Subject: RE: [SIP] Session timer considered harmful (was RE: draft-ietf- sip-session-timer: refresh rate)

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 4 Apr 2001 02:24:37 -0400

> -----Original Message-----
> From: Christer Holmberg [mailto:[email-masked]]
> Sent: Wednesday, March 21, 2001 2:51 AM
> To: Jonathan Rosenberg
> Cc: [email-masked]'; [email-masked]
> Subject: Re: [SIP] Session timer considered harmful (was RE:
> draft-ietf-sip-session-timer: refresh rate)
> 
> > >
> > > >My proposal to fix this is a bit radical, but here goes. I'd
> > > like to put
> > > >into the spec a minimum session timer value. A client never
> > > runs session
> > > >timer more frequently than this interval. I would propose
> > > that this value be
> > > >on the order of 30 minutes.
> > >
> > > I am not sure if that is needed (it could be RECOMMENDED,
> > > though), if we
> > > define the "timer too low" header. Then the proxy 
> administrator can
> > > choose to use a minimum value of 30 minutes, 60 minutes 
> or whatever he
> > > wants.
> > 
> >No, that doesn't help. A rogue proxy could still reduce the 
> value of the
> >"minimum timer value" header, even though its not supposed 
> to. Mandating
> >that the clients never send faster than X, means that no 
> rogue proxy or UA
> >could ever cause a session timer refresh to be used as an attack.
> 
> As much as a proxy can reduce the value, even it it's not 
> supposed to, a
> client can send faster than X, even it it's not supposed to...

You are totally missing the point. I am not debating that a misbehaving
client can send faster than the minimum. My point is that a normal client
won't misbehave, and an attacker can make use of standardized behavior to
launch an amplification attack. Thats bad. I am trying to describe
standardized behavior which cannot be used to launch an amplification
attack.

> 
> I do belive, however, than an operator will not have this 
> problem in his
> network, since he will control all his proxies. 

The problem is that a proxy in another network can cause the attack.

Let me be specific. I sign up for service with sip provider foo. foo is an
origination service provider, which means I can get a phone number, and
calls for that phone number are routed to a gateway owned by foo, converted
to SIP, and sent to my softphone. Now, once I get this number, I use a
hacked client that pretends to be a proxy. I call myself on a PSTN phone.
THe call goes to the gateways of provider foo, through its proxies, and to
my hacked softphone. It answers 200 OK with a session timer of 1ms. Now, the
perfectly compliant gateway of provider foo starts sending re-INVITEs at a
rate of 1000 per second. It floods my softphone, but I don't care. It also
floods the gateway, and the proxies of the provider. Thats more interesting.
I make a bunch more calls, and I can take the gateway and all proxies along
the path out of commission.

This problem will only
> come up if I plug my phone to the internet and call someone "directly"
> via some "public" proxy server, or something. And, if that 
> proxy starts
> to do strange things people will probably stop using it... In other
> words, I personally don't think that I am going to reach unwanted and
> unknown proxies - instead I think that "hacker" clients will 
> be a bigger
> problem.

As I have demonstrated above, there are realistic attacks possible.

> 
> >>Because, no matter if there is a minimum value or not, one can
> >>hack his/her client to send re-INVITEs every second...
> > 
> >That is not the point. The point is whether an attacking device can
> >introduce an amplification attack against existing, 
> compliant devices. With
> >current session timer, they can.
> 
> Yes, but are you sure that introducing a minimum value will 
> solve this?

Yes. Consider the attack above. The gateway will refuse to honor the 1ms
timer, and instead run at 30 seconds. Attack prevented.

-Jonathan R.
---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.