From housley@vigilsec.com Thu Jan 2 09:47:01 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA6761ADFE5 for ; Thu, 2 Jan 2014 09:47:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 54gYwLtTs2HW for ; Thu, 2 Jan 2014 09:47:00 -0800 (PST) Received: from odin.smetech.net (mail.smetech.net [209.135.209.4]) by ietfa.amsl.com (Postfix) with ESMTP id 18B641ADD02 for ; Thu, 2 Jan 2014 09:47:00 -0800 (PST) Received: from localhost (unknown [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id 883F39A423F for ; Thu, 2 Jan 2014 12:46:43 -0500 (EST) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id BaoSlmQUQIJo for ; Thu, 2 Jan 2014 12:46:42 -0500 (EST) Received: from [192.168.2.110] (pool-96-255-140-248.washdc.fios.verizon.net [96.255.140.248]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 041929A421F for ; Thu, 2 Jan 2014 12:46:42 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Thu, 2 Jan 2014 12:46:42 -0500 Message-Id: To: IETF STIR Mail List Mime-Version: 1.0 (Apple Message framework v1085) X-Mailer: Apple Mail (2.1085) Subject: [stir] WG Last Call on draft-ietf-stir-threats-00.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jan 2014 17:47:01 -0000 The authors have posted an updated Internet-Draft on the STIR threat = model. It can be found here: = http://www.ietf.org/id/draft-ietf-stir-threats-00.txt. Is this document ready for the STIR WG to pass to the IESG, requesting = publication as an Informational RFC? Please provide your input on this = mail list by end-of-business on 16 January 2014. If you have issues or = concerns, please tell us what changes to the document are necessary to = resolve them. Russ From internet-drafts@ietf.org Mon Jan 13 12:54:57 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61A4B1AE146; Mon, 13 Jan 2014 12:54:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zIVa_nrd_4Ny; Mon, 13 Jan 2014 12:54:56 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 00BC81AE18F; Mon, 13 Jan 2014 12:54:56 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.90.p2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140113205455.8578.75954.idtracker@ietfa.amsl.com> Date: Mon, 13 Jan 2014 12:54:55 -0800 Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-02.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jan 2014 20:54:57 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Telephone Identity Revisited Worki= ng Group of the IETF. Title : Secure Telephone Identity Problem Statement Authors : Jon Peterson Henning Schulzrinne Hannes Tschofenig Filename : draft-ietf-stir-problem-statement-02.txt Pages : 25 Date : 2014-01-13 Abstract: Over the past decade, Voice over IP (VoIP) systems based on SIP have replaced many traditional telephony deployments. Interworking VoIP systems with the traditional telephone network has reduced the overall security of calling party number and Caller ID assurances by granting attackers new and inexpensive tools to impersonate or obscure calling party numbers when orchestrating bulk commercial calling schemes, hacking voicemail boxes or even circumventing multi- factor authentication systems trusted by banks. Despite previous attempts to provide a secure assurance of the origin of SIP communications, we still lack of effective standards for identifying the calling party in a VoIP session. This document examines the reasons why providing identity for telephone numbers on the Internet has proven so difficult, and shows how changes in the last decade may provide us with new strategies for attaching a secure identity to SIP sessions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-stir-problem-statement-02 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-problem-statement-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From richard@shockey.us Wed Jan 15 06:57:29 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B75091AE36A for ; Wed, 15 Jan 2014 06:57:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.7 X-Spam-Level: X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-Kf4ecMvzgf for ; Wed, 15 Jan 2014 06:57:28 -0800 (PST) Received: from qproxy1.mail.unifiedlayer.com (qproxy1-pub.mail.unifiedlayer.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 41D4D1AE366 for ; Wed, 15 Jan 2014 06:57:28 -0800 (PST) Received: (qmail 28562 invoked by uid 0); 15 Jan 2014 21:57:15 -0000 Received: from unknown (HELO box462.bluehost.com) (74.220.219.62) by qproxy1.mail.unifiedlayer.com with SMTP; 15 Jan 2014 21:57:15 -0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-Type:MIME-Version:Message-ID:Date:Subject:To:From; bh=EcQNnn+LQKmDJR2PuZKAJPZMPJ95sLEgc/iwTWtvDU8=; b=ArUlOXrjRdE3wWnh4LVl5A9LMMm3SLnujFZ1I0bliVq1dVSO5kE5Hqdf5jgzBCNFFw7ZCchnH4PDumqr8Uybv5TBlv/qpiOZqr85XcacoKIS1WuFPKItkF6rGxdSJK8B; Received: from [173.79.179.104] (port=50307 helo=RSHOCKEYPC) by box462.bluehost.com with esmtpa (Exim 4.80) (envelope-from ) id 1W3Rg9-0001Nw-5k for stir@ietf.org; Wed, 15 Jan 2014 07:42:49 -0700 From: "Richard Shockey" To: Date: Wed, 15 Jan 2014 09:42:45 -0500 Message-ID: <00d601cf1200$0f439120$2dcab360$@shockey.us> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00D7_01CF11D6.266F0FC0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: Ac8R//AcneVVu5SlQAWiEmEveRe4GQ== Content-Language: en-us X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 173.79.179.104 authed with richard@shockey.us} Subject: [stir] FYI ... this may be of interest to folks on the list. X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jan 2014 14:57:29 -0000 This is a multipart message in MIME format. ------=_NextPart_000_00D7_01CF11D6.266F0FC0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit http://www.maawg.org/m3aawg-tackles-robocalls-and-other-telephony-threats-in dustry-wide-workshop-and-new-anti-abuse-sig On another point are we going to see some new drafts on 4474 before London? Richard Shockey Shockey Consulting Chairman of the Board of Directors SIP Forum PSTN Mobile: +1 703.593.2683 < mailto:richard(at)shockey.us> skype-linkedin-facebook: rshockey101 http//www.sipforum.org "Money is the answer, what is the question?" tm ------=_NextPart_000_00D7_01CF11D6.266F0FC0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

http://www.maawg.= org/m3aawg-tackles-robocalls-and-other-telephony-threats-industry-wide-wo= rkshop-and-new-anti-abuse-sig

 

On another = point are we going to see some new drafts on 4474 before London? =

 

 

 

Richard = Shockey
Shockey Consulting
Chairman of the Board of Directors SIP = Forum
PSTN Mobile: +1 703.593.2683
<mailto:richard(at)shockey.us>
skype= -linkedin-facebook: = rshockey101
http//www.sipforum.org

"Money is the answer, what is the question?" = tm

 

 

------=_NextPart_000_00D7_01CF11D6.266F0FC0-- From richard@shockey.us Mon Jan 20 12:17:41 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3ECA1A01F7 for ; Mon, 20 Jan 2014 12:17:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.7 X-Spam-Level: X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 506yp-SAxlWB for ; Mon, 20 Jan 2014 12:17:38 -0800 (PST) Received: from alt-proxy11.mail.unifiedlayer.com (alt-proxy11.mail.unifiedlayer.com [74.220.211.241]) by ietfa.amsl.com (Postfix) with SMTP id 7BFAA1A0169 for ; Mon, 20 Jan 2014 12:17:38 -0800 (PST) Received: (qmail 5994 invoked by uid 0); 20 Jan 2014 20:17:35 -0000 Received: from unknown (HELO box462.bluehost.com) (74.220.219.62) by oproxy16.mail.unifiedlayer.com with SMTP; 20 Jan 2014 20:17:35 -0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-Type:MIME-Version:Message-ID:Date:Subject:To:From; bh=zWI3vYq9nTaPAVxdw6zZO7BN/NjAZGeUXI1AXm0aC/8=; b=KwiqA5Y9su0oLJ70R8bhRdTU4Ft8kiTXg9kaK24i+SLEsYcn7J5iw0wEyOq3qMkt4b5br8okK18jWrOp97ryoebeD9RdHbuFQuT40j+1NBq880G2PPz0eiZtOS4gHNJf; Received: from [173.79.179.104] (port=55772 helo=RSHOCKEYPC) by box462.bluehost.com with esmtpa (Exim 4.80) (envelope-from ) id 1W5LHr-0006bc-M7 for stir@ietf.org; Mon, 20 Jan 2014 13:17:35 -0700 From: "Richard Shockey" To: Date: Mon, 20 Jan 2014 15:17:34 -0500 Message-ID: <002e01cf161c$a953f1e0$fbfbd5a0$@shockey.us> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002F_01CF15F2.C07E5F10" X-Mailer: Microsoft Outlook 15.0 Thread-Index: Ac8WHJ+Q1ZGqgDCbSYCU2Ufzrs9R+g== Content-Language: en-us X-Identified-User: {3286:box462.bluehost.com:shockeyu:shockey.us} {sentby:smtp auth 173.79.179.104 authed with richard@shockey.us} Subject: [stir] NIce article on Call Spoofing and Telephony DOS . X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jan 2014 20:17:41 -0000 This is a multipart message in MIME format. ------=_NextPart_000_002F_01CF15F2.C07E5F10 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit http://www.nytimes.com/2014/01/20/technology/swindlers-use-telephones-with-i nternets-tactics.html?&_r=0 Richard Shockey Shockey Consulting Chairman of the Board of Directors SIP Forum PSTN Mobile: +1 703.593.2683 < mailto:richard(at)shockey.us> skype-linkedin-facebook: rshockey101 http//www.sipforum.org "Money is the answer, what is the question?" tm ------=_NextPart_000_002F_01CF15F2.C07E5F10 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

