Subject: [Ecrit] SWATting

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 26 Jul 2011 12:21:57 -0400

I heard from some people that they had not heard the verb "to SWAT" before the ECRIT meeting tomorrow. Today's news has a new example:
<http://www.smh.com.au/technology/technology-news/prank-draws-30-police-and-swat-to-womans-house-20110726-1hxqm.html>

This is a vulnerability of the current system, but the trustworthy location document is intended to quantify the risk of similar attacks in the ECRIT environment.

--Richard

---

From: "James M. Polk" <[email-masked]>
Date: Tue, 26 Jul 2011 12:10:27 -0500

At 11:21 AM 7/26/2011, Richard L. Barnes wrote:
>I heard from some people that they had not heard the verb "to SWAT" 
>before the ECRIT meeting tomorrow.

err, "the ECRIT meeting tomorrow"? The meeting was yesterday. I know 
this can get all confusing during the IETF...  ;-)

James

>Today's news has a new example:
>This is a vulnerability of the current system, but the trustworthy 
>location document is intended to quantify the risk of similar 
>attacks in the ECRIT environment.
>
>--Richard
>_______________________________________________
>Ecrit mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/ecrit

---

From: Marc Linsner <[email-masked]>
Date: Tue, 26 Jul 2011 13:12:10 -0400

Or the reference Hannes uses:

http://www.fbi.gov/news/stories/2008/february/swatting020408

-Marc-

-----Original Message-----
From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 26 Jul 2011 12:21:57 -0400
To: "[email-masked] Org" <[email-masked]>
Subject: [Ecrit] SWATting

>before the ECRIT meeting tomorrow. Today's news has a new example:
><http://www.smh.com.au/technology/technology-news/prank-draws-30-police-an
>d-swat-to-womans-house-20110726-1hxqm.html>
>
>location document is intended to quantify the risk of similar attacks in
>the ECRIT environment.
>
>--Richard

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 26 Jul 2011 13:44:17 -0400

I also say this one recently:  "Xboxer SWATTED by armed cops after online spat" 
http://www.theregister.co.uk/2011/06/30/xbox_swat_police_rait/

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 26 Jul 2011 14:01:00 -0400

Does anyone on this list know how these attacks are accomplished?  

The only obvious approaches that occur to me are CLI spoofing and lying on a VoIP provider's registration form (coincidentally, the same things that Wikipedia suggests).  But in the case I mention below, they say that the call was from "a non-valid number".

Incidentally, the ECRIT equivalent of CLI spoofing is IP address spoofing (when the LIS is locating based on IP address).  So it might be worth referring to BCP 38 somewhere. 

--Richard

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 26 Jul 2011 14:12:30 -0400

You would also have to provide a fake credit card, as I suspect none of the E911 interconnected VoIP providers provide free service. Plus, you'd probably also would need to use a non-traceable IP address, such as a coffee shop WiFi AP.

If somebody knows how this "works", please let me know. (I might want to talk to individuals with knowledge about this off-line wearing another hat.)

Henning

---

From: John Lange <[email-masked]>
Date: Tue, 26 Jul 2011 13:40:23 -0500

You would just sign up for, or hack into a VOIP service which allows
you to set your own outbound caller ID. Or possible a corporate VOIP
server that is vulnerable.

Then, just to be on the safe side, use whatever method you can to hide
your IP address when placing the call, such as a Wifi hotspot or
similar.

Hiding your IP address is probably optional because I've not seen much
interest on the part of the Telco's to track down calls from "fake"
numbers despite the rampant fraud and nuisance they regularly cause.

-- 
John Lange
www.johnlange.ca

---

From: "Thomson, Martin" <[email-masked]>
Date: Wed, 27 Jul 2011 03:36:36 +0800

On 2011-07-26 at 14:12:30, Henning Schulzrinne wrote:
> You would also have to provide a fake credit card, as I suspect none 
> of the E911 interconnected VoIP providers provide free service. Plus, 
> you'd probably also would need to use a non-traceable IP address, such 
> as a coffee shop WiFi AP.

It is possible to buy a pre-paid credit card with which to purchase a service.  Such a card is indistinguishable from the real thing, but it requires no authentication.

For something like this, it would depend on whether the name on the card matters to the service, but I suspect that it would not to many.  Capacity to pay tends to be the primary characteristic that is sought by operators.

--Martin

---

From: "Delaine Arnold ENP" <[email-masked]>
Date: Tue, 26 Jul 2011 20:50:31 -0400

I was on a NENA conference call earlier today and a gentleman from
Montgomery County, PA, was telling us about some major SKYPE phone swatting
issues going on across the US.  PSAPs are being called, linked together and
then loud party noises and music are being played.  If the calltaker hangs
up, within 2-3 minutes they get another call with the same noise - it ties
up their lines.  They have finally assigned one calltaker to just answer
these and let them play themselves out.  They have been working with Level 3
who supposedly provides the IP service for SKYPE.  If you need more
information, I can provide the person's name and contact info.

Thank you,
Delaine
---------------------------------------
Delaine M. Arnold, ENP
Chair, NENA Data Technical Committee
Voice:  813-960-1698
Cell:     813-928-1692
Email:  [email-masked]

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Thomson, Martin
Sent: Tuesday, July 26, 2011 3:37 PM
To: Henning Schulzrinne; Richard L. Barnes
Cc: [email-masked] Org
Subject: Re: [Ecrit] SWATting

> as a coffee shop WiFi AP.

It is possible to buy a pre-paid credit card with which to purchase a
service.  Such a card is indistinguishable from the real thing, but it
requires no authentication.

For something like this, it would depend on whether the name on the card
matters to the service, but I suspect that it would not to many.  Capacity
to pay tends to be the primary characteristic that is sought by operators.

--Martin

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 26 Jul 2011 17:51:26 -0700

An incident from 2007:
http://www.seattlepi.com/default/article/Teen-who-hacked-California-911-system-pleads-1268326.php
http://www.heraldnet.com/article/20071016/NEWS01/71016015

> From: [email-masked]
> To: [email-masked]; [email-masked]
> Date: Wed, 27 Jul 2011 03:36:36 +0800
> CC: [email-masked]

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 27 Jul 2011 10:17:15 +0800

"... ECRIT equivalent of CLI spoofing is IP address spoofing (when the LIS is locating based on IP address).  "

That might be the equivalent of "CLI spoofing" but the real issue is location spoofing. In use cases that allow the terminal to deliver a literal PIDF-LO then the ability to spoof location is direct; just craft your own PIDF-LO. This is why it's important to be able to utilize delivery as location-by-reference so that PSAPs can apply a different policy based on whether location is just provided literally or whether there's the opportunity to source it from a recognized operator within the PSAP catchment (and in the absence of any other mechanism such as ISP-signed PIDF-LO).

Regulators wrestle with assumptions about interconnected VoIP providers but that's a PSTN hangover and not a basis for long term policy - especially relying on something as tenuous as whether such VoIP providers only hand out subscriptions to users with identity-verified credit cards. 

Cheers,
Martin

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Richard L. Barnes
Sent: Wednesday, 27 July 2011 4:01 AM
To: Hannes Tschofenig
Cc: [email-masked] Org
Subject: Re: [Ecrit] SWATting

--Richard

---

From: Marc Linsner <[email-masked]>
Date: Tue, 26 Jul 2011 22:39:59 -0400

Martin,

I believe the point was that IP address spoofing coupled with a stolen uri
from the used IP address is location spoofing to a PSAP.

BTW, current PSTN location mechanisms are in fact LbyR via a recognized
operator.

