Subject: [Sipping] FYI - my I-D about SIP usage scenarios similar to SPIT - Fwd: I-D Action:draft-york-spit-similarity-scenarios-00.txt

From: Dan York <[email-masked]>
Date: Wed, 16 Jan 2008 17:00:41 -0500

FYI, after reading RFC 5039 and some of the other drafts out related  
to voice spam/SPIT it seemed to me that, unless I missed it, the  
documents don't seem to address the issue of what SPIT could look  
like at a network level.  For instance, if a network administrator  
monitoring network traffic suddenly saw a large flood of SIP INVITE  
packets coming into his/her network, it could be:

1. a telemarketer/spammer launching a flood of SIP connections to  
deliver SPIT;
2. an attacker launching a DoS attack through one of the various SIP  
attack tools out there; or
3. a legitimate notification system starting to notify a range of SIP  
endpoints.

It was this last case of legitimate traffic that concerned me and so  
I put together an I-D talking about the types of legitimate systems  
that might generate a significant volume of traffic that could  
resemble SPIT (or a DoS attack).

Comments are very definitely welcome.  Are there other scenarios I  
should include?  Am I overstating the case? or what?

Thanks,
Dan

P.S. As this is also my first Internet-Draft I've actually ever  
submitted, comments about form, content, etc. are also welcome. It  
had been a while since I'd been doing XML publishing (used to do a  
ton of DocBook) but I have to say that 'xml2rfc' is a very nice tool!

-----------------------

Begin forwarded message:

From: [email-masked]
Date: January 16, 2008 4:40:02 PM EST
To: [email-masked]
Subject: I-D Action:draft-york-spit-similarity-scenarios-00.txt
Reply-To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts  
directories.

	Title           : SIP Usage Scenarios Similar to SPIT
	Author(s)       : D. York
	Filename        : draft-york-spit-similarity-scenarios-00.txt
	Pages           : 10
	Date            : 2008-01-16

This document outlines scenarios in which legitimate SIP traffic may
appear similar to traffic associated with voice spam, also known as
"SPIT" or "Spam for Internet Telephony.  This document is created to
provide input into the current discussions about how best to address
the issue of SPIT.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-york-spit-similarity- 
scenarios-00.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
	"get draft-york-spit-similarity-scenarios-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-york-spit-similarity-scenarios-00.txt".

NOTE:   The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
Content-Type: text/plain
Content-ID: <2008-01-16163746.I-D\@ietf.org>

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/i-d-announce

-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Brian Rosen" <[email-masked]>
Date: Wed, 16 Jan 2008 19:02:27 -0500

Another example of an inbound is some major event which causes lots of
emergency calls.  A disaster event is worst case, but even a big traffic
accident spawns a local flurry of calls toward 9-1-1/1-1-2/. We worry quite
a bit about how to distinguish a DDoS attack on emergency centers from
disaster scenarios.

This also happens with calls that are not 9-1-1.  Think of how many inbound
and outbound calls happened as a result of the recent Virginia Tech shooting
incident.

Brian

________________________________________
From: Dan York [mailto:[email-masked]] 
Sent: Wednesday, January 16, 2008 5:01 PM
To: [email-masked]
Subject: [Sipping] FYI - my I-D about SIP usage scenarios similar to SPIT
-Fwd: I-D Action:draft-york-spit-similarity-scenarios-00.txt 

FYI, after reading RFC 5039 and some of the other drafts out related to
voice spam/SPIT it seemed to me that, unless I missed it, the documents
don't seem to address the issue of what SPIT could look like at a network
level. For instance, if a network administrator monitoring network traffic
suddenly saw a large flood of SIP INVITE packets coming into his/her
network, it could be:

1. a telemarketer/spammer launching a flood of SIP connections to deliver
SPIT;
2. an attacker launching a DoS attack through one of the various SIP attack
tools out there; or
3. a legitimate notification system starting to notify a range of SIP
endpoints.

It was this last case of legitimate traffic that concerned me and so I put
together an I-D talking about the types of legitimate systems that might
generate a significant volume of traffic that could resemble SPIT (or a DoS
attack).

Comments are very definitely welcome. Are there other scenarios I should
include? Am I overstating the case? or what?

Thanks,
Dan

P.S. As this is also my first Internet-Draft I've actually ever submitted,
comments about form, content, etc. are also welcome. It had been a while
since I'd been doing XML publishing (used to do a ton of DocBook) but I have
to say that 'xml2rfc' is a very nice tool!

-----------------------

Begin forwarded message:

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-york-spit-similarity-scenarios-00.
txt

Send a message to:
	[email-masked].
In the body type:

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 16 Jan 2008 19:16:42 -0800

Dan,

The occurance of such events is often called a 'flash crowd',
http://en.wikipedia.org/wiki/Flash_Crowd

Here are a few other events that can cause such surges in traffic:

  * Radio and TV contests.  Example: "the 10th caller wins a free concert
ticket"
  * Interview shows.  Example:  "Call now to ask Kip Hawley a question about
airport security"
  * advertising.  Example:  "Call in the next 5 minutes to get your genuine
faux pearl neclace for three payments of $9.95"
  * popularity contests (often called 'voting', but only in the 'vote early,
vote often' sense.  Example: "Call 555-1212 to fire Jennifer; call 555-2222 to
fire Bob"

-d

> -----Original Message-----
> From: Brian Rosen [mailto:[email-masked]] 
> Sent: Wednesday, January 16, 2008 4:02 PM
> To: 'Dan York'; [email-masked]
> Subject: RE: [Sipping] FYI - my I-D about SIP usage scenarios 
> similar to SPIT-Fwd: I-D 
> Action:draft-york-spit-similarity-scenarios-00.txt 
> 
> 	"FILE 
> /internet-drafts/draft-york-spit-similarity-scenarios-00.txt".
>

---

From: "Raphael Tryster" <[email-masked]>
Date: Thu, 17 Jan 2008 08:12:58 +0200

I wonder if any use can be made of the fact that in all of Dan Wing's
scenarios, the nature of the destination is such that it normally
expects to receive a large number of messages from parties with which it
has no prior relationship.  Unfortunately, the emergency scenario is
also one of these, and there is a need to distinguish legitimate use
from DDoS.  