http://www.nytimes.com/2014/01/20/technology/swindlers-= use-telephones-with-internets-tactics.html?&_r=3D0

Richard = Shockey
Shockey Consulting
Chairman of the Board of Directors SIP = Forum
PSTN Mobile: +1 703.593.2683
<mailto:richard(at)shockey.us>
skype= -linkedin-facebook: = rshockey101
http//www.sipforum.org

"Money is the answer, what is the question?" = tm

 

 

------=_NextPart_000_002F_01CF15F2.C07E5F10-- From rjsparks@nostrum.com Tue Jan 21 09:14:00 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40B861A03E7 for ; Tue, 21 Jan 2014 09:14:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.036 X-Spam-Level: X-Spam-Status: No, score=-1.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B_52q9Mwx9XU for ; Tue, 21 Jan 2014 09:13:59 -0800 (PST) Received: from shaman.nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id 039081A03D6 for ; Tue, 21 Jan 2014 09:13:58 -0800 (PST) Received: from unnumerable.local (pool-173-71-10-88.dllstx.fios.verizon.net [173.71.10.88]) (authenticated bits=0) by shaman.nostrum.com (8.14.3/8.14.3) with ESMTP id s0LHDwWh018546 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=OK) for ; Tue, 21 Jan 2014 11:13:58 -0600 (CST) (envelope-from rjsparks@nostrum.com) Message-ID: <52DEAAD5.2080103@nostrum.com> Date: Tue, 21 Jan 2014 11:13:57 -0600 From: Robert Sparks User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: stir@ietf.org References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Received-SPF: pass (shaman.nostrum.com: 173.71.10.88 is authenticated by a trusted mechanism) Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jan 2014 17:14:00 -0000 There have been no on-list responses to this last call. We're extending it through this Friday, Jan 24. Please let us know that you've reviewed this document and believe it is ready for publication, or if you have any issues that still need to be resolved. Capturing your review on list is important, even if it's just a "ready" note. RjS On 1/2/14, 11:46 AM, Russ Housley wrote: > The authors have posted an updated Internet-Draft on the STIR threat model. It can be found here: http://www.ietf.org/id/draft-ietf-stir-threats-00.txt. > > Is this document ready for the STIR WG to pass to the IESG, requesting publication as an Informational RFC? Please provide your input on this mail list by end-of-business on 16 January 2014. If you have issues or concerns, please tell us what changes to the document are necessary to resolve them. > > Russ > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From alex@bobotek.net Tue Jan 21 10:43:32 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DAD11A01C8 for ; Tue, 21 Jan 2014 10:43:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mvif9mU0ndll for ; Tue, 21 Jan 2014 10:43:27 -0800 (PST) Received: from qmta08.emeryville.ca.mail.comcast.net (qmta08.emeryville.ca.mail.comcast.net [IPv6:2001:558:fe2d:43:76:96:30:80]) by ietfa.amsl.com (Postfix) with ESMTP id C4FC91A01D5 for ; Tue, 21 Jan 2014 10:43:15 -0800 (PST) Received: from omta19.emeryville.ca.mail.comcast.net ([76.96.30.76]) by qmta08.emeryville.ca.mail.comcast.net with comcast id GfYg1n0051eYJf8A8ijFe4; Tue, 21 Jan 2014 18:43:15 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by omta19.emeryville.ca.mail.comcast.net with comcast id GijE1n00G4EJ4tY01ijEvT; Tue, 21 Jan 2014 18:43:15 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Tue, 21 Jan 2014 10:40:32 -0800 From: Alex Bobotek To: Robert Sparks , "stir@ietf.org" Date: Tue, 21 Jan 2014 10:43:15 -0800 Thread-Topic: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thread-Index: Ac8Wy8/28l/6jt+xQuCvgoGfm0WJgwACFHaw Message-ID: <4B1956260CD29F4A9622F00322FE0531EC8D239E95@BOBO1A.bobotek.net> References: <52DEAAD5.2080103@nostrum.com> In-Reply-To: <52DEAAD5.2080103@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20121106; t=1390329795; bh=ANjTKBKhBlMFwBjasqJnUfHoLGcv1k3qfH9dX6K9l3E=; h=Received:Received:Received:From:To:Date:Subject:Message-ID: Content-Type:MIME-Version; b=Re+mDXE8KANRjCpaYSk4cwxQkKWAXNSGEuT2RH2feoXX8X8IkJn6VNB39A3GvwnUd aaaDprEf/WEuTl9aVj/QaHQmd/Xbykz3BnaLkHa7iIVWS9mmbHzfvO5KJwXANQ4Or4 0VNLsYcqRYYoKO9WmSH5KSptlwW3CCI4Y5q93qL10CNdUEaDaSOwK9FtEfh1vL9Xrk RBf4yqMB3/t6xV1igsItH6Qtoelyqmu4NNeshgnGGTKmKED6N0sINPx+Ff0NgPOMto jDsmaY8ZR3jlpBAfqW4z455JHcs1+MDlofWcxDB2PHpOWVvQte6qw5yJEH2YEK0Cvw 0GmDl/iTJT8Ww== Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Jan 2014 18:43:32 -0000 Some comments on draft-ietf-stir-threats-00.txt: 1. Introduction: Remove the word "commercial". Not all schemes (e.g., so= me DoS schemes which may be enabled by falsifying ID) are commercial. 2. Scope: Question: Why are the identities of parties to the call out of= scope? It seems to me that this should be considered, at least in the int= erest of commonality between setup auth and connection endpoint auth. =20 3. Scope, last paragraph: Change "improve" to "improves" 4. 3.2, 2nd paragraph: Currently, most text spam comes from phones (not I= nternet) in many countries. But there's no need to correct it; just make t= he point that it can originate anywhere and be gatewayed to the other netwo= rks. Change "Almost always, these messages originate on the Internet, though they may ultimately reach endpoints over traditional telephone network protocols or the Internet. " to "Thes= e messages may originate and terminate on the Internet, cellular and/or traditional= telephony networks." 5. Attack Scenarios (or perhaps a new attack -- 3.3.): IMO it would be go= od to add a TDoS scenario in which obfuscation of caller (e.g., randomizati= on) complicates blocking. Blocklists and rate limits depend on secure iden= tity, typically caller but also calling network identity. 6. Should we also point to the need to authenticate the service provider? = We have in some ways explicitly stated that it's just the calling party th= at's to be authenticated. However, many of the proposals include authentic= ation of the originating service provider. For example, the crypto signing= of an INVITE by the originating service provider actually authenticates bo= th caller and service provider (SP). We should consider the fact that call= ing parties are using multiple service providers (i.e., there exists author= ized spoofing), and decide whether or not the origination service provider = should also be authenticated. IMO, it is extremely important to know the o= riginating SP, both to provide feedback to the SP and to block calls. It is= the originating SP that can most directly and drastically take action agai= nst an abusive caller. And if a service provider is negligent, compromised= or complicit, it may be necessary to take action against the service provi= der and/or all calls they originate. =20 Best Regards, Alex > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks > Sent: Tuesday, January 21, 2014 9:14 AM > To: stir@ietf.org > Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last > Call on draft-ietf-stir-threats-00.txt) >=20 > There have been no on-list responses to this last call. > We're extending it through this Friday, Jan 24. >=20 > Please let us know that you've reviewed this document and believe it is > ready for publication, or if you have any issues that still need to be re= solved. > Capturing your review on list is important, even if it's just a "ready" > note. >=20 > RjS >=20 >=20 > On 1/2/14, 11:46 AM, Russ Housley wrote: > > The authors have posted an updated Internet-Draft on the STIR threat > model. It can be found here: http://www.ietf.org/id/draft-ietf-stir-thre= ats- > 00.txt. > > > > Is this document ready for the STIR WG to pass to the IESG, requesting > publication as an Informational RFC? Please provide your input on this m= ail > list by end-of-business on 16 January 2014. If you have issues or concer= ns, > please tell us what changes to the document are necessary to resolve them= . > > > > Russ > > > > _______________________________________________ > > stir mailing list > > stir@ietf.org > > https://www.ietf.org/mailman/listinfo/stir >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From pp3129@att.com Fri Jan 24 09:42:00 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F1911A000B for ; Fri, 24 Jan 2014 09:42:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o-xfVRVEd0bl for ; Fri, 24 Jan 2014 09:41:58 -0800 (PST) Received: from nbfkord-smmo07.seg.att.com (nbfkord-smmo07.seg.att.com [209.65.160.93]) by ietfa.amsl.com (Postfix) with ESMTP id 22BA61A0006 for ; Fri, 24 Jan 2014 09:41:58 -0800 (PST) Received: from unknown [144.160.229.24] (EHLO alpi155.enaf.aldc.att.com) by nbfkord-smmo07.seg.att.com(mxl_mta-7.2.1-0) over TLS secured channel with ESMTP id 4e5a2e25.0.6331594.00-2366.16385674.nbfkord-smmo07.seg.att.com (envelope-from ); Fri, 24 Jan 2014 17:41:57 +0000 (UTC) X-MXL-Hash: 52e2a5e56ae183a0-bfc73a504c4bbf49191cf44ec1ae372ec392fbef Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id s0OHfu3X012782 for ; Fri, 24 Jan 2014 12:41:56 -0500 Received: from mlpi409.sfdc.sbc.com (mlpi409.sfdc.sbc.com [130.9.128.241]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id s0OHfo8k012738 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 24 Jan 2014 12:41:51 -0500 Received: from MISOUT7MSGHUBAE.ITServices.sbc.com (MISOUT7MSGHUBAE.itservices.sbc.com [130.9.129.149]) by mlpi409.sfdc.sbc.com (RSA Interceptor) for ; Fri, 24 Jan 2014 17:41:39 GMT Received: from MISOUT7MSGUSR9N.ITServices.sbc.com ([144.151.223.65]) by MISOUT7MSGHUBAE.ITServices.sbc.com ([130.9.129.149]) with mapi id 14.03.0174.001; Fri, 24 Jan 2014 12:41:38 -0500 From: "PFAUTZ, PENN L" To: "stir@ietf.org" Thread-Topic: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thread-Index: AQHPFswzPmQve3334EyWlPqXrUWSk5qUJQzA Date: Fri, 24 Jan 2014 17:41:38 +0000 Message-ID: <38726EDA2109264987B45E29E758C4D604CB02AB@MISOUT7MSGUSR9N.ITServices.sbc.com> References: <52DEAAD5.2080103@nostrum.com> In-Reply-To: <52DEAAD5.2080103@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.91.160.227] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-AnalysisOut: [v=2.0 cv=NvxmhbhJ c=1 sm=1 a=dhB6nF3YHL5t/Ixux6cINA==:17 a] X-AnalysisOut: [=R0RLumPgxsoA:10 a=ofMgfj31e3cA:10 a=-HdFQuizeNIA:10 a=BLc] X-AnalysisOut: [eEmwcHowA:10 a=kj9zAlcOel0A:10 a=zQP7CpKOAAAA:8 a=XIqpo32R] X-AnalysisOut: [AAAA:8 a=RSg0Iy5uW7oA:10 a=48vgC7mUAAAA:8 a=Ipcs9riiqiHl7N] X-AnalysisOut: [Vfd08A:9 a=CjuIK1q_8ugA:10 a=iE9YWIBck50A:10 a=lZB815dzVvQ] X-AnalysisOut: [A:10 a=JPD2Hp2MXcw0U4FL:21 a=jbPYxdE_12wSgZcd:21] X-Spam: [F=0.2000000000; CM=0.500; S=0.200(2010122901)] X-MAIL-FROM: X-SOURCE-IP: [144.160.229.24] Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jan 2014 17:42:00 -0000 I'd like to suggest a somewhat different taxonomy for the document: I think there is one basic threat: delivery of a calling number that the c= aller is not authorized to use. This threat enables two kinds of attacks building on that threat: -impersonation to hide caller identity (e.g., in support of robocalling) -impersonation of the specific identity associated with the calling number = (voicemail hacking, phishing) I think the " Endpoints" section might be better called "Targets" Section 4.1 on solution specific attacks either needs to be expanded with s= ufficient detail to be meaningful or else deleted before the document can b= ecome and RFC. Penn Pfautz AT&T Access Management +1-732-420-4962 -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks Sent: Tuesday, January 21, 2014 12:14 PM To: stir@ietf.org Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last C= all on draft-ietf-stir-threats-00.txt) There have been no on-list responses to this last call. We're extending it through this Friday, Jan 24. Please let us know that you've reviewed this document and believe it is ready for publication, or if you have any issues that still need to be resolved. Capturing your review on list is important, even if it's just a "ready" note. RjS On 1/2/14, 11:46 AM, Russ Housley wrote: > The authors have posted an updated Internet-Draft on the STIR threat mode= l. It can be found here: http://www.ietf.org/id/draft-ietf-stir-threats-00= .txt. > > Is this document ready for the STIR WG to pass to the IESG, requesting pu= blication as an Informational RFC? Please provide your input on this mail = list by end-of-business on 16 January 2014. If you have issues or concerns= , please tell us what changes to the document are necessary to resolve them= . > > Russ > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir From internet-drafts@ietf.org Fri Jan 24 18:47:05 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 113F81A0462; Fri, 24 Jan 2014 18:47:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QF_siyJX3RmM; Fri, 24 Jan 2014 18:47:03 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 542121A0195; Fri, 24 Jan 2014 18:47:03 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.90.p2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140125024703.13804.86803.idtracker@ietfa.amsl.com> Date: Fri, 24 Jan 2014 18:47:03 -0800 Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-03.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jan 2014 02:47:05 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Telephone Identity Revisited Worki= ng Group of the IETF. Title : Secure Telephone Identity Problem Statement Authors : Jon Peterson Henning Schulzrinne Hannes Tschofenig Filename : draft-ietf-stir-problem-statement-03.txt Pages : 25 Date : 2014-01-24 Abstract: Over the past decade, Voice over IP (VoIP) systems based on SIP have replaced many traditional telephony deployments. Interworking VoIP systems with the traditional telephone network has reduced the overall security of calling party number and Caller ID assurances by granting attackers new and inexpensive tools to impersonate or obscure calling party numbers when orchestrating bulk commercial calling schemes, hacking voicemail boxes or even circumventing multi- factor authentication systems trusted by banks. Despite previous attempts to provide a secure assurance of the origin of SIP communications, we still lack of effective standards for identifying the calling party in a VoIP session. This document examines the reasons why providing identity for telephone numbers on the Internet has proven so difficult, and shows how changes in the last decade may provide us with new strategies for attaching a secure identity to SIP sessions. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-stir-problem-statement-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-stir-problem-statement-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From jon.peterson@neustar.biz Fri Jan 24 18:47:57 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8F6D1A0462 for ; Fri, 24 Jan 2014 18:47:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.301 X-Spam-Level: X-Spam-Status: No, score=-104.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oKAADb6a3LBg for ; Fri, 24 Jan 2014 18:47:55 -0800 (PST) Received: from neustar.com (mx1.neustar.com [156.154.17.104]) by ietfa.amsl.com (Postfix) with ESMTP id 7CC631A0195 for ; Fri, 24 Jan 2014 18:47:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.biz; s=neustarbiz; t=1390618224; x=1705973888; q=dns/txt; h=From:Subject:Date:Message-ID:Content-Language: Content-Type:Content-ID:Content-Transfer-Encoding; bh=HeMEnFzAwQ r0C8kxgXkDC9zajsRxXgpthwXvKFpKBlk=; b=lNMdJn6JTSoxcJrhkcp+s0r/xG WhkFmi33jilLSS8JEYRwbiQ+dwPC65KKc04Mzhrzf2uY5Z/vWPN9Wj+XE0Gg== Received: from ([10.31.58.70]) by stihiron2.va.neustar.com with ESMTP with TLS id J041124103.40032974; Fri, 24 Jan 2014 21:50:23 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.252]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0158.001; Fri, 24 Jan 2014 21:47:46 -0500 From: "Peterson, Jon" To: "PFAUTZ, PENN L" , "stir@ietf.org" Thread-Topic: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thread-Index: AQHPFsw1C9NVVD282kaYpPqfGIZxZZqUfUoAgAASdIA= Date: Sat, 25 Jan 2014 02:47:45 +0000 Message-ID: References: <52DEAAD5.2080103@nostrum.com> <38726EDA2109264987B45E29E758C4D604CB02AB@MISOUT7MSGUSR9N.ITServices.sbc.com> In-Reply-To: <38726EDA2109264987B45E29E758C4D604CB02AB@MISOUT7MSGUSR9N.ITServices.sbc.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.9.131030 x-originating-ip: [192.168.128.165] x-ems-proccessed: R64IxjzeHPwwd+efoj3ZcA== x-ems-stamp: tPseNlNcLpLjr4abwGsItw== Content-Type: text/plain; charset="iso-8859-1" Content-ID: <9F8E277423B7EE4193E21EF0DE5FFD69@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jan 2014 02:47:57 -0000 >I'd like to suggest a somewhat different taxonomy for the document: Thanks for these notes, Penn. >I think there is one basic threat: delivery of a calling number that the >caller is not authorized to use. >This threat enables two kinds of attacks building on that threat: >-impersonation to hide caller identity (e.g., in support of robocalling) >-impersonation of the specific identity associated with the calling >number (voicemail hacking, phishing) I went through a spin on this document already with Steve Kent about what should be considered an =B3attack=B2 versus a =B3threat=B2 versus what have= you. I take it in the security community these are terms with a particular meaning, and I tried to bring the text here into conformance with his guidance. I don=B9t think we=B9d say the =B3threat=B2 is the delivery of th= e calling number in that fashion; that=B9s a technique used by attackers to accomplish their attacks. >I think the " Endpoints" section might be better called "Targets" In the architecture that the Actors section describes, endpoints originate calls and receive them, and so necessarily originators of calls aren=B9t in that sense =B3targets.