Subject: [saag] FW: (1) Global Standards Symposium; (2) workshop on spoofing

From: Scott Mansfield <[email-masked]>
Date: Mon, 24 Mar 2014 13:04:57 +0000

Security Area in general and STIR in particular....

I have received a request for support from the ITU-T.  There is a workshop on caller ID spoofing during the ITU-T SG2 meeting on 2 June.  The ITU-T would like to have an introduction to STIR.  How would you like to handle this type of request?

Regards,
-scott.

From: Scholl, Reinhard [mailto:[email-masked]]
Sent: Monday, March 24, 2014 5:42 AM
To: Scott Mansfield
Cc: Jamoussi, Bilel; Ntoko, Alexander; Zhang, Jie
Subject: RE: (1) Global Standards Symposium; (2) workshop on spoofing

Scott,

Below pls find info on the spoofing workshop. Would an expert from the IETF STIR group be able to provide an introduction on activities and progress in the STIR group?

Reinhard

ITU workshop on caller ID spoofing at 2:30-5:30 PM of 2 June 2014, during the coming ITU-T SG2 meeting (28 May-6 June).

Caller ID spoofing can happen in cases of PSTN-PSTN, and with higher potential, in IP-PSTN, IP-IP, IP-PSTN-IP, as analyzed in draft-ietf-stir-threats-00.txt (http://tools.ietf.org/pdf/draft-ietf-stir-threats-00.pdf).

Attack Scenarios:

-          Impersonation, IP-PSTN
An attacker on the Internet uses a commercial WebRTC service to send
a call to the PSTN with a chosen calling party number. The service
contacts an Internet-to-PSTN gateway, which inserts the attacker's
chosen calling party number into the CPN field of an IAM. When the
IAM reaches the terminating telephone switch, the terminal renders
the attacker's chosen calling party number as the calling identity.

-          Impersonation, PSTN-PSTN
An attacker with a traditional PBX (connected to the PSTN through
ISDN) sends a Q.931 SETUP request with a chosen calling party number
which a service provider inserts into the corresponding SS7 calling
party number (CPN) field of a call setup message (IAM). When the IAM
reaches the endpoint switch, the terminal renders the attacker's
chosen calling party number as the calling identity.

-          Impersonation, IP-IP
An attacker with an IP phone sends a SIP request to an IP-enabled
voicemail service. The attacker puts a chosen calling party number
into the From header field value of the INVITE. When the INVITE
reaches the endpoint terminal, the terminal renders the attacker's
chosen calling party number as the calling identity.

-          Impersonation, IP-PSTN-IP
An attacker with an IP phone sends a SIP request to the telephone
number of a voicemail service, perhaps without even knowing that the
voicemail service is IP-based. The attacker puts a chosen calling
party number into the From header field value of the INVITE. The
attacker's INVITE reaches an Internet-to-PSTN gateway, which inserts
the attacker's chosen calling party number into the CPN of an IAM.
That IAM then traverses the PSTN until (perhaps after a call
forwarding) it reaches another gateway, this time back to the IP
realm, to an H.323 network. The PSTN-IP gateway puts takes the
calling party number in the IAM CPN field and puts it into the SETUP
request. When the SETUP reaches the endpoint terminal, the terminal
renders the attacker's chosen calling party number as the calling
identity.

From: Scott Mansfield [mailto:[email-masked]]
Sent: Tuesday, February 04, 2014 3:42 PM
To: Scholl, Reinhard
Cc: Johnson, Malcolm; Jamoussi, Bilel; Ntoko, Alexander
Subject: RE: (1) Global Standards Symposium; (2) workshop on spoofing

I  am still exploring that, but the leadership doesn't seem interested at this time.
Do you have more information on the workshop?

Regards,
-scott.

