Subject: [Rucus] SIP scenarios similar to SPIT - Fwd: I-D Action:draft-york-sipping-spit-similarity-scenarios-00.txt

From: Dan York <[email-masked]>
Date: Mon, 18 Feb 2008 17:04:17 -0500

RUCUS members,

FYI, based on the feedback of a number of folks, I did submit a new  
version of this document today. It is still tagged -00 because this  
time I added the workgroup name to the file name (which I missed  
doing when I originally posted it as draft-york-spit-similarity- 
scenarios-00.txt):

     http://www.ietf.org/internet-drafts/draft-york-sipping-spit- 
similarity-scenarios-00.txt

It has, however, changed slightly from the first draft as I  
incorporated a few more scenarios suggested by people and also broke  
out the inbound scenarios a bit more.

Feedback is of course definitely welcome.  As we talk about potential  
architectures to address SPIT, my intent really is to highlight the  
fact that there are scenarios where legitimate SIP traffic might  
easily be mistaken for one form of SPIT.

Regards,
Dan

Begin forwarded message:

> From: [email-masked]
> Date: February 18, 2008 3:15:01 PM EST
> To: [email-masked]
> Subject: I-D Action:draft-york-sipping-spit-similarity- 
> scenarios-00.txt
> Reply-To: [email-masked]
>
> A New Internet-Draft is available from the on-line Internet-Drafts  
> directories.
>
> 	Title           : SIP Usage Scenarios Similar to SPIT
> 	Author(s)       : D. York
> 	Filename        : draft-york-sipping-spit-similarity-scenarios-00.txt
> 	Pages           : 11
> 	Date            : 2008-02-18
>
> This document outlines scenarios in which legitimate SIP traffic may
> appear similar to traffic associated with voice spam, also known as
> "SPIT" or "Spam for Internet Telephony.  This document is created to
> provide input into the current discussions about how best to address
> the issue of SPIT.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-york-sipping-spit- 
> similarity-scenarios-00.txt
>
> To remove yourself from the I-D Announcement list, send a message to
> [email-masked] with the word unsubscribe in the body of
> the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
>
> Internet-Drafts are also available by anonymous FTP. Login with the
> username "anonymous" and a password of your e-mail address. After
> logging in, type "cd internet-drafts" and then
> 	"get draft-york-sipping-spit-similarity-scenarios-00.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE /internet-drafts/draft-york-sipping-spit-similarity- 
> scenarios-00.txt".
>
> NOTE:   The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> Content-Type: text/plain
> Content-ID: <2008-02-18120051.I-D\@ietf.org>
>
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/i-d-announce

-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

_______________________________________________
Rucus mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rucus

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Feb 2008 09:24:45 +0200

Hi Dan,

I believe this is an interesting document since it challenges the 
capabilities of statistical learning algorithms some people have been 
excited about.

Ciao
Hannes

Dan York wrote:
> time I added the workgroup name to the file name (which I missed doing 
> when I originally posted it as 
> draft-york-spit-similarity-scenarios-00.txt):
>
>     
> http://www.ietf.org/internet-drafts/draft-york-sipping-spit-similarity-scenarios-00.txt 
>
>
>> Subject: I-D Action:draft-york-sipping-spit-similarity-scenarios-00.txt
>>     Filename        : 
>> draft-york-sipping-spit-similarity-scenarios-00.txt
>>     Pages           : 11
>>     Date            : 2008-02-18
>>
>> http://www.ietf.org/internet-drafts/draft-york-sipping-spit-similarity-scenarios-00.txt 
>>
>>
>>     "FILE 
>> /internet-drafts/draft-york-sipping-spit-similarity-scenarios-00.txt".
>>
> ------------------------------------------------------------------------
>

---

From: Otmar Lendl <[email-masked]>
Date: Tue, 19 Feb 2008 10:35:39 +0100

> capabilities of statistical learning algorithms some people have been 

I agree, this is a good contribution and a valuable reality-check.

Another thing which might throw a wrench into a lot of anti-spit ideas
(including mine) is the proliferation of bot-nets. In the email world,
these account for the majority of spam already and I wonder what they
could do to SIP.

/ol
-- 
-=-  Otmar Lendl  --  [email-masked]  -=-
_______________________________________________
Rucus mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rucus

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 19 Feb 2008 01:50:34 -0800

> > capabilities of statistical learning algorithms some people 
> > have been excited about.
> 

The computing power available to a botnet means that computational
puzzles (Section 3.9 of RFC5039) are ineffective -- the botnet itself
would be tasked with solving the computational puzzle.

If the computer itself is compromised (versus just having an 
unauthorized application running on it), then the user's identity
can be stolen.  A stolen identity would render some of the other 
RFC5039 techniques (reputation systems and white lists) less effective 
or ineffective.

-d

---

From: Dan York <[email-masked]>
Date: Tue, 19 Feb 2008 05:55:20 -0500

> I agree, this is a good contribution and a valuable reality-check.

Thank you both for your kind words.

