Subject: Re: [Rucus] Review of David's RUCUS Problem Statement

From: "David Schwartz" <[email-masked]>
Date: Mon, 10 Mar 2008 13:46:45 -0000

Hi Dan and sorry for the VERY late response to this...

inline...

On Feb 19, 2008, at 2:14 AM, Dan York wrote:

Okay, so here are some comments about David's "problem statement" as shown here:

  http://www.ietf.org/internet-drafts/draft-schwartz-rucus-problem-statement-01.txt

First, I do think documents like this are useful to help us refine what it is we want to talk about at our meeting in Philadelphia, so thanks, David, for taking the time to write this.

Stepping through the document:

1. Introduction
===========
A couple of comments:
First, I don't know that I would characterize the attacks mentioned in RFC5039 only as "misrepresentation".  I view it as broader than that, but then I guess I have some issues with how you have characterized it (but more on that in a moment).

DS: When I think of SPAM I think of EVIL and NAUGHTY with misrepresentation falling into the EVIL camp and calls at 2AM falling into the NAUGHTY one.  Upon re-reading 5039 I would agree that the types of threats that are being discussed there are more of the NAUGHTY kind and less of the EVIL kind.  The main focus is that with costs dropping to 0 bulk messaging is possible and hence the increase in the annoyance factor.  The caller is not necessarily "hiding" who he is and hence solutions such as white/black etc. will work.  Obviously the caller MAY be hiding his identity as well as bulk messaging but this is not necessarily the case and hence I would still not automatically put in the EVIL camp. 

EVIL == misrepresentation.

So I agree with your comment.

Second, you indicate that this document and by extension this WG/BOF is focusing on "all types of 'unwanted' commmunications".  Perhaps here is where we need to discuss drawing lines a bit further.   When we think of "SPIT" (or whatever you want to call it), who is the communication attacking? The human using the device?  Or the system?  Or both?

DS: I think we can agree that at this point we should focus ONLY on the human and leave the system for later.

When *I* think of "SPIT", I am thinking of unwanted calls that I (or the voicemail system or other apps receiving calls on my behalf) receive. I am not necessarily thinking of system probes (such as perhaps what you define as Data Mining).

DS: The probes were mentioned as a precursor to unwanted communications. In the scoping of the problem it is important that we look at unwanted communications from start to end and not just look at one point in the lifetime a a spammer. In order to SPAM you have to first find out who to spam. Ignoring the "mining" issue IMHO is potentially biasing the solution space.

Third, I've already commented on my view of "What should have been done earlier".

DS: noted

2. Unwanted Communication
=======================
When you say that solving the "misrepresentation" issue will "clearly not eliminate SPAM", I am not sure I follow you. Perhaps again we don't agree on what constitutes "SPAM".  

DS: As I said above, I just think we need to focus on both EVIL and NAUGHTY.

Personally, I don't know that I would include "voice phishing" (THANK YOU for not giving in to the media and calling it "vishing"!) in a definition of SPIT/voice spam.  As you indicate, it is often brought about by email scams that entice someone to call a phone number where the listener then hears realistic prompts.  I agree this is a problem and I agree that with SIP there are undoubtedly things we could do to help with this.  I just don't know that it's something we should incorporate into the first round of "RUCUS".

DS: The reason for this inclusion is that in essence it is the same problem only in reverse. Instead of a VoIP phone initiating the call (to a VoIP or PSTN number) the VoIP phone is terminating the call (from a VoIP or PSTN number). Again, in the scoping process I do not want to bias one direction over the other.

It also goes back to my scoping question above - Reducing Unwanted Communications to *whom*?

DS: Thats just it. Its not only TO but FROM as well

Per your other note I assume that "underprivileged" was left in by mistake and will disappear from a future draft.

DS: Yes - sorry for that unfortunate addition.

3. Data Mining
===========
I understand your rationale for including this, i.e. that an attacker could, for instance, query an ENUM server in preparation for a SPIT attack. Again I wonder if this is something we can address.  It does, though, probably fit in the framework of things to consider.

DS: I think so

4. B-Side Attacks
=============
I don't personally like the name, as it doesn't seem to line up with anything else I've really heard in the security space.  Basically what you are defining would be better called "Voice Phishing".  As I stated above, it's not clear to me that this is a fit for the BOF or is getting too far out of scope.

DS: The name can change - but as I discussed above I think we should have this in the scoping of the problem.

5. Lack of Policy
=============
I understand what you are getting at here but I'm not sure naming the category "Lack of Policy" works.  I don't have a better suggestion right now... perhaps "Policy-related Attacks".  I don't know.  It's all about "policy", certainly.

I also agree that policy is subjective and needs to ultimately be under the recipient's control.  There may be days when I don't want to take any phone calls from unknown callers... and their may be other days when I'm in a chatty mood and willing to talk to absolutely anyone who calls.

DS: Yes

6. Misrepresentation
================
Again, I'm not entirely comfortable lumping all of RFC 5039 under the heading of "Misrepresentation". I also think that if this is to be a "problem statement" for the BOF it should have some text in here about the attacks rather than simply referring to RFC5039.  Just a brief paragraph, perhaps, summarizing the category.

DS: Version 02 :(

7. Regulatory
===========
Agreed this is something that does need to be thought of in the larger picture.

I need to think about this document a bit more and also think about what is missing. It seems to me there are some other categories of unwanted communication that aren't there, but right now they aren't jumping out at me.

DS: Thanks for detailed input and sorry for late response :(

Regards,
Dan
-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     [email-masked]
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com

_______________________________________________
Rucus mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/rucus