Subject: [dispatch] SIPBRANDY and other dangers

From: Adam Roach <[email-masked]>
Date: Wed, 25 May 2016 17:15:12 -0500

As early as 2005, we identified a class of DoS attack that would be 
enabled by SIP systems, if widely deployed on the public internet. 
Called the "Voice Hammer," this attack involves triggering potentially 
vast quantities of media traffic towards a target using normal SIP call 
setup procedures.

While I don't think this is something that SIPBRANDY is required to 
address, I would like it to be part of the discussion. I believe this 
makes sense for two reasons: (1) I expect the recommendations that come 
out of SIPBRANDY to require non-trivial endpoint changes, and it would 
be good to consider coupling breaking changes to each other so as to 
minimize the number of potential modes of operation; and (2) the issue 
is fundamentally a security issue -- albeit of a different nature -- 
which would seem to require the same set of expertise as the other 
problems SIPBRANDY will work on.

To that end, I propose adding the following sentence to the "Objectives" 
paragraph in the SIPBRANDY charter:

"The working group may also define best practices for ensuring 
recipients of media flows have consented to receive such flows, in order 
to prevent or mitigate the denial-of-service attack described in RFC 
5245, section 18.5.1."

To be clear: I do not wish to presuppose that the solution to this 
problem will be ICE, or that it even is required in order for the WG to 
declare success. I just want it to be available for consideration.

/a

---

From: "Ben Campbell" <[email-masked]>
Date: Thu, 26 May 2016 16:57:32 -0500

On 25 May 2016, at 17:15, Adam Roach wrote:

> vast quantities of media traffic towards a target using normal SIP 
> call setup procedures.
>
> makes sense for two reasons: (1) I expect the recommendations that 
> come out of SIPBRANDY to require non-trivial endpoint changes, and it 
> would be good to consider coupling breaking changes to each other so 
> as to minimize the number of potential modes of operation; and (2) the 
> issue is fundamentally a security issue -- albeit of a different 
> nature -- which would seem to require the same set of expertise as the 
> other problems SIPBRANDY will work on.
>
> To that end, I propose adding the following sentence to the 
> "Objectives" paragraph in the SIPBRANDY charter:
>
> recipients of media flows have consented to receive such flows, in 
> order to prevent or mitigate the denial-of-service attack described in 
> RFC 5245, section 18.5.1."
>
> problem will be ICE, or that it even is required in order for the WG 
> to declare success. I just want it to be available for consideration.

I agree it would be nice to address that. My concern is whether this is 
the right place to do it. We've so far not succeeded in standardizing 
e2e SRTP for SIP. I hope we can do better this time around, but there's 
no guarantee there. So anything that distracts from that mission 
concerns me.

A compromise might be to put Adam's language in along with some 
disclaimer to the effect that e2e crypto will have priority.

Does anyone else have thoughts about this?

Thanks!

Ben.

---

From: Adam Roach <[email-masked]>
Date: Thu, 26 May 2016 17:24:38 -0500

On 5/26/16 16:57, Ben Campbell wrote:
>> Called the "Voice Hammer," this attack involves triggering 
>> potentially vast quantities of media traffic towards a target using 
>> normal SIP call setup procedures.
>>
>> as to minimize the number of potential modes of operation; and (2) 
>> the issue is fundamentally a security issue -- albeit of a different 
>> nature -- which would seem to require the same set of expertise as 
>> the other problems SIPBRANDY will work on.
>>
>> order to prevent or mitigate the denial-of-service attack described 
>> in RFC 5245, section 18.5.1."
>>
> I agree it would be nice to address that. My concern is whether this 
> is the right place to do it. We've so far not succeeded in 
> standardizing e2e SRTP for SIP. I hope we can do better this time 
> around, but there's no guarantee there. So anything that distracts 
> from that mission concerns me.
>

To be clear, that's what I had in mind, and I would support adding 
language to make it even more explicit.

/a

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 27 May 2016 00:05:05 +0000

It would be a fairly significant change to the proposed scope, but perhaps
one that's warranted.

I understand why you have some process caution here about scoping a
consent mechanism to ICE at the outset, but if we're going to put this
problem under SIPPRANDY's umbrella, I think it could make sense to set the
explicit goal of getting a "grand unified theory" of VoIP security that
would align the security of SIP and WebRTC. As we all know, WebRTC went
down many of the paths that it did for the sake of backwards compatibility
with SIP, and it would be a shame if the effort to interwork the two
proved futile because of lack of e2e SRTP. Consent would be another prong
of that. So maybe writing ICE in as a foregone conclusion in the service
of that goal would let us skip some unnecessary deliberation. Getting
plausible interworking with WebRTC could also provide some further
incentive for implementers to crack open their SIP implementations.

If a "grand unified theory" is the goal, then this also conforms nicely
with Cullen's recent efforts to figure out how to get STIR and WebRTC's
IdP aligned. As my strawman proposal for SIP media confidentiality had
both a STIR story and an opportunistic story, we could argue that getting
alignment of identity, consent, and encryption could be grouped under one
effort, which is mostly about getting offer/answer to deal with those
three things in a common way - especially as WebRTC IdP today conveys that
identity information as an SDP attribute.

Realigning Offers[/Answers]: The Grand Unified Theory?

Jon Peterson
Neustar, Inc.

On 5/25/16, 3:15 PM, "dispatch on behalf of Adam Roach"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>dispatch mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dispatch

---

From: "Ben Campbell" <[email-masked]>
Date: Thu, 26 May 2016 19:55:19 -0500

Hi Jon,

As an individual, I'm afraid the association of this effort with other 
great unsolved problems (Great Unsolved Theories?) may be prophetic. 
(Also, the implied acronym :-) ) I'd be happy if we just solved e2e 
confidentiality. And I don't think we would be happy if we solved all 
the other things and _not_ e2e confidentiality.

It also seems to me that aligning identity models fits more with STIR 
than with this group.

That being said, what about something like the following:

"While confidentiality is the first priority of the working group, it 
may work on aligning these practices with WebRTC, for example by 
defining best practices for ensuring recipients of media flows have 
consented to receive such flows, in order to prevent or mitigate the 
denial-of-service attack described in RFC 5245, section 18.5.1."

Ben.

On 26 May 2016, at 19:05, Peterson, Jon wrote:

>> potentially
>> call
>> come
>> order
>> to