> these account for the majority of spam already and I wonder what they

Yes, botnets certainly could add challenges. Proof-of-concept bots  
that focus entirely on SIP are also out there in the wild. I wrote  
about one (with a focus on the DDoS potential) back in May 2007 here:

http://voipsa.org/blog/2007/05/07/ready-or-not-here-come-the-irc- 
controlled-sipvoip-attack-bots/

Since that time I haven't personally seen any more work being exposed  
around SIP-related bots. (but then again, *would* I if the botherders  
are seriously about it? :-)  I don't know that the financial  
circumstances are there yet for a bot herder to move into the SIP  
space (i.e. there probably aren't enough SIP endpoints and trunks out  
there *yet* to merit moving into the space. More money can still be  
made in email spam or DDoS.)

I don't know that we need to be hugely concerned about botnets in  
your near-term thinking about combatting SPIT, but I do agree that  
any larger architecture we look at should consider the fact that  
massively distributed "attacks" of voice spam by botnets could at  
some point become a reality.  (and could indeed look like some of the  
scenarios I outlined in my document)

Regards,
Dan

---

From: "Martin Stiemerling" <[email-masked]>
Date: Tue, 19 Feb 2008 13:40:49 +0100

Hi, 

[...]
> 
> The computing power available to a botnet means that 
> computational puzzles (Section 3.9 of RFC5039) are 
> ineffective -- the botnet itself would be tasked with solving 
> the computational puzzle.
> 
> unauthorized application running on it), then the user's 
> identity can be stolen.  A stolen identity would render some 
> of the other
> RFC5039 techniques (reputation systems and white lists) less 
> effective or ineffective.

...which has been just reported today in  German networking/computer news. I have only the news report in German as I didn't find any English version yet (http://www.heise.de/newsticker/meldung/103711)

The report basically points out that email spammers have just climbed the brarrier of white lists and reputation systems. They are hacking in email accounts of regular users and use their accounts to send spam to others.

Just my 2 cents,

  Martin

[email-masked]   <== NEW ADDRESS

NEC Laboratories Europe - Network Research Division

NEC Europe Limited | Registered Office: NEC House, 1 Victoria Road, London W3 6BL | Registered in England 2832014 
_______________________________________________
Rucus mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rucus

---

From: "Saverio Niccolini" <[email-masked]>
Date: Tue, 19 Feb 2008 14:52:24 +0100

> I don't know that we need to be hugely concerned about 
> botnets in your near-term thinking about combatting SPIT, but 
> I do agree that any larger architecture we look at should 
> consider the fact that massively distributed "attacks" of 
> voice spam by botnets could at some point become a reality.  
> (and could indeed look like some of the scenarios I outlined 
> in my document)

I think we do need to be concerned about bot-nets. They are the main
source of email spam and they are the reason why many of us agree that
white list and reputation system are not enough for fighting SPIT.

Saverio

============================================================
Dr. Saverio Niccolini
Senior Researcher
NEC Laboratories Europe, Network Research Division	
Kurfuerstenanlage 36, D-69115 Heidelberg
Tel.     +49 (0)6221 4342-118
Fax:     +49 (0)6221 4342-155
e-mail:  [email-masked] <-- !!! NEW ADDRESS !!!
============================================================
NEC Europe Limited Registered Office: NEC House, 1 Victoria
Road, London W3 6BL Registered in England 2832014
_______________________________________________
Rucus mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rucus

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 19 Feb 2008 16:01:03 +0200

Botnets is the killer argument for almost all solutions.
I wouldn't therefore conclude that whitelists are useless.
What solution does help against botnets?

---

From: "Martin Stiemerling" <[email-masked]>
Date: Tue, 19 Feb 2008 15:03:48 +0100

+1.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Saverio Niccolini
> Sent: Tuesday, February 19, 2008 2:52 PM
> To: rucus BoF
> Subject: Re: [Rucus] SIP scenarios similar to SPIT -Fwd:I-D 
> Action:draft-york-sipping-spit-similarity-scenarios-00.txt
> 
> botnets in your 
> > near-term thinking about combatting SPIT, but I do agree that any 
> > larger architecture we look at should consider the fact 
> that massively 
> > distributed "attacks" of voice spam by botnets could at some point 
> > become a reality.
> > (and could indeed look like some of the scenarios I outlined in my 
> > document)
> 
> I think we do need to be concerned about bot-nets. They are 
> the main source of email spam and they are the reason why 
> many of us agree that white list and reputation system are 
> not enough for fighting SPIT.
> 
> Saverio
>

---

From: "Saverio Niccolini" <[email-masked]>
Date: Tue, 19 Feb 2008 15:03:49 +0100

Hannes and others,

> I believe this is an interesting document since it challenges 
> the capabilities of statistical learning algorithms some 
> people have been excited about.

I think there is a misunderstanding here, please read:
http://www.ietf.org/internet-drafts/draft-seedorf-sipping-spam-score-semantics-00.txt

it is not about statistical methods, the main reasons are others,
see section "2.1. Proposal motivation".