-----Original Message-----
From: Dan Wing [mailto:[email-masked]] 
Sent: Thursday, January 17, 2008 5:17 AM
To: 'Dan York'; [email-masked]
Subject: RE: [Sipping] FYI - my I-D about SIP usage scenarios similar
toSPIT-Fwd: I-D Action:draft-york-spit-similarity-scenarios-00.txt 

Dan,

  * Radio and TV contests.  Example: "the 10th caller wins a free
concert ticket"
  * Interview shows.  Example:  "Call now to ask Kip Hawley a question
about airport security"
  * advertising.  Example:  "Call in the next 5 minutes to get your
genuine faux pearl neclace for three payments of $9.95"
  * popularity contests (often called 'voting', but only in the 'vote
early, vote often' sense.  Example: "Call 555-1212 to fire Jennifer;
call 555-2222 to fire Bob"

-d

> Subject: RE: [Sipping] FYI - my I-D about SIP usage scenarios similar 
> to SPIT-Fwd: I-D Action:draft-york-spit-similarity-scenarios-00.txt
> 

> emergency calls.  A disaster event is worst case, but even a big 
> traffic accident spawns a local flurry of calls toward 9-1-1/1-1-2/.
> We worry quite

> disaster scenarios.
> 
> This also happens with calls that are not 9-1-1.  Think of how many 
> inbound and outbound calls happened as a result of the recent Virginia

> Tech shooting incident.
> documents don't seem to address the issue of what SPIT could look like

> at a network level. For instance, if a network administrator 
> deliver SPIT; 2. an attacker launching a DoS attack through one of the

> various SIP attack tools out there; or 3. a legitimate notification 
> system starting to notify a range of SIP endpoints.
> 
> It was this last case of legitimate traffic that concerned me and so I

> put together an I-D talking about the types of legitimate systems that

> might generate a significant volume of traffic that could resemble 
> SPIT (or a DoS attack).
> 
> submitted, comments about form, content, etc. are also welcome. It had

> been a while since I'd been doing XML publishing (used to do a ton of
> DocBook) but I have

> http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> Dan York, CISSP, Director of Emerging Communication Technology Office 
> of the CTO Voxeo Corporation [email-masked]
> This list is for NEW development of the application of SIP Use 
> [email-masked] for questions on current sip Use 
> [email-masked] for new developments of core SIP

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP Use
[email-masked] for questions on current sip Use
[email-masked] for new developments of core SIP
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************

---

From: "Harsha. R" <[email-masked]>
Date: Thu, 17 Jan 2008 15:24:03 +0530

Dan,
  Consider the case when there is a network outage and all the traffic
in a wide area might be routed via a single SIP signalling node -
provided if its allowed.

Regards
Harsha

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 17 Jan 2008 09:19:28 -0800

> From: Raphael Tryster [mailto:[email-masked]] 
> Sent: Wednesday, January 16, 2008 10:13 PM
> To: Dan Wing; Dan York; [email-masked]
> similar toSPIT-Fwd: I-D 
> has no prior relationship. 

There are others, too:  "Call your local Domino's Pizza in
the next 10 minutes for $5 off a large pizza."  This won't be
a fixed, nationwide number, but rather a local number.

A similar situation occurs with the non-emergency number for
your local police.  Not the 311 number commonly used, but
rather the normal E.164 number.  People (such as me) use this
number when 911 is busy (I live in San Jose, CA, and dialing
911 on a cellular phone during the evening rush hour can often
result in a busy signal; calling the state police directly
avoids the clogged 911 lines).

> Unfortunately, the emergency scenario is

My point is that there are flash crowds that occur
with all sorts of numbers.  Not just emergency numbers.  If we
only 'protect' certain emergency numbers, we aren't solving the
underlying problem.

-d

> > Subject: [Sipping] FYI - my I-D about SIP usage scenarios 
> similar to 
> > SPIT
> > You can also visit 
> https://www1.ietf.org/mailman/listinfo/I-D-announce
> If you have received this email in error, please notify the 
> system manager or the sender immediately and do

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 21 Jan 2008 09:50:55 +0200

Hi Dan,

that's a nice document and fits well into the discussions around the 
development of clever techniques to learn the behavior of users to 
distinguish "good" from "bad" calls. There are obviously plenty of 
challenges for folks working on these techniques.

You are right that existing documents did not describe the algorithms as 
such. This has lead a couple of folks to believe that they do not work 
too well in a real-world setting.

Ciao
Hannes

Dan York wrote:
> DocBook) but I have to say that 'xml2rfc' is a very nice tool!
>
> -----------------------
>
> Begin forwarded message:
>
> http://www.ietf.org/internet-drafts/draft-york-spit-similarity-scenarios-00.txt 
>
>
> ------------------------------------------------------------------------
>