Subject: RE: [SIP] How to stop a Lawnmower Man attack?

From: "Fox, Mike" <[email-masked]>
Date: Tue, 18 Jul 2000 12:27:43 -0700

> -----Original Message-----
> Jonathan Rosenberg wrote:
> "Fox, Mike" wrote:
> > 
> > The zombie never belongs to the attacker it belongs to some other
> > unsuspecting dupe so is can be very hard (impossible?) to 
> find who to
> > prosecute later.
> 
> In this case, how are you controlling it to make it make all those
> random phone calls?

Using software of course ;-). How did it get to the zombie, you ask.
Perhaps somebody read an email. Here is a clipping of a recent SANS alert.

From: Alan Paller for SANS NewsBites and SANS Windows Security Digest
      Services

I am forwarding this note to you as a FLASH because the vulnerability
it describes is probably the most dangerous programming error in Windows
workstation (all varieties -- 95, 98, 2000, NT 4.0) that Microsoft has
made.

You are vulnerable to total compromise simply by previewing or reading
an email (without opening any attachments) if you have one of the
affected operating systems and have the following installed:
* Microsoft Access 97 or 2000
* Internet Explorer 4.0 or higher, including 5.5 (Windows 2000 includes
  IE 5)
....

> 
> > 
> > Not that it has been widely implemented, a GK can be used 
> in conjunction
> > with a firewall so that only GK routed calls can be 
> originated or accepted
> > by a Zone. The administrative problem of protecting a few 
> GKs and a Firewall
> > seems more tractable than protecting all possible terminals.
> 
> You can certainly do this for SIP also; see:
> http://www.cs.columbia.edu/~jdrosen/papers/draft-rosenberg-sip
>-firewalls-00.txt
>
>Using firewalls though to prevent people from getting out is ultimateily
>futile.

Perhaps, but the point is not to reduce the service users have access to but
increase and improve them. Administrative domains which enable better
services can be considered. Users on administrative islands do not get as
good visibility into what is happening on the network. For example, I do not
want to be part of a prank I would like my service provider to recognize the
signature of pranks and stop them. If my UAC is behaving badly because it
got some virus I want it stopped. Most "users" do not want to be
administrators, and recognize the benefits of the administrative function.
Perhaps I'm wrong but it seems that many SIP endorsers have ideologically
eschew the concept of administrative control, but it can be useful. 

I would like to be clear in that I'm not trying to suggest that SIP does
support administrative control. Instead I would like to suggest that such
models are possible, and that a community effort in addressing security
threats could yield useful results.

Mike

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 19 Jul 2000 00:47:10 -0400

"Fox, Mike" wrote:

> threats could yield useful results.

Mechanisms to prevent infected/misbehaving UAs from launching lots of
calls in order to perform a DoS attack are possible without any protocol
support. They all fall into the realm of policy of a server. When it
gets an INVITE, what to do? It can reject the request, if it likes, or
proxy, or redirect, or whatever. If you want to implement counters, and
if the same UA makes more than X calls in Y seconds, reject further
calls, thats just fine.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com

---

From: Michael Thomas <[email-masked]>
Date: Thu, 20 Jul 2000 08:21:18 -0700 (PDT)

> threats could yield useful results.

   I don't see how the protocol itself can help. I can
   see pretty simple call gapping measures at proxies,
   etc, help though but those don't require any new
   protocol mechanisms. Also: a UAS can always insist
   that the initial INVITE come through a trusted 
   proxy rather than directly from the UAC. Assuming
   that proxies are more trustworthy because they at
   least have some admin behind them, you could limit
   the zombie attack as above.

   Am I missing something?

		Mike