Subject: [Sip] Residential UA security

From: "Gabriel Velo" <[email-masked]>
Date: Tue, 2 Apr 2002 11:22:46 -0300

Dear All.

I need some help on this topic:

How can i protect a residential UA (my residential Sip Phone) from DOS
Attack like a flood of INVITE msg ??
In this scenario we don't have a validation since we need receive call from
anyone.
and .... anyone with a low bandwidth connection can make than my phone can't
stop of ring !!

Thanks in advance.

Gabriel.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Dean Willis" <[email-masked]>
Date: Tue, 2 Apr 2002 08:57:07 -0600

I believe Henning has suggested doing a 401 challenge with null
authentication. This at least lets you know what IP address is flooding
you with INVITEs, which allows other steps to be taken.

--
Dean

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Gabriel Velo
> Sent: Tuesday, April 02, 2002 8:23 AM
> To: [email-masked]
> Subject: [Sip] Residential UA security
> 
> 
> Dear All.
> 
> How can i protect a residential UA (my residential Sip Phone) 
> from DOS Attack like a flood of INVITE msg ?? In this 
> scenario we don't have a validation since we need receive 
> call from anyone. and .... anyone with a low bandwidth 
> connection can make than my phone can't stop of ring !!
> 
> Thanks in advance.
> 
> Gabriel.
> 
> 
> 
> Use [email-masked] for questions on current 
> sip Use [email-masked] for new developments on the 
> application of sip
> 
>

---

From: "Cullen Jennings" <[email-masked]>
Date: Tue, 2 Apr 2002 10:00:12 -0800

It is an interesting question - it may not be solvable on the other hand it
may not need to solved as directly as you think.

With a modem set up as an auto dialer, I could make your current PSTN phone
unusable. I could flood your email box so you were likely over quota. I
could probably use up on the bandwidth on your WAN link. None of these DOS
issues seem to be a huge problem today. One reason is that there is some
hope you could trace back and figure out who was doing this to you then
perhaps filter or take legal action.

Cullen

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Gabriel
> Velo
> Sent: Tuesday, April 02, 2002 6:23 AM
> To: [email-masked]

---

From: "David R. Oran" <[email-masked]>
Date: Tue, 2 Apr 2002 13:03:16 -0500

Another possibility is to set your UA to only accept invites from a
known set of previous-hop proxies that you trust and are configured to
execute your chosen call screening policy.

> Behalf Of Cullen Jennings
> Sent: Tuesday, April 02, 2002 1:00 PM
> To: [email-masked]; [email-masked]
> Subject: RE: [Sip] Residential UA security
> 
> 
> 
> It is an interesting question - it may not be solvable on the 
> other hand it may not need to solved as directly as you think.
> 
> With a modem set up as an auto dialer, I could make your 
> current PSTN phone unusable. I could flood your email box so 
> you were likely over quota. I could probably use up on the 
> bandwidth on your WAN link. None of these DOS issues seem to 
> be a huge problem today. One reason is that there is some 
> hope you could trace back and figure out who was doing this 
> to you then perhaps filter or take legal action.
> 
> Cullen
> 
> 
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of 
> > Gabriel Velo
> > Attack like a flood of INVITE msg ?? In this scenario we 
> don't have a 
> > validation since we need receive call from
> > anyone.
> > Use [email-masked] for questions on 
> current sip Use 
> > [email-masked] for new developments on the application of sip
> >
> 
>

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 02 Apr 2002 14:58:11 -0500

> perhaps filter or take legal action.

For the PSTN, this kind of attack is not common because it costs money
to make a call. It doesn't cost money to send email, and thats why there
is spam.

That said, the anonymous authentication mechanism can prevent DDOS
attacks on my phone, but not a direct targeted attack from a single
source. 

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

---

From: "Gabriel Velo" <[email-masked]>
Date: Wed, 3 Apr 2002 13:15:24 -0300

ok . but how my UA validate an invite message from a proxy ?? anyone can
impersonate my proxy.
in other words, a proxy can validate a UA but can a UA validate a proxy ?

thanks.

-----Mensaje original-----
De: [email-masked] [mailto:[email-masked]]En nombre de David R.
Oran
Enviado el: martes, 02 de abril de 2002 15:03
Para: 'Cullen Jennings'; [email-masked]; [email-masked]
Asunto: RE: [Sip] Residential UA security

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 03 Apr 2002 12:10:55 -0500

> in other words, a proxy can validate a UA but can a UA validate a proxy

THis is supported in bis using TLS. The UAS would connect to its proxy
via TLS, and register to receive incoming invites on that connection. It
would validate that the proxy is its own proxy using the TLS procedures,
and then reject any incoming calls that do not arrive on that
connection.

Of course, this requires a long lived tls connection from the client to
the server. Nothing is for free....

-Jonathan R.