Subject: [SIP] How to stop a Lawnmower Man attack?

From: "Fox, Mike" <[email-masked]>
Date: Mon, 17 Jul 2000 09:55:41 -0700

In this attack scenario, a SIP zombie machine is established with access to
necessary credentials for call initiation. This single machine then attempts
call initiation with many endpoints. The resulting media streams could be
used in an DOS attack against a given target or randomly interconnected as
calls are answered as a prank.

I do not see where in the current SIP architecture this type of threat is
addressed. In the H.323 architecture an administrator could use the Zone and
Gatekeeper approach to control the pattern of call initiation and
acceptance. How is it to be done with SIP?

Best regards,
Mike Fox

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 17 Jul 2000 14:01:38 -0400

> acceptance. How is it to be done with SIP?

Well, if I'm launching an attack with my zombie machine, its unlikely
I'll obey the GK message which tells me I can't make the call (I presume
you mean ARQ). You can also bypass the gatekeeper completely and send
call setup requests directly to clients. 

The real way to protect against this threat is with authentication in
the UAS. If you only accept calls from authenticated callers, even if
you don't know the person, you have a record of who launched the attack
that can be used to prosecute them later. 

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com