=B2 There goal of the Actors section is to explain wh= o the all parties are that originate, forward, and receive calls, just so the Attacks and Attack Scenarios can refer to these. >Section 4.1 on solution specific attacks either needs to be expanded with >sufficient detail to be meaningful or else deleted before the document >can become and RFC. Here, agreed. I don=B9t want to lose those bullet points though; maybe the right thing to do is to just say that these points are out of scope, but that future work should remember to consider issues like these. Jon Peterson Neustar, Inc. >Penn Pfautz >AT&T Access Management >+1-732-420-4962 > >-----Original Message----- >From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks >Sent: Tuesday, January 21, 2014 12:14 PM >To: stir@ietf.org >Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last >Call on draft-ietf-stir-threats-00.txt) > >There have been no on-list responses to this last call. >We're extending it through this Friday, Jan 24. > >Please let us know that you've reviewed this document and believe it is >ready for publication, or if you have any issues that still need to be >resolved. >Capturing your review on list is important, even if it's just a "ready" >note. > >RjS > > >On 1/2/14, 11:46 AM, Russ Housley wrote: >> The authors have posted an updated Internet-Draft on the STIR threat >>model. It can be found here: >>http://www.ietf.org/id/draft-ietf-stir-threats-00.txt. >> >> Is this document ready for the STIR WG to pass to the IESG, requesting >>publication as an Informational RFC? Please provide your input on this >>mail list by end-of-business on 16 January 2014. If you have issues or >>concerns, please tell us what changes to the document are necessary to >>resolve them. >> >> Russ >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From alex@bobotek.net Fri Jan 24 19:36:55 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73B9A1A0211 for ; Fri, 24 Jan 2014 19:36:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NsJQqwoOewai for ; Fri, 24 Jan 2014 19:36:52 -0800 (PST) Received: from qmta15.emeryville.ca.mail.comcast.net (qmta15.emeryville.ca.mail.comcast.net [IPv6:2001:558:fe2d:44:76:96:27:228]) by ietfa.amsl.com (Postfix) with ESMTP id 396191A010F for ; Fri, 24 Jan 2014 19:36:52 -0800 (PST) Received: from omta01.emeryville.ca.mail.comcast.net ([76.96.30.11]) by qmta15.emeryville.ca.mail.comcast.net with comcast id J37w1n0050EPchoAF3cfFr; Sat, 25 Jan 2014 03:36:39 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by omta01.emeryville.ca.mail.comcast.net with comcast id J3cp1n0044EJ4tY8M3cp1v; Sat, 25 Jan 2014 03:36:50 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Fri, 24 Jan 2014 19:33:52 -0800 From: Alex Bobotek To: "stir@ietf.org" Date: Fri, 24 Jan 2014 19:36:48 -0800 Thread-Topic: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thread-Index: AQHPFsw1C9NVVD282kaYpPqfGIZxZZqP14KAgAS4OwCAADgTQA== Message-ID: <4B1956260CD29F4A9622F00322FE0531EC8D239EB7@BOBO1A.bobotek.net> References: <52DEAAD5.2080103@nostrum.com> <4B1956260CD29F4A9622F00322FE0531EC8D239E95@BOBO1A.bobotek.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20121106; t=1390620999; bh=2BPOFkcM2l17RadQXfEDADVVTUtZTKN92SQewa41yNw=; h=Received:Received:Received:From:To:Date:Subject:Message-ID: Content-Type:MIME-Version; b=LM3Ro0V4nNMf+kedQI5VymeTIPyi68ht+lT2ZH3iZeD+hDSwo/EMVlOpt8pXLJZ9E AS4AjA0KFtutJrsTtI4qx1gzhnXD+XVzw9hOizUUa9W/DAwyGuB6Krb4GdF6s2Ggou R5Q/LfvrZ2ur/GaatPQg3BxygtyICORzfUzC5O9ujTnlY7VmS3lBHPNzKY1phKF1Aw BPdX4IimKL0hY+cXu9OthiE4A4qHy5YTn55jC+hDVH7HKpMaAgScrD1k+ZlGeFcYIk wfZT7K1OacruqfOCH/RkejUgV0FrUFIGj3YyW9WoZHotL5w9SxXbsBoj1oCtB6QDQT jzwc+2FanZHTw== Subject: [stir] FW: WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jan 2014 03:36:55 -0000 Jon, Thanks much for the response. =20 Some clarifications and response to it:=20 On comment #4, most text spam comes from cellular devices (i.e., devices wi= th prepaid SIMs in them); it would be incorrect to say that it usually come= s from the Internet. =20 Jon and others: =20 On comment #6: much of the abuse we see today involves unauthorized spoofi= ng of an identity issued by one service provider on calls originating from = a different service provider (SP). While there are some solutions (e.g., d= elegation of authority chains) that could probably address much of this wit= hout identifying the originating service provider, knowing the originating = SP has proven to be extremely useful in TDoS and robocall defense. For exa= mple, there are many cases in which a TDoS victim may wish to block all cal= ls from specific service providers. Additionally, complaints can be direct= ed to the correct SP. Since the same calling party ID may be used in origi= nating calls from multiple service providers (legitimately in addition to i= llegitimately), knowing the originating service provider may be necessary f= or some optimal defense mechanisms. Some solutions, such as SP crypto-sign= ing of INVITEs authenticate both SP and caller. Personally, I believe that= managing robocalls and TDoS requires a mechanism for securely identifying = the originating SP, as the originating SP may need to take some action (e.g= ., neutralizing accounts that are participating in DoS). The operational n= eed for SP identification exists. I feel it's best to at least mention and= consider this, but possibly not _require_ it in a solution. =20 I hope this helps. Regards, Alex -----Original Message----- From: Peterson, Jon [mailto:jon.peterson@neustar.biz]=20 Sent: Friday, January 24, 2014 6:48 PM To: Alex Bobotek; Robert Sparks; stir@ietf.org Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG La= st Call on draft-ietf-stir-threats-00.txt) Thanks for these notes Alex: >1. Introduction: Remove the word "commercial". Not all schemes=20 >(e.g., some DoS schemes which may be enabled by falsifying ID) are commerc= ial. The word =B3commercial=B2 there applies to one of three listed scenarios, a= ll of which are just examples. Mentioning bulk commercial calling schemes d= oes not exclude the possibility that the solution here would be relevant to= TDoS attacks of various kinds. >2. Scope: Question: Why are the identities of parties to the call=20 >out of scope? It seems to me that this should be considered, at least=20 >in the interest of commonality between setup auth and connection endpoint = auth. Long story, but the most important reason is because our motivating cases h= ere are robocalling and voicemail hacking, and solving connected identity i= s not required for either of those problems. Authenticating who you connect= to is also a difficult problem to solve because in many cases, the origina= tor of a call can=B9t know for sure who a call is supposed to reach, thanks= to forwarding and related conditions. There is a SIP solution for this (c= onnected identity, RFC4916), but it adds some significant complexity, and u= ltimately it=B9s not clear how often it would be useful. >3. Scope, last paragraph: Change "improve" to "improves" Done. >4. 3.2, 2nd paragraph: Currently, most text spam comes from phones=20 >(not >Internet) in many countries. But there's no need to correct it; just=20 >make the point that it can originate anywhere and be gatewayed to the=20 >other networks. Change "Almost always, these messages > originate on the Internet, though they may ultimately reach endpoints > over traditional telephone network protocols or the Internet. " to=20 >"These messages > may originate and terminate on the Internet, cellular and/or=20 >traditional telephony networks." I=B9m not sure what you mean when you say text spam comes from phones. Surely you don=B9t mean literally from people thumbing these texts in repea= tedly? I=B9ll change =B3almost always=B2 to =B3usually,=B2 though, if that helps. >5. Attack Scenarios (or perhaps a new attack -- 3.3.): IMO it would=20 >be good to add a TDoS scenario in which obfuscation of caller (e.g., >randomization) complicates blocking. Blocklists and rate limits depend=20 >on secure identity, typically caller but also calling network identity. I=B9d be happy to add a TDoS attack; I think that would be under Attacks an= d not Attack Scenarios. That would require some new text. The problem-state= ment does already allude (twice) to TDoS attacks. I can put some thoughts t= ogether, but definitely any text people feel like sending would be welcome. >6. Should we also point to the need to authenticate the service=20 >provider? We have in some ways explicitly stated that it's just the=20 >calling party that's to be authenticated. However, many of the=20 >proposals include authentication of the originating service provider. =20 >For example, the crypto signing of an INVITE by the originating service=20 >provider actually authenticates both caller and service provider (SP). =20 >We should consider the fact that calling parties are using multiple=20 >service providers (i.e., there exists authorized spoofing), and decide=20 >whether or not the origination service provider should also be=20 >authenticated. IMO, it is extremely important to know the originating=20 >SP, both to provide feedback to the SP and to block calls. It is the=20 >originating SP that can most directly and drastically take action=20 >against an abusive caller. And if a service provider is negligent,=20 >compromised or complicit, it may be necessary to take action against=20 >the service provider and/or all calls th ey originate. Again, if the scope of the work here is preventing robocalling and voicemai= l hacking (and well, okay, helping create greater accountability for TDoS),= I=B9m not sure how authenticating the service provider is on our plate as = a problem. The degree to which a service provider vouches for a call is kin= d of solution-specific: it may be relevant to some in-band approaches, and = not others; unclear how relevant it would be to out-of-band approaches. It = is not in an meaningful sense a primary goal of this work for service provi= ders to authenticate themselves to users, I think. Certainly service provid= ers will play a role in some solutions, and reporting problems to a service= provider will as well just as it does in a pre-STIR environment >Best Regards, Thanks again, Jon Peterson Neustar, Inc. >Alex > > >> -----Original Message----- >> From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks >> Sent: Tuesday, January 21, 2014 9:14 AM >> To: stir@ietf.org >> Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG=20 >>Last Call on draft-ietf-stir-threats-00.txt) >>=20 >> There have been no on-list responses to this last call. >> We're extending it through this Friday, Jan 24. >>=20 >> Please let us know that you've reviewed this document and believe it=20 >>is ready for publication, or if you have any issues that still need=20 >>to be resolved. >> Capturing your review on list is important, even if it's just a "ready" >> note. >>=20 >> RjS >>=20 >>=20 >> On 1/2/14, 11:46 AM, Russ Housley wrote: >> > The authors have posted an updated Internet-Draft on the STIR=20 >> > threat >> model. It can be found here: >>http://www.ietf.org/id/draft-ietf-stir-threats- >> 00.txt. >> > >> > Is this document ready for the STIR WG to pass to the IESG,=20 >> > requesting >> publication as an Informational RFC? Please provide your input on=20 >>this mail list by end-of-business on 16 January 2014. If you have=20 >>issues or concerns, please tell us what changes to the document are=20 >>necessary to resolve them. >> > >> > Russ >> > >> > _______________________________________________ >> > stir mailing list >> > stir@ietf.org >> > https://www.ietf.org/mailman/listinfo/stir >>=20 >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From rjsparks@nostrum.com Sat Jan 25 14:40:12 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 630B11A00A4 for ; Sat, 25 Jan 2014 14:40:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.036 X-Spam-Level: X-Spam-Status: No, score=-1.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LGQ-NwbgJQ5k for ; Sat, 25 Jan 2014 14:40:11 -0800 (PST) Received: from shaman.nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id 286051A003C for ; Sat, 25 Jan 2014 14:40:10 -0800 (PST) Received: from unnumerable.local (pool-173-71-10-88.dllstx.fios.verizon.net [173.71.10.88]) (authenticated bits=0) by shaman.nostrum.com (8.14.3/8.14.3) with ESMTP id s0PMe85g055027 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=OK) for ; Sat, 25 Jan 2014 16:40:09 -0600 (CST) (envelope-from rjsparks@nostrum.com) Message-ID: <52E43D43.5080502@nostrum.com> Date: Sat, 25 Jan 2014 16:40:03 -0600 From: Robert Sparks User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: stir@ietf.org References: <20140125024703.13804.86803.idtracker@ietfa.amsl.com> In-Reply-To: <20140125024703.13804.86803.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Received-SPF: pass (shaman.nostrum.com: 173.71.10.88 is authenticated by a trusted mechanism) Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-03.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jan 2014 22:40:12 -0000 I've requested publication of this version of the document. RjS On 1/24/14, 8:47 PM, internet-drafts@ietf.org wrote: > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Secure Telephone Identity Revisited Working Group of the IETF. > > Title : Secure Telephone Identity Problem Statement > Authors : Jon Peterson > Henning Schulzrinne > Hannes Tschofenig > Filename : draft-ietf-stir-problem-statement-03.txt > Pages : 25 > Date : 2014-01-24 > > Abstract: > Over the past decade, Voice over IP (VoIP) systems based on SIP have > replaced many traditional telephony deployments. Interworking VoIP > systems with the traditional telephone network has reduced the > overall security of calling party number and Caller ID assurances by > granting attackers new and inexpensive tools to impersonate or > obscure calling party numbers when orchestrating bulk commercial > calling schemes, hacking voicemail boxes or even circumventing multi- > factor authentication systems trusted by banks. Despite previous > attempts to provide a secure assurance of the origin of SIP > communications, we still lack of effective standards for identifying > the calling party in a VoIP session. This document examines the > reasons why providing identity for telephone numbers on the Internet > has proven so difficult, and shows how changes in the last decade may > provide us with new strategies for attaching a secure identity to SIP > sessions. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement/ > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-stir-problem-statement-03 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-stir-problem-statement-03 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From pp3129@att.com Sun Jan 26 07:42:22 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 182151A0149 for ; Sun, 26 Jan 2014 07:42:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.735 X-Spam-Level: X-Spam-Status: No, score=-4.735 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NdOHwBK1Mm9o for ; Sun, 26 Jan 2014 07:42:20 -0800 (PST) Received: from nbfkord-smmo05.seg.att.com (nbfkord-smmo05.seg.att.com [209.65.160.92]) by ietfa.amsl.com (Postfix) with ESMTP id DAC861A00CA for ; Sun, 26 Jan 2014 07:42:19 -0800 (PST) Received: from unknown [144.160.229.24] (EHLO alpi155.enaf.aldc.att.com) by nbfkord-smmo05.seg.att.com(mxl_mta-7.2.1-0) over TLS secured channel with ESMTP id adc25e25.0.74168.00-2189.200921.nbfkord-smmo05.seg.att.com (envelope-from ); Sun, 26 Jan 2014 15:42:18 +0000 (UTC) X-MXL-Hash: 52e52cda6b927e7d-019357cf29837fe07fccbe88a5cb2d0723f28fd6 Received: from enaf.aldc.att.com (localhost [127.0.0.1]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id s0QFgHH4030544; Sun, 26 Jan 2014 10:42:17 -0500 Received: from mlpi407.sfdc.sbc.com (mlpi407.sfdc.sbc.com [130.9.128.239]) by alpi155.enaf.aldc.att.com (8.14.5/8.14.5) with ESMTP id s0QFg9Fe030510 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 26 Jan 2014 10:42:12 -0500 Received: from MISOUT7MSGHUB9D.ITServices.sbc.com (MISOUT7MSGHUB9D.itservices.sbc.com [144.151.223.93]) by mlpi407.sfdc.sbc.com (RSA Interceptor); Sun, 26 Jan 2014 15:41:59 GMT Received: from MISOUT7MSGUSR9N.ITServices.sbc.com ([144.151.223.65]) by MISOUT7MSGHUB9D.ITServices.sbc.com ([144.151.223.93]) with mapi id 14.03.0174.001; Sun, 26 Jan 2014 10:41:58 -0500 From: "PFAUTZ, PENN L" To: "'Peterson, Jon'" , "stir@ietf.org" Thread-Topic: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thread-Index: AQHPFswzPmQve3334EyWlPqXrUWSk5qUJQzAgADw04CAAhYFgA== Date: Sun, 26 Jan 2014 15:41:57 +0000 Message-ID: <38726EDA2109264987B45E29E758C4D604CB099A@MISOUT7MSGUSR9N.ITServices.sbc.com> References: <52DEAAD5.2080103@nostrum.com> <38726EDA2109264987B45E29E758C4D604CB02AB@MISOUT7MSGUSR9N.ITServices.sbc.