Subject: RE: [Sipping] Edge Proxy Informational Draft

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Thu, 24 Feb 2005 14:57:06 -0500

Richard,
 
I quickly read through your draft and had some general comments:
 
The problems identified seem to arise from poor/incomplete
implementation on the part of the attack target SIP devices.  Seems like
fixing the underlying problems would obviate much of what the edge
device needs to do.
 
There seems to be an assumption that the edge device will have
sufficient information (omniscience) to do many of the functions you
propose, perhaps as much as all the serving proxies combined.
 
Several of your resolutions to problems lead me (thinking as a
miscreant) to conclude that I now have a new point of attack on your
protected system as well as the remote systems and users that you will
now wall off.
 
The scalability of the amount of processing suggested seems suspect to
me.  Will you have as many edge proxies as service proxies?  Seems if I
overload your edge with filtering work, I can DoS your whole network, as
good traffic is going to get dropped.
 
Mike

________________________________

	From: [email-masked] [mailto:[email-masked]]
On Behalf Of Richard Fogel
	Sent: Wednesday, February 23, 2005 4:27 PM
	To: Arjun Roychowdhury
	Cc: [email-masked]
	Subject: Re: [Sipping] Edge Proxy Informational Draft

	In general voice spam is tougher since there is not a lot of
content on which to filter as in email, in which you can look for
specific words. IM spam over SIP is easier to tackle since there is more
content such as a Subject and possibly multiple SDP sections. However in
voice SIP, you can filter on rules based on how often a message has been
sent from a given sender (by IP and/or SIP uri) within a given timespan,
or query on how often the same message has been seen by other SIP
servers.
	
	While voice spamming is not currently prevalent, it needs to be
addressed now before it becomes a plague similar to email's spam. From a
carrier perspective, it is more effective to stop spam at the perimiter
rather than passing it on to their subscribers.
	
	Arjun Roychowdhury wrote: 

		On Tue, 22 Feb 2005 16:02:22 -0500, Richard Fogel
<[email-masked]> <mailto:[email-masked]>  wrote:
		spam is such a

			serious threat (as described by Rosenberg et al.
in draft "SIP and Spam")
			that it must be checked now. Malformed messages
must be checked at the
			perimiter as they can crash

		How does one actually check for voice spam ? The draft
you mention
		highlights the problems and certain mechanisms as well
as highlights
		the fact that voice spam filtering is a harder problem
than email spam
		filtering. Also, I have not yet seen voice spamming in
live networks,
		so not sure if you are indicating its a reality today
that takes more
		precedence than the other SBC functions listed.
		
		regds
		arjun

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Richard Fogel <[email-masked]>
Date: Thu, 24 Feb 2005 15:17:15 -0500

Michael Hammer (mhammer) wrote:

Richard,

I quickly read through your
draft and had some general comments:

The problems identified seem to
arise from poor/incomplete implementation on the part of the attack
target SIP devices.  Seems like fixing the underlying problems would
obviate much of what the edge device needs to do.

That's a good thing in the future as the UAs and servers get hardened.
The Edge Proxy is defence in depth, in which the Proxy is the first to
get updated as new attacks are seen.

There seems to be an assumption
that the edge device will have sufficient information (omniscience) to
do many of the functions you propose, perhaps as much as all the
serving proxies combined.

This will be an interesting discussion when we come to talk about
implementations. I think that the measures I discuss such as keeping a
history of past messages and sharing attack information among Edge
Proxies are certainly doable with current hardware.

Several of your resolutions to
problems lead me (thinking as a miscreant) to conclude that I now have
a new point of attack on your protected system as well as the
remote systems and users that you will now wall off.

The Edge Proxy is analogous to deploying a firewall to protect all of
your assets. It is now a new (and only) point of attack that is
dedicated to protecting the internal SIP infrastructure, and to enable
a carrier to protect their customers from attackers and spammers.

The scalability of the amount of processing
suggested seems suspect to me.  Will you have as many edge proxies as
service proxies?  Seems if I overload your edge with filtering work, I
can DoS your whole network, as good traffic is going to get dropped.

Good point, and this will be a challenge for any implementor. We
believe that the Edge Proxies can be clustered to achieve the necessary
thoughput and reliability.

Mike

From:
[email-masked] [mailto:[email-masked]] On
Behalf Of Richard Fogel

To: Arjun Roychowdhury

Cc: [email-masked]

In general voice spam is tougher since there is not a lot of content on
which to filter as in email, in which you can look for specific words.
IM spam over SIP is easier to tackle since there is more content such
as a Subject and possibly multiple SDP sections. However in voice SIP,
you can filter on rules based on how often a message has been sent from
a given sender (by IP and/or SIP uri) within a given timespan, or query
on how often the same message has been seen by other SIP servers.

While voice spamming is not currently prevalent, it needs to be
addressed now before it becomes a plague similar to email's spam. From
a carrier perspective, it is more effective to stop spam at the
perimiter rather than passing it on to their subscribers.

On Tue, 22 Feb 2005 16:02:22 -0500, Richard Fogel <[email-masked]> wrote:
spam is such a

serious threat (as described by Rosenberg et al. in draft "SIP and Spam")
that it must be checked now. Malformed messages must be checked at the
perimiter as they can crash

How does one actually check for voice spam ? The draft you mention
highlights the problems and certain mechanisms as well as highlights
the fact that voice spam filtering is a harder problem than email spam
filtering. Also, I have not yet seen voice spamming in live networks,
so not sure if you are indicating its a reality today that takes more
precedence than the other SBC functions listed.

regds
arjun