-Marc-

-----Original Message-----
From: "Dawson, Martin" <[email-masked]>
Date: Wed, 27 Jul 2011 10:17:15 +0800
To: "Richard L. Barnes" <[email-masked]>, Hannes Tschofenig
<[email-masked]>
Cc: "[email-masked] Org" <[email-masked]>
Subject: Re: [Ecrit] SWATting

>That might be the equivalent of "CLI spoofing" but the real issue is
>location spoofing. In use cases that allow the terminal to deliver a
>literal PIDF-LO then the ability to spoof location is direct; just craft
>your own PIDF-LO. This is why it's important to be able to utilize
>delivery as location-by-reference so that PSAPs can apply a different
>policy based on whether location is just provided literally or whether
>there's the opportunity to source it from a recognized operator within
>the PSAP catchment (and in the absence of any other mechanism such as
>ISP-signed PIDF-LO).
>
>Regulators wrestle with assumptions about interconnected VoIP providers
>but that's a PSTN hangover and not a basis for long term policy -
>especially relying on something as tenuous as whether such VoIP providers
>only hand out subscriptions to users with identity-verified credit cards.
>
>Cheers,
>Martin
>
>Richard L. Barnes
>The only obvious approaches that occur to me are CLI spoofing and lying
>on a VoIP provider's registration form (coincidentally, the same things
>that Wikipedia suggests).  But in the case I mention below, they say that
>the call was from "a non-valid number".
>
>Incidentally, the ECRIT equivalent of CLI spoofing is IP address spoofing
>(when the LIS is locating based on IP address).  So it might be worth
>referring to BCP 38 somewhere.
>
>--Richard
>
>
>

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 27 Jul 2011 12:25:32 +0800

What is the method by which somebody spoofs an IP address to fool an ISP LIS into giving them a PIDF-LO or location reference applicable to a different location? How would this be done?

Cheers,
Martin

-----Original Message-----
From: Marc Linsner [mailto:[email-masked]] 
Sent: Wednesday, 27 July 2011 12:40 PM
To: Dawson, Martin
Cc: [email-masked] Org
Subject: Re: [Ecrit] SWATting

Martin,

-Marc-

---

From: "Richard L. Barnes" <[email-masked]>
Date: Wed, 27 Jul 2011 01:11:12 -0400

I think risk is actually greater in the transition.  If you look at things like i2 and the NICC architecture, the user's IP address as seen by the outbound proxy is used as the key to look up location with the access network's LIS.  So if the caller spoofs the IP on his INVITE, the PSAP gets the wrong location.

--Richard

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 26 Jul 2011 22:32:40 -0700

If the PIDF-LO isn't signed, you can just make one up. 

Even if it is signed, for IP address spoofing with HELD, it is possible to obtain a PIDF-LO for another IP address if you are on the path from the fake source address to the LIS.   Possible, but not easy.

However, it is not necessary to spoof an IP address to obtain a (signed) PIDF-LO that can be (falsely) conveyed.  

You can have someone else obtain the (signed) PIDF-LO and give it to you to convey within SIP ('cut and paste'), or you can obtain a PIDF-LO, change your location and then convey it later (time-shifting). 

Even if the PIDF-LO is signed, and SIP uses RFC 4474, the 'cut and paste' attack still works, if the identity in the PIDF-LO is unlinkable to the SIP identity (e.g. From field). 

The time-shifting attack will work as long as the PIDF-LO timestamp is within the window checked by the PSAP. 

While the PSAP may not want to necessarily reject the incoming call, there is information that can be used in determining the "swatting" potential:

1. Checking the 'timestamp' field in the PIDF-LO against the SIP timestamp or the time at the PSAP;
2. Checking fields in the PIDF-LO (such as 'contact') against the identity in the SIP From: field;
3. Whether the PIDF-LO is signed; 
4. Checking aspects of the signing certificate (e.g. altSubjectName);
5. Whether SIP uses RFC 4474;

As was noted in the discussion, this is not only about 'trustworthy location' but also about accountability.  
If attackers feel confident that they will be held accountable (many are caught now, after all), they will be less likely to attempt these attacks.

We have seen this quite often with unauthenticated/unauthorized calling;  move from no SIM to a registered SIM (albeit with no balance) and voila, attacks decline. 

> From: [email-masked]
> To: [email-masked]
> Date: Wed, 27 Jul 2011 12:25:32 +0800
> CC: [email-masked]

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 26 Jul 2011 22:36:08 -0700

While LbyR helps with time-shifting attacks, the  'cut and paste' attack can still work, as will the IP address spoofing attack.  A collaborator can give you a PIDF-LO reference to include in your SIP message.  

From: [email-masked]
To: [email-masked]; [email-masked]
Date: Tue, 26 Jul 2011 22:32:40 -0700
CC: [email-masked]
Subject: Re: [Ecrit] SWATting

---

From: "Winterbottom, James" <[email-masked]>
Date: Wed, 27 Jul 2011 13:42:17 +0800

Comments inline.

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Bernard Aboba
Sent: Wednesday, 27 July 2011 3:33 PM
To: Dawson, Martin; [email-masked]
Cc: [email-masked]
Subject: Re: [Ecrit] SWATting

You can have someone else obtain the (signed) PIDF-LO and give it to you to convey within SIP ('cut and paste'), or you can obtain a PIDF-LO, change your location and then convey it later (time-shifting).
[AJW] This is a analogous to you lending me your phone to make an fraudulent emergency call though. In this case they will know where you were when you made the call.
If you look at the draft that Martin Thomson and I wrote on location signing some time ago, you will see that it provides a good way to a) link to the SIP identity if you it to, and b) stop the time shifting problem by including a timestamp over which the signature is based. Location by value need to be attributable to a specific device at a specific point in time.

The time-shifting attack will work as long as the PIDF-LO timestamp is within the window checked by the PSAP.
[AJW] this is true, but it does require some degree of collusion, and therefore requires some local footprint in order to achieve it.

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 27 Jul 2011 13:52:16 +0800

I agree with all of this. The "just make one up" was the point I was making about the danger of relying on basic literal PIDF-LO.

The cut and paste attack you refer to, nevertheless, still relies on the attacker having some sort of physical presence (themselves or from a proxy) at the location to be spoofed. This raises the bar very many notches from just being able to "make one up".

As we are both saying, this sort of information has major utility when it comes to the PSAP being able to apply effective policy to the incoming call. Location information would not have to be very old before it is considered suspicious or even not acceptable. Not that we currently have a specification for signing location - unless I missed something. There was a good draft a number of years ago that didn't progress. Currently, to my knowledge, all we have is location URI (which is a deferred way to get location assurance - with much the same properties as signing anyway).

I'm interested in just how easily/routinely the IP spoofing that is regularly referred to can actually be done. As you say, getting yourself in the path between the actual location and the ISP doesn't seem like such an easy thing.

You're right on the accountability thing. Also, going back to conventional circuit service cellular, there is good evidence in the difference in abuse levels related to SIMless phone use between places that have good mobile location and those that don't.

Cheers,
Martin

From: Bernard Aboba [mailto:[email-masked]]
Sent: Wednesday, 27 July 2011 3:33 PM
To: Dawson, Martin; [email-masked]
Cc: [email-masked]
Subject: RE: [Ecrit] SWATting

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 27 Jul 2011 05:15:13 -0700

Based on this thread, Hannes and I can formulate some text for review by the WG.  

From: [email-masked]
To: [email-masked]; [email-masked]
CC: [email-masked]
Date: Wed, 27 Jul 2011 13:52:16 +0800
Subject: RE: [Ecrit] SWATting