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [135.70.199.70] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-RSA-Inspected: yes X-RSA-Classifications: public X-AnalysisOut: [v=2.0 cv=Xck+OvF5 c=1 sm=1 a=dhB6nF3YHL5t/Ixux6cINA==:17 a] X-AnalysisOut: [=R0RLumPgxsoA:10 a=ofMgfj31e3cA:10 a=p1pXL3tZhh0A:10 a=BLc] X-AnalysisOut: [eEmwcHowA:10 a=8nJEP1OIZ-IA:10 a=zQP7CpKOAAAA:8 a=XIqpo32R] X-AnalysisOut: [AAAA:8 a=RSg0Iy5uW7oA:10 a=hGBaWAWWAAAA:8 a=48vgC7mUAAAA:8] X-AnalysisOut: [ a=UNm46Augf8m17lSrxjkA:9 a=wPNLvfGTeEIA:10 a=iE9YWIBck50A] X-AnalysisOut: [:10 a=lZB815dzVvQA:10 a=3hd6L0sVstZjxG_m:21 a=1kz2vTiCW0Lr] X-AnalysisOut: [76QZ:21] X-Spam: [F=0.2000000000; CM=0.500; S=0.200(2010122901)] X-MAIL-FROM: X-SOURCE-IP: [144.160.229.24] Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jan 2014 15:42:22 -0000 Thanks, Jon I'll defer to you on terminology. I do think that the attack sections 3.1 a= nd 3.2 should be made more generic along the lines I suggest: -impersonation to hide caller identity (e.g., in support of robocalling) -impersonation of the specific identity associated with the calling number = (voicemail hacking, phishing) Penn Pfautz AT&T Access Management +1-732-420-4962 -----Original Message----- From: Peterson, Jon [mailto:jon.peterson@neustar.biz] Sent: Friday, January 24, 2014 9:48 PM To: PFAUTZ, PENN L; stir@ietf.org Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG La= st Call on draft-ietf-stir-threats-00.txt) >I'd like to suggest a somewhat different taxonomy for the document: Thanks for these notes, Penn. >I think there is one basic threat: delivery of a calling number that the >caller is not authorized to use. >This threat enables two kinds of attacks building on that threat: >-impersonation to hide caller identity (e.g., in support of robocalling) >-impersonation of the specific identity associated with the calling >number (voicemail hacking, phishing) I went through a spin on this document already with Steve Kent about what should be considered an =B3attack=B2 versus a =B3threat=B2 versus what have= you. I take it in the security community these are terms with a particular meaning, and I tried to bring the text here into conformance with his guidance. I don=B9t think we=B9d say the =B3threat=B2 is the delivery of th= e calling number in that fashion; that=B9s a technique used by attackers to accomplish their attacks. >I think the " Endpoints" section might be better called "Targets" In the architecture that the Actors section describes, endpoints originate calls and receive them, and so necessarily originators of calls aren=B9t in that sense =B3targets.=B2 There goal of the Actors section is to explain wh= o the all parties are that originate, forward, and receive calls, just so the Attacks and Attack Scenarios can refer to these. >Section 4.1 on solution specific attacks either needs to be expanded with >sufficient detail to be meaningful or else deleted before the document >can become and RFC. Here, agreed. I don=B9t want to lose those bullet points though; maybe the right thing to do is to just say that these points are out of scope, but that future work should remember to consider issues like these. Jon Peterson Neustar, Inc. >Penn Pfautz >AT&T Access Management >+1-732-420-4962 > >-----Original Message----- >From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Robert Sparks >Sent: Tuesday, January 21, 2014 12:14 PM >To: stir@ietf.org >Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last >Call on draft-ietf-stir-threats-00.txt) > >There have been no on-list responses to this last call. >We're extending it through this Friday, Jan 24. > >Please let us know that you've reviewed this document and believe it is >ready for publication, or if you have any issues that still need to be >resolved. >Capturing your review on list is important, even if it's just a "ready" >note. > >RjS > > >On 1/2/14, 11:46 AM, Russ Housley wrote: >> The authors have posted an updated Internet-Draft on the STIR threat >>model. It can be found here: >>http://www.ietf.org/id/draft-ietf-stir-threats-00.txt. >> >> Is this document ready for the STIR WG to pass to the IESG, requesting >>publication as an Informational RFC? Please provide your input on this >>mail list by end-of-business on 16 January 2014. If you have issues or >>concerns, please tell us what changes to the document are necessary to >>resolve them. >> >> Russ >> >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From dfrankel@zipdx.com Sun Jan 26 10:39:07 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D01061A001D for ; Sun, 26 Jan 2014 10:39:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.756 X-Spam-Level: ** X-Spam-Status: No, score=2.756 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FRT_PENIS1=3.592, MANGLED_PENIS=2.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tZB_9xC_Nbsa for ; Sun, 26 Jan 2014 10:39:06 -0800 (PST) Received: from xdev1sjc.zipdx.com (sjc119.zipdx.com [72.51.53.119]) by ietfa.amsl.com (Postfix) with ESMTP id 8EBC11A0020 for ; Sun, 26 Jan 2014 10:39:06 -0800 (PST) Received: from DPFyoga (c-76-103-140-126.hsd1.ca.comcast.net [76.103.140.126]) (using TLSv1.2 with cipher AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: dfrankel) by xdev1sjc.zipdx.com (Postfix) with ESMTPSA id 9338C8BC08D; Sun, 26 Jan 2014 10:39:04 -0800 (PST) From: "David Frankel" To: "'PFAUTZ, PENN L'" , "'Peterson, Jon'" , References: <52DEAAD5.2080103@nostrum.com> <38726EDA2109264987B45E29E758C4D604CB02AB@MISOUT7MSGUSR9N.ITServices.sbc.com> <38726EDA2109264987B45E29E758C4D604CB099A@MISOUT7MSGUSR9N.ITServices.sbc.com> In-Reply-To: <38726EDA2109264987B45E29E758C4D604CB099A@MISOUT7MSGUSR9N.ITServices.sbc.com> Date: Sun, 26 Jan 2014 10:39:06 -0800 Organization: ZipDX LLC Message-ID: <078701cf1ac5$e4afce00$ae0f6a00$@zipdx.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQG9jIDRJErQjLABB0DtAln+V/2nkwIBqwkmAaJTrJ8BE3IfogHVI+MTmoYADDA= Content-Language: en-us Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jan 2014 18:39:08 -0000 Just a few more thoughts on the sorts of "attacks" (or at least abuses) that involve Caller-ID, which I think support the sort of distinction Penn is making: 1) Robocalling / SPIT: The caller's objective is to get the called party to answer the phone and engage in some interaction (initially automated, then human). Caller-ID is manipulated for at least three reasons: A. Encourage the called party to answer (or at least discourage them from ignoring the call). B. Provide anonymity; avoid trace-back; evade blocking schemes. C. Lend credibility to the call. These objectives can be achieved to varying degrees through several mechanisms including: misappropriating a number belonging to some legitimate institution, or by using a (perhaps random) number from the local calling area (making it look like a neighbor or local business), or by acquiring numbers specifically for this purpose (see, for example, www.callerid4u.com, which permits their clients to associate a specific calling NAME with an acquired number). These are "mass calling" campaigns where, typically, the called party is non-specific. 2) Denial-of-Service: The caller attacks a specific target (PSAP, other service provider, or even an individual), perhaps as part of an extortion scheme. Caller-ID is manipulated primarily to provide anonymity, avoid trace-back and evade blocking, using schemes similar to those noted above. 3) Impersonation / Hacking: By using a specific caller-ID belonging to a particular individual, the caller is trying to gain access to an institution or system that relies on caller-ID for "authentication." Voice-mail hacking is perhaps the most obvious example (and is not specific to "mobile" telephones noted in first sentence of 3.1), but there are other systems in use at banks, airlines, calling-card services, conferencing providers, ISPs and other "customer support" operations where callers are fully or partially granted access to information or services based on caller-ID. 4) Impersonation targeting an individual: The caller uses an ID with some "trust" association to fool the called party for nefarious purposes. For example, a student-loan debt collector might call you with the ID of your bank or mortgage lender or even your employer to add credence to some threat if you don't pay up. Or an estranged spouse/parent might call a women's shelter using "POLICE" or "FBI" to extract the whereabouts of somebody they seek to harm or kidnap. I'm not suggesting all this go into the document; just trying to help clarify the range of threats and nuances associated therewith. (Perhaps some of this could augment section 3.) Also, by the way, the last two paragraphs of section 2.1 appear to be near-duplicates (assuming I'm looking at the latest version). David Frankel ZipDXR LLC -----Original Message----- From: stir [mailto:stir-bounces@ietf.org] On Behalf Of PFAUTZ, PENN L Sent: Sunday, January 26, 2014 7:42 AM To: 'Peterson, Jon'; stir@ietf.org Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt) Thanks, Jon