow token to point at the attackers  
flow instead of Alice's flow.

>
> Perhaps the problem is that I don't interpret "can not be modified  
> by attackers" correctly - please explain what you mean by that too =).

That the attacker could change the value of the flow token ether in  
the registration from edge to registrar or later in messages that  
were either setting up a dialog or mid dialog.

>
> /Fredrik
>
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Fredrik Thulin <[email-masked]>
Date: Mon, 12 Mar 2007 09:21:26 +0100

Cullen Jennings wrote:
>>    it wants as long as the flow token is unique to a flow, the flow can
>> and then goes on explaining two stateless algorithms that both, if I 
>> understand them correctly, would generate a static flow token for a 
>> given flow (static for as long as the proxy is running).
>>
> calls will be forwarded to the edge proxy with the wrong token the edge 
> proxy will forwarded the calls to the attackers UA instead of Alice. 
> Alice's phone has been hi-jacked.

If the attacker is able to modify packets between the edge proxy and the 
registrar, then what prevents the attacker from using the Path header 
the edge proxy created for the attackers own REGISTER, complete with a 
securely generated flow token (for the attacker) and all? Wouldn't that 
also result in all calls to Alice being sent to the attacker?

Or - why wouldn't the attacker just remove the Path header and replace 
the Contact header in Alice's REGISTER with, say, Contact: 
<sip:[email-masked]>?

I think all bets are off if you have an attacker that can modify your 
REGISTERs. The solution is to prevent the attacker from being able to do 
that (i.e. use TLS).

/Fredrik