Saverio

---

From: "Martin Stiemerling" <[email-masked]>
Date: Tue, 19 Feb 2008 15:05:10 +0100

> Botnets is the killer argument for almost all solutions.

It is not a killer argument for all solutions but it is a serious threat that needs to be considered. I also don't see this as Saverion's point.

> I wouldn't therefore conclude that whitelists are useless.

Nobody did, but they are not enough anymore.

> What solution does help against botnets?

No idea yet.

  Martin

> >> some point become a reality.

---

From: Otmar Lendl <[email-masked]>
Date: Tue, 19 Feb 2008 15:56:32 +0100

On 2008/02/19 13:02, Martin Stiemerling <[email-masked]> wrote:
> 
> ...which has been just reported today in German networking/computer
> news. I have only the news report in German as I didn't find any
> English version yet (http://www.heise.de/newsticker/meldung/103711)
>
> The report basically points out that email spammers have just climbed
> the brarrier of white lists and reputation systems. They are hacking
> in email accounts of regular users and use their accounts to send spam
> to others.

Putting on my cynic's hat, this is actually a good development:

Up to now, a lot of people didn't care about whether their PC was
zombified and sending out spam, as it didn't affect their use of the
box. 

If the spammer are now really using the mail account of the user, then
the malware might no longer be that invisible to user. 

/ol

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 19 Feb 2008 11:16:09 -0800

> ...which has been just reported today in  German 
> networking/computer news. I have only the news report in 
> German as I didn't find any English version yet 
> (http://www.heise.de/newsticker/meldung/103711)

Between my smattering of German that I still remember and
some translation software, I got the gist of the attack.

> The report basically points out that email spammers have just 
> climbed the brarrier of white lists and reputation systems. 
> They are hacking in email accounts of regular users and use 
> their accounts to send spam to others.

The user's SMTP AUTH password is stored somewhere on their
system (inside their Outlook, Thunderbird, Outlook Express, Eudora,
or mail.app configuration).  So even a non-privileged application
running on the same system as the same user can probably get 
access to that password.  SIP would share the same weakness.

-d

---

From: Dan York <[email-masked]>
Date: Tue, 19 Feb 2008 14:21:21 -0500

Saverio,

I absolutely agree that we need to be concerned about botnets.   They  
absolutely need to be part of our thinking in terms of a larger  
architecture for addressing SPIT.

The point I was trying to make was that I personally don't want to  
see RUCUS turn into a "how do we deal with SIP botnets" forum and in  
so doing we get caught up in that and lose sight of threats that  
might be closer at hand.  To put it another way, I think we have to  
realize that botnets are out on the horizon, and we need to need to  
take those into account as we design our architecture, but there's  
probably a more real threat *today* from someone who installs  
Asterisk, downloads the "SPITTER" tool, sucks down a database via  
ENUM and starts making calls.

Ultimately we have to address both issues (the script-kiddie with  
SPITTER and the serious botnet) and we need to aim to arrive at an  
architecture that lets us address the full spectrum. (Whether or not  
that is achievable in an "architecture" is, of course, an open  
question.)

Regards,
Dan

---

From: "Saverio Niccolini" <[email-masked]>
Date: Tue, 19 Feb 2008 20:29:24 +0100

Dan,

I would be in principle fine with the wording:
"The architectural investigations should cover different threat
models, including those of compromised end hosts."

(where for compromised end-host we basically say bot-nets
installed on a legitimate host)

And also:
"The main goal of the group is to produce an
architecture document that outlines the interworking between
identified potential building blocks"

where some of these building blocks take into account how to REDUCE
unwanted communications even in the case of compomised end hosts.

Saverio

> From: Dan York [mailto:[email-masked]] 
> Sent: Tuesday, February 19, 2008 8:21 PM
> To: Saverio Niccolini
> Cc: rucus BoF
> Subject: Botnets... Re: [Rucus] SIP scenarios similar to SPIT 
> - Fwd:I-D Action:draft-york-sipping-spit-similarity-scenarios-00.txt
> 
> Saverio,
> 
> I absolutely agree that we need to be concerned about 
> botnets.   They absolutely need to be part of our thinking in 
> terms of a larger architecture for addressing SPIT.
> 
> The point I was trying to make was that I personally don't 
> want to see RUCUS turn into a "how do we deal with SIP 
> botnets" forum and in so doing we get caught up in that and 
> lose sight of threats that might be closer at hand.  To put 
> it another way, I think we have to realize that botnets are 
> out on the horizon, and we need to need to take those into 
> account as we design our architecture, but there's probably a 
> more real threat *today* from someone who installs Asterisk, 
> downloads the "SPITTER" tool, sucks down a database via ENUM 
> and starts making calls.
> 
> Ultimately we have to address both issues (the script-kiddie 
> with SPITTER and the serious botnet) and we need to aim to 
> arrive at an architecture that lets us address the full 
> spectrum. (Whether or not that is achievable in an 
> "architecture" is, of course, an open question.)
> 
> Regards,
> Dan
>