Subject: [Rucus] Review of David's RUCUS Problem Statement

From: Dan York <[email-masked]>
Date: Mon, 18 Feb 2008 19:14:20 -0500

Okay, so here are some comments about David's "problem statement" as  
shown here:

   http://www.ietf.org/internet-drafts/draft-schwartz-rucus-problem- 
statement-01.txt

First, I do think documents like this are useful to help us refine  
what it is we want to talk about at our meeting in Philadelphia, so  
thanks, David, for taking the time to write this.

Stepping through the document:

1. Introduction
===========
A couple of comments:
First, I don't know that I would characterize the attacks mentioned  
in RFC5039 only as "misrepresentation".  I view it as broader than  
that, but then I guess I have some issues with how you have  
characterized it (but more on that in a moment).

Second, you indicate that this document and by extension this WG/BOF  
is focusing on "all types of 'unwanted' commmunications".  Perhaps  
here is where we need to discuss drawing lines a bit further.   When  
we think of "SPIT" (or whatever you want to call it), who is the  
communication attacking? The human using the device?  Or the system?   
Or both?

When *I* think of "SPIT", I am thinking of unwanted calls that I (or  
the voicemail system or other apps receiving calls on my behalf)  
receive. I am not necessarily thinking of system probes (such as  
perhaps what you define as Data Mining).

Third, I've already commented on my view of "What should have been  
done earlier".

2. Unwanted Communication
=======================
When you say that solving the "misrepresentation" issue will "clearly  
not eliminate SPAM", I am not sure I follow you. Perhaps again we  
don't agree on what constitutes "SPAM".

Personally, I don't know that I would include "voice phishing" (THANK  
YOU for not giving in to the media and calling it "vishing"!) in a  
definition of SPIT/voice spam.  As you indicate, it is often brought  
about by email scams that entice someone to call a phone number where  
the listener then hears realistic prompts.  I agree this is a problem  
and I agree that with SIP there are undoubtedly things we could do to  
help with this.  I just don't know that it's something we should  
incorporate into the first round of "RUCUS".

It also goes back to my scoping question above - Reducing Unwanted  
Communications to *whom*?

Per your other note I assume that "underprivileged" was left in by  
mistake and will disappear from a future draft.

3. Data Mining
===========
I understand your rationale for including this, i.e. that an attacker  
could, for instance, query an ENUM server in preparation for a SPIT  
attack. Again I wonder if this is something we can address.  It does,  
though, probably fit in the framework of things to consider.

4. B-Side Attacks
=============
I don't personally like the name, as it doesn't seem to line up with  
anything else I've really heard in the security space.  Basically  
what you are defining would be better called "Voice Phishing".  As I  
stated above, it's not clear to me that this is a fit for the BOF or  
is getting too far out of scope.

5. Lack of Policy
=============
I understand what you are getting at here but I'm not sure naming the  
category "Lack of Policy" works.  I don't have a better suggestion  
right now... perhaps "Policy-related Attacks".  I don't know.  It's  
all about "policy", certainly.

I also agree that policy is subjective and needs to ultimately be  
under the recipient's control.  There may be days when I don't want  
to take any phone calls from unknown callers... and their may be  
other days when I'm in a chatty mood and willing to talk to  
absolutely anyone who calls.

6. Misrepresentation
================
Again, I'm not entirely comfortable lumping all of RFC 5039 under the  
heading of "Misrepresentation". I also think that if this is to be a  
"problem statement" for the BOF it should have some text in here  
about the attacks rather than simply referring to RFC5039.  Just a  
brief paragraph, perhaps, summarizing the category.

7. Regulatory
===========
Agreed this is something that does need to be thought of in the  
larger picture.

I need to think about this document a bit more and also think about  
what is missing. It seems to me there are some other categories of  
unwanted communication that aren't there, but right now they aren't  
jumping out at me.

Regards,
Dan
-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

_______________________________________________
Rucus mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/rucus