From: Scholl, Reinhard [mailto:[email-masked]]
Sent: Tuesday, February 04, 2014 1:24 AM
To: Scott Mansfield
Cc: Johnson, Malcolm; Jamoussi, Bilel; Ntoko, Alexander
Subject: RE: (1) Global Standards Symposium; (2) workshop on spoofing

Thanks Scott. Is there interest to pursue a joint ITU/IETF workshop on spoofing? Reinhard

From: Scott Mansfield [mailto:[email-masked]]
Sent: Monday, February 03, 2014 21:02
To: Scholl, Reinhard
Cc: Johnson, Malcolm; Jamoussi, Bilel; Ntoko, Alexander
Subject: RE: (1) Global Standards Symposium; (2) workshop on spoofing

Reinhard,

I have spoken with the COO of ISOC, the chair of the IETF, and the chair of the IAB and they are not interested in a GSS-like event in June.

If the situation changes, I will send an email.  I'm back in Geneva for the SG15 meeting if you would like to meet in person.

Regards,
-scott.

From: Scholl, Reinhard [mailto:[email-masked]]
Sent: Friday, January 31, 2014 1:59 PM
To: Scott Mansfield
Cc: Johnson, Malcolm; Jamoussi, Bilel; Ntoko, Alexander
Subject: (1) Global Standards Symposium; (2) workshop on spoofing

Hi Scott,

As we discussed during your stay mid-January, have you had a chance to inquire whether IETF would be interested in joining us for a Global Standards Symposium (tentatively 12 - 13 June 2014)?

And a further suggestion for collaboration: would IETF be interested in a joint ITU/IETF workshop on spoofing (tentatively 30 May 2014 during ITU-T Study Group 2)?

Best regards

Reinhard

---

From: Russ Housley <[email-masked]>
Date: Tue, 25 Mar 2014 02:29:05 -0400

I cannot add another trip to my schedule this June.  That said, I can help someone put together a set of slides.

Russ

On Mar 24, 2014, at 9:04 AM, Scott Mansfield wrote:

> Security Area in general and STIR in particular….
>  
> Caller ID spoofing can happen in cases of PSTN-PSTN, and with higher potential, in IP-PSTN, IP-IP, IP-PSTN-IP, as analyzed in draft-ietf-stir-threats-00.txt(http://tools.ietf.org/pdf/draft-ietf-stir-threats-00.pdf).
>  
> Attack Scenarios:
>  
> -          Impersonation, IP-PSTN
> contacts an Internet-to-PSTN gateway, which inserts the attacker’s
> the attacker’s chosen calling party number as the calling identity.
>  
> reaches the endpoint switch, the terminal renders the attacker’s
> reaches the endpoint terminal, the terminal renders the attacker’s
> attacker’s INVITE reaches an Internet-to-PSTN gateway, which inserts
> the attacker’s chosen calling party number into the CPN of an IAM.
> renders the attacker’s chosen calling party number as the calling
> identity.
>  
>  
>  
> I  am still exploring that, but the leadership doesn’t seem interested at this time.
> If the situation changes, I will send an email.  I’m back in Geneva for the SG15 meeting if you would like to meet in person.
>  
> Regards,
> -scott.
>  
>  
>  
> As we discussed during your stay mid-January, have you had a chance to inquire whether IETF would be interested in joining us for a Global Standards Symposium (tentatively 12 – 13 June 2014)?
>

---

From: Scott Brim <[email-masked]>
Date: Tue, 25 Mar 2014 09:03:02 -0400

> someone put together a set of slides.

Maybe _they_ should put together slides and ask for comments. There's
enough info available already.

---

From: Scott Mansfield <[email-masked]>
Date: Fri, 28 Mar 2014 09:28:01 +0000

I don't think it is an unreasonable request for the ITU-T to ask the IETF to talk about an IETF work item.  I would certainly feel more comfortable if IETF experts wrote and presented the information.

-scott.

-----Original Message-----
From: Scott Brim [mailto:[email-masked]] 
Sent: Tuesday, March 25, 2014 9:03 AM
To: Russ Housley
Cc: Scott Mansfield; Joel Halpern; David Sinicrope; [email-masked]; Leslie Daigle ([email-masked]); [email-masked]
Subject: Re: [saag] (1) Global Standards Symposium; (2) workshop on spoofing

On Tue, Mar 25, 2014 at 2:29 AM, Russ Housley <[email-masked]> wrote:
> I cannot add another trip to my schedule this June.  That said, I can 
> help someone put together a set of slides.
>
> Russ

Maybe _they_ should put together slides and ask for comments. There's enough info available already.