Subject: AW: [Ecrit] tschofenig-ecrit-security-threats

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 1 Aug 2005 08:53:07 +0200

hi cullen, 

thanks for the review. 

> In many ways this looks at the VoIP threats in a very well structured
> approach, but I feel like it is missing some of the obvious 
> overall system
> problems - problems that are probably not desirable to solve. 

i think we should list all threats that are applicable for the ecrit
scope. 
i know that we need to scope our work a bit in this document and focus
on threats that are also relevant for the requirements document. the
security requirements should then indicate what threats are applicable
for us.  

i know that we list a few threats in the document that are outside the
scope. i do not want to be the main driver of this document --- i hope
to find someone in the working group to take over the document. i will
raise this question again during the ecrit working group session. 

> Let me give a
> few examples of what I mean ....
> 
> Section 5.1 - DOS
> 
> Today, One can DOS a psap by taking a large handful of phones 
> and dialing
> 911 on them all at the same time. This is because of the 
> limited number of
> human operators at the PSAP. We don't want to solve this - we 
> don't want to
> stop more than a handful of phones from calling at once and 
> we don't want to
> add more operators.

to a certain extend you are right. 
what i cannot do with my mobile phone today is place an emergency call
here in paris to the police in munich. 
 
> 
> One can DOS a police of fire department by phoning in a bomb 
> threat to high
> school. Folks used to do this at my high school to avoid 
> exams - I hope it
> is not done so casually today.
> 
> 5.2 - Call to PSAP with no Identity
> 
> Do we really want to block 911 calls from pay phones?

no.

btw, having a pay phone does not have that no identities are used. 
they are used by they cannot be traced back to real world persons (at
least not in some countries).

 If 
> caller id does not
> work for some reason do we want to block the 911 call. I 
> think it is more
> likely to see that 911 calls will have to work from phones 
> that have not
> been registered and don't have billing accounts that would 
> even allow a
> normal call.

there are some operational issues that depend on country specific laws. 

we need to be prepared that the authenticated identity of the emergency
caller might not be available to the psap. 
 
> 
> 5.3 - Location Spoofing
> 
> No matter how we do location on phones, it will not always 
> work. Today when
> I phone 911 in the US from a residential PSTN line, the first 
> thing they ask
> me is where am I. I don't expect this to change. If my phone 
> says I am in
> San Jose but I tell them I am in Dallas, they transfer to me 
> to Dallas PSAP.
> I believe that they should continue to rely on the human 
> version of where
> the human is over the machine version.

that's fine. the problem is more if i am in paris but i give them a call
and tell them that i am in munich. 

in some cases i might just not be able to say anything anymore. 
additionally, you have to consider the instant messaging case where i
don't want to type in my location (civic or geospatial location
information). 

> 
> 5.4 - Impersonating a PSAP
> 
> It would be an absolute travesty if a given region brought a 
> new PSAP online
> and then when I called 911, my phone hung up the call because 
> it did not
> know about the new region. Many, many people are going to end 
> up having
> access to the credentials that would identify a psap as a real pasp.

it would also be bad if you would like to place an emergency call and an
adversary pretends to be the true psap.

we certainly have todo a tradeoff regarding deployment complexity and
security vulnerabilities (as we do it with all protocols).

> 
> I could go on with 5.5 to 5.10 but you get the idea.
> 
> My biggest fear about VoIP 911 is that it will be too 
> complicated and fail
> when most needed or that it will not be possible to 
> continuously test that
> it is working.

i agree with you. 
as previously indicated i think it does not hurt to mention all threats
if we are later able to decide what threats we would like to address. 

 Usually the bad news about security is that it 
> is only as
> good as the weakest link. I think this is great news for 911, 
> we don't need
> the security to be stronger than the weakest link. And the 
> weakest link is
> pretty minimal.

what security properties would you like to see being addressed in the
context of ecrit? 
we could provide the building blocks to secure certain parts if people
want. i think we cannot mandate a certain emergency infrastructure to be
used.

ciao
hannes

> 
> Cullen
> 
> 
> 
> 
> _______________________________________________
> Ecrit mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ecrit
> 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit