Subject: [sipcore] SIP Push Suggested Change: push parameters sent to non-trusted endpoints

From: Christer Holmberg <[email-masked]>
Date: Fri, 11 Jan 2019 14:23:23 +0000

Dear fans of push,

As part of the IESG review, Adam raised an issue that needs to be discussed on the list.

What is it about?

As defined in the draft, some of the pn- parameters included in the Contact header field URI of the REGISTER request are considered "sensitive". Not because they necessarily reveal user information, but because they could potentially be used to trigger malicious push notifications towards a UA.

Adam noted that, if someone else subscribes to the reg event package (RFC 3680) of a UA, that someone else could get hold of the pn- parameters (if the Contact information is included in the associated NOTIFY request).

What do I think?

In my personal opinion this is more of an RFC 3680 issue than a push issue. Because, the contact of a UA could also contain other information (non-push related) that is considered sensitive, e.g., the private IP address and port of a UA.

Therefore, I would assume that registrars have some kind of control of who is allowed to subscribe to a given user's reg event.

For example, in IMS the S-CSCF has a list of users authorized to subscribe to the reg event package for a user. Each UA associated with the user, and network nodes within the trust domain of the S-CSCF, are authorized to subscribe. Other users, and non-trusted network nodes, are NOT authorized.

Having said that, I do think it would be good to address this issue in the draft.

What is the suggestion?

My suggestion is to add additional text to the draft (Security Considerations) that highlights the RFC 3680 issue, and that operators that deploy SIP push need to make sure the push related information is not shared with non-trusted entities.

Regards,

Christer

---

From: Roman Shpount <[email-masked]>
Date: Fri, 11 Jan 2019 13:45:47 -0500

On Fri, Jan 11, 2019 at 9:23 AM Christer Holmberg <
[email-masked]> wrote:

> My suggestion is to add additional text to the draft (Security
> Considerations) that highlights the RFC 3680 issue, and that operators that
> deploy SIP push need to make sure the push related information is not
> shared with non-trusted entities.
>
>
>
I agree. I think listing this issue in Security Considerations should be
sufficient.
_____________
Roman Shpount

---

From: Martin Thomson <[email-masked]>
Date: Mon, 14 Jan 2019 10:01:03 +1100

> I agree. I think listing this issue in Security Considerations should be

As long as there is a "MUST" attached to that mention, I'm OK with that outcome.

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 14 Jan 2019 10:01:06 +0000

Hi,

Please note that RFC 3680 already says the following:

   "Registration state can be sensitive information.  Therefore, all
   subscriptions to it SHOULD be authenticated and authorized before
   approval.  Authentication MAY be performed using any of the
   techniques available through SIP, including digest, S/MIME, TLS or
   other transport specific mechanisms [1].  Authorization policy is at
   the discretion of the administrator, as always.  However, a few
   recommendations can be made.

   It is RECOMMENDED that a user be allowed to subscribe to their own
   registration state.  Such subscriptions are useful when there are
   many devices that represent a user, each of which needs to learn the
   registration state of the other devices.  We also anticipate that
   applications and automata will frequently be subscribers to the
   registration state.  In those cases, authorization policy will
   typically be provided ahead of time."

So, in addition to pointing out that the pn- information is sensitive, and referencing the text 3680 text above, do we need to specify something NEW?

Regards,

Christer

On 14/01/2019, 1.01, "sipcore on behalf of Martin Thomson" <[email-masked] on behalf of [email-masked]> wrote:

    
    _______________________________________________
    sipcore mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/sipcore

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 14 Jan 2019 13:12:25 +0000

Perhaps something like this:

"RFC 3680 defines generic security considerations for the registration event package. As the SIP URI parameters defined in this document carry sensitive information, operators that support the registration event package MUST ensure that event package subscriptions are properly authenticated and authorized, and that the SIP URI parameters are not included in event notifications sent to other users, or to non-trusted network entities."  

Regards,

Christer

On 14/01/2019, 12.02, "sipcore on behalf of Christer Holmberg" <[email-masked] on behalf of [email-masked]> wrote:

    Hi,

    

    Regards,
    
    Christer

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 15 Jan 2019 00:39:39 -0500

Yes. This isn't like giving away your name or contact information, it is giving away a password. 

On Mon, Jan 14, 2019, at 23:01, Christer Holmberg wrote:
> So, in addition to pointing out that the pn- information is sensitive, 
> and referencing the text 3680 text above, do we need to specify 
> something NEW?
> 
> Regards,
> 
> Christer
> 
> 
> 
> 
> 
> On 14/01/2019, 1.01, "sipcore on behalf of Martin Thomson" 
> <[email-masked] on behalf of [email-masked]> wrote:
>

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 15 Jan 2019 09:48:54 +0000

Hi,

I have submitted a github pull request commit that suggests text:

https://github.com/cdh4u/draft-sip-push/pull/31/commits/fc88deb280550925699c99186ea29503e7fe762b

Regards,

Christer

On 15/01/2019, 7.40, "Martin Thomson" <[email-masked]> wrote: