Subject: [Ecrit] tschofenig-ecrit-security-threats

From: "Cullen Jennings" <[email-masked]>
Date: Fri, 29 Jul 2005 23:47:58 -0400

In many ways this looks at the VoIP threats in a very well structured
approach, but I feel like it is missing some of the obvious overall system
problems - problems that are probably not desirable to solve. Let me give a
few examples of what I mean ....

Section 5.1 - DOS

Today, One can DOS a psap by taking a large handful of phones and dialing
911 on them all at the same time. This is because of the limited number of
human operators at the PSAP. We don't want to solve this - we don't want to
stop more than a handful of phones from calling at once and we don't want to
add more operators.

One can DOS a police of fire department by phoning in a bomb threat to high
school. Folks used to do this at my high school to avoid exams - I hope it
is not done so casually today.

5.2 - Call to PSAP with no Identity

Do we really want to block 911 calls from pay phones? If caller id does not
work for some reason do we want to block the 911 call. I think it is more
likely to see that 911 calls will have to work from phones that have not
been registered and don't have billing accounts that would even allow a
normal call.

5.3 - Location Spoofing

No matter how we do location on phones, it will not always work. Today when
I phone 911 in the US from a residential PSTN line, the first thing they ask
me is where am I. I don't expect this to change. If my phone says I am in
San Jose but I tell them I am in Dallas, they transfer to me to Dallas PSAP.
I believe that they should continue to rely on the human version of where
the human is over the machine version.

5.4 - Impersonating a PSAP

It would be an absolute travesty if a given region brought a new PSAP online
and then when I called 911, my phone hung up the call because it did not
know about the new region. Many, many people are going to end up having
access to the credentials that would identify a psap as a real pasp.

I could go on with 5.5 to 5.10 but you get the idea.

My biggest fear about VoIP 911 is that it will be too complicated and fail
when most needed or that it will not be possible to continuously test that
it is working. Usually the bad news about security is that it is only as
good as the weakest link. I think this is great news for 911, we don't need
the security to be stronger than the weakest link. And the weakest link is
pretty minimal.

Cullen

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Sat, 30 Jul 2005 09:25:16 -0400

One of the really important messages I ever got was when a PSAP person went
on and on and on about how important it was to get validated location, and
know who the carrier was, and that the calls were routed to the correct
PSAP.  

I asked him what he wanted to do when all the checks and security and
mechanisms still resulted in a call without any of that
"Oh, we'll take the call" was the reply.

Now, there are rumors of PSAPs not accepting calls under some circumstances,
but I have never actually talked to anyone who would admit that they
literally would not take a call.

So, we need mechanisms, and the mechanisms have to be reliable.  However,
when the mechanisms fail, you send the call to the best guess PSAP, without
the identity, without the security, and they will try to help.  

That is not any kind of excuse to make mechanisms less rigorous, or
implementations sloppy.  It's just a "what do you do when despite your best
effort it didn't work".  You send the call.  You never drop an emergency
call.  You always send it somewhere.  PSAPs never (well, okay, there are
those rumors) refuse calls.  So your conclusion that we don't need much
security is incorrect I think.

We're working on strategies to deal with DOS on PSAPs.  There are around
25,000 call takers on duty at any one time in the U.S.  Even if whatever
defenses you have for DoS fail, one thing we can do is spread calls out to
available call takers and let them sort out the good from the bad.  Bad
calls get dropped, good calls get forwarded back to the right PSAP.  That
would have to be done by prior arrangement (the attacked PSAP has to agree
to send it's calls elsewhere, other PSAPs have to agree to take them).  You
would do that in the interval where your firewall failed to detect a new
type of attack and when you got a reasonable signature on it to use to
filter out the bad calls.

Brian
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Cullen Jennings
Sent: Friday, July 29, 2005 11:48 PM
To: [email-masked]
Subject: [Ecrit] tschofenig-ecrit-security-threats

Section 5.1 - DOS

5.3 - Location Spoofing

Cullen