I agree with all of this. The “just make one up” was the point I was making about the danger of relying on basic literal PIDF-LO. The cut and paste attack you refer to, nevertheless, still relies on the attacker having some sort of physical presence (themselves or from a proxy) at the location to be spoofed. This raises the bar very many notches from just being able to “make one up”. As we are both saying, this sort of information has major utility when it comes to the PSAP being able to apply effective policy to the incoming call. Location information would not have to be very old before it is considered suspicious or even not acceptable. Not that we currently have a specification for signing location – unless I missed something. There was a good draft a number of years ago that didn’t progress. Currently, to my knowledge, all we have is location URI (which is a deferred way to get location assurance – with much the same properties as signing anyway). I’m interested in just how easily/routinely the IP spoofing that is regularly referred to can actually be done. As you say, getting yourself in the path between the actual location and the ISP doesn’t seem like such an easy thing. You’re right on the accountability thing. Also, going back to conventional circuit service cellular, there is good evidence in the difference in abuse levels related to SIMless phone use between places that have good mobile location and those that don’t. Cheers,Martin From: Bernard Aboba [mailto:[email-masked]] 
Sent: Wednesday, 27 July 2011 3:33 PM
To: Dawson, Martin; [email-masked]
Cc: [email-masked]
Subject: RE: [Ecrit] SWATting If the PIDF-LO isn't signed, you can just make one up.

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 27 Jul 2011 05:39:29 -0700

[BA]You
 can have someone else obtain the (signed) PIDF-LO and give it to you to
 convey within SIP ('cut and paste'), or you can obtain a PIDF-LO, 
change your location and then convey it later (time-shifting).

[AJW] This is a analogous to you lending me your phone to make an fraudulent emergency
call though. In this case they will know where you were when you made the call.
If
 you look at the draft that Martin Thomson and I wrote on location 
signing some time
ago, you will see that it provides a good way to a) link to the SIP 
identity if you it to, and b) stop the time shifting problem by 
including a timestamp over which the signature is based. Location by 
value need to be attributable to a specific device at a
specific point in time.

[BA]Linking to a specific device isn't enough to stop cut and paste attacks -- you need linkability between the PIDF-LO and the SIP Identity (e.g. 'contact').  A device identity doesn't necessarily provide this.

Multiple types of deception fit under the rubric of "swatting".  There is the enclosure of an invented, time-shifted or contact-shifted PIDF-LO in a SIP message from an authentic identity.  Then there is a forged SIP message which might contain a bogus or genuine PIDF-LO.  Then there are bogus claims (e.g. fire! fire!) transmitted via various media (voice, text, video, etc.), which could involve authentic/non-authentic SIP identities + bogus/genuine PIDF-LOs, etc.

[BA]Even if the PIDF-LO is signed, and SIP uses RFC 4474, the 'cut and 
paste' attack still works, if the identity in the PIDF-LO is unlinkable 
to the SIP identity (e.g. From field). 

The time-shifting attack will work as long as the PIDF-LO timestamp is within the window checked by the PSAP.
[AJW] this is true, but it does require some degree of collusion, and therefore requires
some local footprint in order to achieve it.

[BA] This attack may or may not involve collusion between individuals; the main characteristic is that it provides evidence of where someone was at one point in the past, not where the caller is at the time of the emergency call.  For example, when travelling at 60 mph, 10 minutes of elapsed time can put you 10 miles from the transmitted location.

---

From: John Lange <[email-masked]>
Date: Wed, 27 Jul 2011 13:57:27 -0500

Another swatting incident yesterday.

http://www.cbc.ca/news/technology/story/2011/07/27/bc-langley-swatting-911-hacker.html

"Cassidy says swatters can just as easily make it appear the call
comes from a target's home by using one of several spoofing companies
on the internet offering a free service allowing callers to choose
whatever number they want to show up on the caller ID."

John

---

From: John Lange <[email-masked]>
Date: Wed, 27 Jul 2011 15:27:57 -0500

The story says:

"In the Langley case, police said the call appeared to come from a
cell phone with a California area code."

So it would seem that they do indeed use callerID to some extent.

The story also says it was a "fake 911" call, but I wonder if that is
accurate? It would seem more likely that the call came in through a
traditional non-emergency 10 digit number which could be dialed from
anywhere. That would allow fake callerID and wouldn't have ANI.

The "911" trunks, on the other hand, are strictly local and would use
ANI, not callerID. Do PSAPs even display caller id?

Or maybe it's as simple as a cloned or stolen cell phone?

John