Subject: [Speermint] FW: I-D Action:draft-niccolini-speermint-voipthreats-03.txt

From: "Saverio Niccolini" <[email-masked]>
Date: Fri, 22 Feb 2008 19:25:55 +0100

Hi,

a new version of the VoIP Threats draft is available.
Main changes are:
-- adapted to the terminology draft
-- added the BCPs

Comments are appreciated,
Saverio

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Friday, February 22, 2008 1:45 PM
> To: [email-masked]
> Subject: I-D Action:draft-niccolini-speermint-voipthreats-03.txt 
> 
> A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> 
> 	Title           : SPEERMINT Security BCPs
> 	Author(s)       : S. Niccolini, et al.
> 	Filename        : draft-niccolini-speermint-voipthreats-03.txt
> 	Pages           : 22
> 	Date            : 2008-02-22
> 
> This memo presents the different security threats related to 
> SPEERMINT classifying them into threats to the Location 
> Function, to the Signaling Function and to the Media 
> Function.  The different instances of the threats are briefly 
> introduced inside the classification.  Finally the existing 
> security solutions in SIP and RTP/RTCP are presented to 
> describe the countermeasures currently available for such 
> threats.  The objective of this document is to identify and 
> enumerate the SPEERMINT-specific threat vectors in order to 
> specify security-related requirements.  Once the requirements 
> are identified, methods and solutions how to achieve such 
> requirements can be selected.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-niccolini-speermint-
> voipthreats-03.txt
> 
> To remove yourself from the I-D Announcement list, send a 
> message to [email-masked] with the word 
> unsubscribe in the body of the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
> 
> Internet-Drafts are also available by anonymous FTP. Login 
> with the username "anonymous" and a password of your e-mail 
> address. After logging in, type "cd internet-drafts" and then
> 	"get draft-niccolini-speermint-voipthreats-03.txt".
> 
> A list of Internet-Drafts directories can be found in 
> http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> Internet-Drafts can also be obtained by e-mail.
> 
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE 
> /internet-drafts/draft-niccolini-speermint-voipthreats-03.txt".
> 
> NOTE:   The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant 
> mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 
> Below is the data which will enable a MIME compliant mail 
> reader implementation to automatically retrieve the ASCII 
> version of the Internet-Draft.
> 
============================================================
Dr. Saverio Niccolini
Senior Researcher
NEC Laboratories Europe, Network Research Division	
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     +49 (0)6221 4342-118
Fax:     +49 (0)6221 4342-155
e-mail:  [email-masked] <-- !!! NEW ADDRESS !!!
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014
_______________________________________________
Speermint mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/speermint

---

From: Dan York <[email-masked]>
Date: Mon, 25 Feb 2008 09:05:29 -0500

Saverio,

The document looks quite good.  On behalf of VOIPSA, I'll say again  
thanks for the mention of the Threat Taxonomy. (I know I've said this  
to you personally in the past but also want to do so publicly.)

A couple of minor nits, mostly related to formatting:

- In sections 2.1.x and 2.2.1-2, you list out individual attacks as  
bullet items.  In section 2.2.3, you mention several attacks but do  
not list them as bullet items.  For the sake of consistency you might  
want to consider doing so.

- Sections 2.1.1 and 2.2.1 do not have introductory sentences but  
purely include bullets. I don't know if you care about being  
consistent with the other sections.

- In section 2.2.3, there is a missing "the" in the first sentence:  
"The LF can be THE object of DoS attacks."

- In section 2.3 there are a couple of places in the first sentence  
where you use "signaling function" but I think to be grammatically  
correct it should be "the signaling function".  (As I wonder if I'm  
going to unleash another grammar rathole... )

- In sections 2.3.2.1 and 2.3.2.2 the bullets suddenly disappeared  
(at least on http://www.ietf.org/internet-drafts/draft-niccolini- 
speermint-voipthreats-03.txt )

- Section 2.4.1 again has no bullets while 2.4.2-2.4.3 do

Like I said, really all just formatting issues.

The only real substantive comment I'll make is to ask this - have you  
considered if there is a threat of what I'll call a "self-inflicted  
DoS" within the SPEERMINT architecture?  By that I mean what happens  
when, for instance, there is a power outage and upon the return of  
power there is a large flood as all the SIP devices send INVITEs to  
the registrar.   Obviously that instance doesn't impact the SPEERMINT  
architecture, but are there similar issues?  For instance,  
misconfiguration of one SIP provider's servers sending a flood of  
bogus packets within the peering fabric?  If there are such  
situations it may make sense to at least mention them in this  
document.  I find that people often focus on the external attackers  
and forget to look at how to protect against internal configuration  
problems that can have the same ultimate effect as an external attacker.

Overall a great document,
Dan

On Feb 22, 2008, at 1:25 PM, Saverio Niccolini wrote:

> Road, London W3 6BL Registered in England 2832014<draft-niccolini- 
> speermint- 
> voipthreats-03.URL>_______________________________________________
> Speermint mailing list
> [email-masked]

-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

---

From: "Saverio Niccolini" <[email-masked]>
Date: Tue, 26 Feb 2008 15:13:49 +0100

Dan,

thanks for the review, I will take care of your editorial comments
in the next revision of the draft.
  
> The only real substantive comment I'll make is to ask this - 
> have you considered if there is a threat of what I'll call a 
> "self-inflicted DoS" within the SPEERMINT architecture?  By 
> that I mean what happens when, for instance, there is a power 
> outage and upon the return of power there is a large flood as 
> all the SIP devices send INVITEs to the registrar.   
> Obviously that instance doesn't impact the SPEERMINT 
> misconfiguration of one SIP provider's servers sending a 
> flood of bogus packets within the peering fabric?  If there 
> are such situations it may make sense to at least mention 
> them in this document.  I find that people often focus on the 
> external attackers and forget to look at how to protect 
> against internal configuration problems that can have the 
> same ultimate effect as an external attacker.

Right, we explicitly did not look at these and if the group
has consensus on this we can add them in the next version of the
draft. Anyway we need to be sure that the threats we are addressing
are specific to SPEERMINT, we excluded domain-internal threats
from the classification (not interesting to SPEERMINT the REGISTER
after loss of power example you cited).
Can you suggest (maybe offline) more specifically which kind of
threats that are SPEERMINT specific did you have in mind?

> Overall a great document,

Thanks, looking forward to discussing it at the next IETF during
the SPEERMINt session (we should have time allocated for this on
the agenda).

Cheers,
Saverio

---

From: Dan York <[email-masked]>
Date: Tue, 26 Feb 2008 17:49:52 -0500

Saverio,

> after loss of power example you cited).

DY> Yes, I realized that my loss-of-power example was NOT applicable  
to SPEERMINT.

> threats that are SPEERMINT specific did you have in mind?

DY> Unfortunately I haven't spent enough time yet analyzing the  
SPEERMINT architecture to be able to provide solid feedback on this  
point.  In my initial thinking, there aren't many cases that leap out  
at me.  Perhaps the misconfiguration of a SIP proxy at a provider's  
network that starts spewing a flood of packets out into the peering  
fabric?  I'm not honestly sure... but I will give it some thought.

Regards,
Dan