Subject: RE: [SIP] How to stop a Lawnmower Man attack?

From: "Fox, Mike" <[email-masked]>
Date: Mon, 17 Jul 2000 11:18:14 -0700

The zombie never belongs to the attacker it belongs to some other
unsuspecting dupe so is can be very hard (impossible?) to find who to
prosecute later. 

Not that it has been widely implemented, a GK can be used in conjunction
with a firewall so that only GK routed calls can be originated or accepted
by a Zone. The administrative problem of protecting a few GKs and a Firewall
seems more tractable than protecting all possible terminals. 

Mike

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Monday, July 17, 2000 11:02 AM
> To: Fox, Mike
> Cc: [email-masked]
> Subject: Re: [SIP] How to stop a Lawnmower Man attack?
> 
> 
> 
> 
> "Fox, Mike" wrote:
> > 
> > In this attack scenario, a SIP zombie machine is 
> established with access to
> > necessary credentials for call initiation. This single 
> machine then attempts
> > call initiation with many endpoints. The resulting media 
> streams could be
> > used in an DOS attack against a given target or randomly 
> interconnected as
> > calls are answered as a prank.
> > 
> > I do not see where in the current SIP architecture this 
> type of threat is
> > addressed. In the H.323 architecture an administrator could 
> use the Zone and
> > Gatekeeper approach to control the pattern of call initiation and
> > acceptance. How is it to be done with SIP?
> 
> Well, if I'm launching an attack with my zombie machine, its unlikely
> I'll obey the GK message which tells me I can't make the call 
> (I presume
> you mean ARQ). You can also bypass the gatekeeper completely and send
> call setup requests directly to clients. 
> 
> The real way to protect against this threat is with authentication in
> the UAS. If you only accept calls from authenticated callers, even if
> you don't know the person, you have a record of who launched 
> the attack
> that can be used to prosecute them later. 
> 
> -Jonathan R.
> 
> -- 
> Jonathan D. Rosenberg                       72 Eagle Rock Ave.
> Chief Scientist                             First Floor
> dynamicsoft                                 East Hanover, NJ 07936
> [email-masked]                     FAX:   (973) 952-5050
> http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
> http://www.dynamicsoft.com
> 
> 
> _______________________________________________
> SIP mailing list
> [email-masked]
> http://lists.bell-labs.com/mailman/listinfo/sip
> 

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 18 Jul 2000 01:50:05 -0400

> unsuspecting dupe so is can be very hard (impossible?) to find who to

In this case, how are you controlling it to make it make all those
random phone calls?

> seems more tractable than protecting all possible terminals.

You can certainly do this for SIP also; see:
http://www.cs.columbia.edu/~jdrosen/papers/draft-rosenberg-sip-firewalls-00.txt

Using firewalls though to prevent people from getting out is ultimateily
futile.

-Jonathan R.