Subject: Re: [Sip] Residential UA security

From: "Mahey, Sonit" <[email-masked]>
Date: Wed, 3 Apr 2002 10:00:02 -0500

Hi Jonathan,

I did not follow the last para in your response. Could you please explain
further the "anonymous" authentication mechanism that you are referring to
and how it can be effective in DDOS and your thoughts on direct DOS attack
mitigation, if "anonymous" method is ineffective.

Thanks,

- sonit

Date: Tue, 02 Apr 2002 14:58:11 -0500
From: Jonathan Rosenberg <[email-masked]>
Organization: dynamicsoft
To: Cullen Jennings <[email-masked]>
CC: [email-masked], [email-masked]

Cullen Jennings wrote:
> 
> It is an interesting question - it may not be solvable on the other hand
> it
> may not need to solved as directly as you think.
> 
> With a modem set up as an auto dialer, I could make your current PSTN
> phone
> unusable. I could flood your email box so you were likely over quota. I
> could probably use up on the bandwidth on your WAN link. None of these
> DOS
> issues seem to be a huge problem today. One reason is that there is some
> hope you could trace back and figure out who was doing this to you then
> perhaps filter or take legal action.

For the PSTN, this kind of attack is not common because it costs money
to make a call. It doesn't cost money to send email, and thats why there
is spam.

That said, the anonymous authentication mechanism can prevent DDOS
attacks on my phone, but not a direct targeted attack from a single
source. 

-Jonathan R.

======================================= 
This email message is for the sole use of the intended recipient (s) and may
contain confidential and privileged information, including without
limitation, Confidential and/or Proprietary Information belonging to
Unisphere Networks, Inc. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient, please
contact the sender by reply email and destroy all copies of the original
message.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jari Arkko <[email-masked]>
Date: Wed, 03 Apr 2002 17:49:07 +0300

> further the "anonymous" authentication mechanism that you are referring to

Bis section 22. It is effective in the sense that you don't need to alert
the user or devote any resources or memory until the other side responds
to your null authentication request in a way that he proves he has seen
you challenge. Essentially, this verifies that the IP address that was
used in the first request is not completely bogus.

 > attacks on my phone, but not a direct targeted attack from a single

To be more exact, the anon method can prevent DDoS and DoS attacks that
use a forged IP address. This is pretty good in the sense that ingress
filtering isn't deployed all over in the Internet, and most attacks can
be prevented by verifying the addresses in this manner.

However, this does not prevent any of the attacks where the attacker is
willing to compromise its own address and position. There is little we
can do about such attacks for SIP or other protocols, except to send
in the police. (Though a virus-infected PC might not care about
its address being revealed, or the police finding it.)

Jari