I'll defer to you on terminology. I do think that the attack sections 3.1 and 3.2 should be made more generic along the lines I suggest: -impersonation to hide caller identity (e.g., in support of robocalling) -impersonation of the specific identity associated with the calling number (voicemail hacking, phishing) Penn Pfautz AT&T Access Management +1-732-420-4962 From anton@ministry.int.ru Thu Jan 30 02:50:09 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D499A1A042D for ; Thu, 30 Jan 2014 02:50:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.27 X-Spam-Level: ** X-Spam-Status: No, score=2.27 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HELO_EQ_RU=0.595, HOST_EQ_RU=0.875] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fB7v-mfgPQpv for ; Thu, 30 Jan 2014 02:50:08 -0800 (PST) Received: from leaf.named.informdeskmedia.ru (leaf.named.informdeskmedia.ru [85.17.236.2]) by ietfa.amsl.com (Postfix) with ESMTP id 95A681A042C for ; Thu, 30 Jan 2014 02:50:08 -0800 (PST) Received: from [2a02:578:5002:1a::2] (account postmaster@leaf.named.informdeskmedia.ru HELO firepaw) by leaf.named.informdeskmedia.ru (CommuniGate Pro SMTP 6.0.4 _community_) with ESMTPSA id 2308836 for stir@ietf.org; Thu, 30 Jan 2014 14:50:03 +0400 Date: Thu, 30 Jan 2014 12:49:55 +0200 From: Anton Baskov To: stir@ietf.org Message-Id: <20140130124955.36f845c83567532f445be465@ministry.int.ru> X-Mailer: Sylpheed 3.3.0 (GTK+ 2.10.14; i686-pc-mingw32) Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [stir] Comment on draft-jennings-stir-rfc4474bis-00 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Jan 2014 10:50:10 -0000 Some notes about phone number canonization described in Cullen’s STIR Signaling presentation and section “7. Identity and Telephone Numbers” of draft-jennings-stir-rfc4474bis: There is a problem with telephone number canonization that in some cases we can’t assume right number judging on sip uri, because some countries uses international access codes different that recommended by ITU. For example, at Russia dial out code is “8” for long distance calls and “8 - 10” for international calls, and most local operators use such number representation in their voip systems, so looking at “sip:8495...” number we can’t suppose is that call from Moscow (+7495...) or it’s from Vietnam (+84...). Also I saw two voip operators that use internal account number as right side of client sip uri – it’s make a possibility to make false phone number assumption by clients. In this case I think that we should have at least information header with full tel: uri or limit canonization procedure only to “sip:+..@domain”-like uri. -- Anton Baskov +7 (911) 254-77-92, +7 (916) 716-89-46 From br@brianrosen.net Fri Jan 31 07:21:39 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C83731A0376 for ; Fri, 31 Jan 2014 07:21:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.821 X-Spam-Level: X-Spam-Status: No, score=-1.821 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_NEUTRAL=0.779] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TiSrquXALdLv for ; Fri, 31 Jan 2014 07:21:37 -0800 (PST) Received: from mail-qa0-f41.google.com (mail-qa0-f41.google.com [209.85.216.41]) by ietfa.amsl.com (Postfix) with ESMTP id 837C01A028B for ; Fri, 31 Jan 2014 07:21:37 -0800 (PST) Received: by mail-qa0-f41.google.com with SMTP id w8so6441766qac.28 for ; Fri, 31 Jan 2014 07:21:33 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=ffRoXBADv3pq8ESwWZ1LiAIn3SAOBkKZtr2Zo7W8yQc=; b=GQ+SDcE4hzF8/CwMSOd62sONBH6UlJ7pOYWXtXcH849HqDxGi4pTPf4W3Se1N9KF2g m82NEgJ1UJsyL0rUTXLhdjqEwUIvv7kxTi5968Ujv/pdfYykmIvgsOe+OQKaBtxqmoSw mA0Rr8iK8Ams9bPSM+4o9QUDcDFgnc2Bsdx5nYXmwcHEEZMgkOUXXY8tcE7dSvCI3gjP amkUYCPkJffLo/z3Q+ft9ggDNP5KveAgYRlKM2geHMj+QEFJrnePWXRiinGUxSy8dLbv /59hbIKb8xgb6CbixL+92J8ivY+u/RHxkp/px5xNubUyMtVpdhBHhqR8jTiA+K7S6W0A /KFQ== X-Gm-Message-State: ALoCoQnVX1Wv4URSzkLavQ6Y60m5EqRLjhOoSTR6a/ai9KNlTCg8ylHyu66UTjlUKc4Z/HAyQE4A X-Received: by 10.140.17.105 with SMTP id 96mr30949565qgc.44.1391181693758; Fri, 31 Jan 2014 07:21:33 -0800 (PST) Received: from [10.33.193.26] (neustargw.va.neustar.com. [209.173.53.233]) by mx.google.com with ESMTPSA id g6sm27880006qag.17.2014.01.31.07.21.31 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 31 Jan 2014 07:21:33 -0800 (PST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Brian Rosen In-Reply-To: <20140130124955.36f845c83567532f445be465@ministry.int.ru> Date: Fri, 31 Jan 2014 10:21:29 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20140130124955.36f845c83567532f445be465@ministry.int.ru> To: Anton Baskov X-Mailer: Apple Mail (2.1827) Cc: "stir@ietf.org List" Subject: Re: [stir] Comment on draft-jennings-stir-rfc4474bis-00 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jan 2014 15:21:40 -0000 This is a good point. We probably have to say that if the rules we agree to do not result in a = a proper e.164, and the call is sent beyond the local domain, that the = =46rom must be changed to be able to be canonicalized by the rules. Brian On Jan 30, 2014, at 5:49 AM, Anton Baskov wrote: > Some notes about phone number canonization described in Cullen=92s = STIR Signaling presentation and section =937. Identity and Telephone = Numbers=94 of draft-jennings-stir-rfc4474bis: >=20 > There is a problem with telephone number canonization that in some = cases we can=92t assume right number judging on sip uri, because some = countries uses international access codes different that recommended by = ITU. For example, at Russia dial out code is =938=94 for long distance = calls and =938 - 10=94 for international calls, and most local operators = use such number representation in their voip systems, so looking at = =93sip:8495...=94 number we can=92t suppose is that call from Moscow = (+7495...) or it=92s from Vietnam (+84...). Also I saw two voip = operators that use internal account number as right side of client sip = uri =96 it=92s make a possibility to make false phone number assumption = by clients. In this case I think that we should have at least = information header with full tel: uri or limit canonization procedure = only to =93sip:+..@domain=94-like uri. >=20 >=20 > --=20 > Anton Baskov > +7 (911) 254-77-92, +7 (916) 716-89-46 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From alex@bobotek.net Fri Jan 31 14:45:41 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DB871A058D for ; Fri, 31 Jan 2014 14:45:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iftfZ_W5gbpu for ; Fri, 31 Jan 2014 14:45:40 -0800 (PST) Received: from qmta04.emeryville.ca.mail.comcast.net (qmta04.emeryville.ca.mail.comcast.net [IPv6:2001:558:fe2d:43:76:96:30:40]) by ietfa.amsl.com (Postfix) with ESMTP id 29A151A04EF for ; Fri, 31 Jan 2014 14:45:39 -0800 (PST) Received: from omta09.emeryville.ca.mail.comcast.net ([76.96.30.20]) by qmta04.emeryville.ca.mail.comcast.net with comcast id LiSk1n0040S2fkCA4mlcnU; Fri, 31 Jan 2014 22:45:36 +0000 Received: from BOBO1A.bobotek.net ([76.22.113.196]) by omta09.emeryville.ca.mail.comcast.net with comcast id Lmlb1n00B4EJ4tY8Vmlbke; Fri, 31 Jan 2014 22:45:36 +0000 Received: from BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad]) by BOBO1A.bobotek.net ([fe80::4851:b4bb:416a:e1ad%10]) with mapi; Fri, 31 Jan 2014 14:41:57 -0800 From: Alex Bobotek To: "stir@ietf.org" Date: Fri, 31 Jan 2014 14:45:37 -0800 Thread-Topic: London session? Thread-Index: Ac8e1hmXrF21/EoZSzqpoIjsKEIEwQ== Message-ID: <4B1956260CD29F4A9622F00322FE0531EC8D239EE1@BOBO1A.bobotek.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_4B1956260CD29F4A9622F00322FE0531EC8D239EE1BOBO1Abobotek_" MIME-Version: 1.0 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20121106; t=1391208336; bh=eDS4w+VHOY8o0Kll1uR4TH5lfYb5l/tOsS5b27dRS+w=; h=Received:Received:Received:From:To:Date:Subject:Message-ID: Content-Type:MIME-Version; b=V/kLes5iT576EV9ATARjVsQ11C1Bd4w+79fvt74mQ33A8DGLyq68j4P7Xjs4p0F9S Np3+PjAzHnGEJBkBOFtZ/XXlSAExCryVzaALIBO0hrSkXOg7Aw8//C/35HYSrCAiAt dzZd+B+iE01G+wuHulq2DcUYc6fKFeMsceOblP3K92j8DQWTX7lsBadRObIA0pdQJV JdzactbKiY96F6u8hcGcJs4I/MVv2yQ0LRs51XzNf1Ve3q0fC/zdX/3GwRuzv3/kzR Ev8nImavNzJARdywCFOcKd99tBEQcH/WhY73KaV6m9T6S46INJOW4RJOjRnMc0At63 Rpd2eWRGXmSJw== Subject: [stir] London session? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jan 2014 22:45:41 -0000 --_000_4B1956260CD29F4A9622F00322FE0531EC8D239EE1BOBO1Abobotek_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Are there any plans for STIR to have a session in London? Regards, Alex --_000_4B1956260CD29F4A9622F00322FE0531EC8D239EE1BOBO1Abobotek_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Are ther= e any plans for STIR to have a session in London?

 

Regards,

=

 

Alex

= --_000_4B1956260CD29F4A9622F00322FE0531EC8D239EE1BOBO1Abobotek_-- From rjsparks@nostrum.com Fri Jan 31 16:41:25 2014 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A730E1ACC80 for ; Fri, 31 Jan 2014 16:41:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.035 X-Spam-Level: X-Spam-Status: No, score=-1.035 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, HTML_MESSAGE=0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UPLyrgOFi0tL for ; Fri, 31 Jan 2014 16:41:24 -0800 (PST) Received: from shaman.nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id A7C131ACC7E for ; Fri, 31 Jan 2014 16:41:24 -0800 (PST) Received: from unnumerable.local (pool-173-71-10-88.dllstx.fios.verizon.net [173.71.10.88]) (authenticated bits=0) by shaman.nostrum.com (8.14.3/8.14.3) with ESMTP id s110fK99065604 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=OK) for ; Fri, 31 Jan 2014 18:41:20 -0600 (CST) (envelope-from rjsparks@nostrum.com) Message-ID: <52EC42B0.8070907@nostrum.com> Date: Fri, 31 Jan 2014 18:41:20 -0600 From: Robert Sparks User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: stir@ietf.org References: <4B1956260CD29F4A9622F00322FE0531EC8D239EE1@BOBO1A.bobotek.net> In-Reply-To: <4B1956260CD29F4A9622F00322FE0531EC8D239EE1@BOBO1A.bobotek.net> Content-Type: multipart/alternative; boundary="------------010402020301080306040102" Received-SPF: pass (shaman.nostrum.com: 173.71.10.88 is authenticated by a trusted mechanism) Subject: Re: [stir] London session? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Feb 2014 00:41:25 -0000 This is a multi-part message in MIME format. --------------010402020301080306040102 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 1/31/14, 4:45 PM, Alex Bobotek wrote: > > Are there any plans for STIR to have a session in London? > Yes. We will meet. We'll have a proposed agenda up soon. RjS > > Regards, > > Alex > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --------------010402020301080306040102 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 1/31/14, 4:45 PM, Alex Bobotek wrote:

Are there any plans for STIR to have a session in London?

Yes. We will meet. We'll have a proposed agenda up soon.

RjS

 

Regards,

 

Alex



_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

--------------010402020301080306040102--