Subject: RE: [MMUSIC] RTP denial of service

From: [email-masked]
Date: Wed, 2 Jul 2003 19:11:06 +0200

Let me check If I understood correctly what jonathan wanted to mean:

the point is that the attacker COULD be authenticated
e.g. the attacker *buys* a movie (say with a stolen credit card)
from www.holywood-movies.com etc ....
BUT tweaks the streaming request in a way that the
movie will be sent toward whitehouse.gov instead !

Traceability would be if the stolen credit card can be traced,
or if the attacker IP address can be traced etc ...

BTW jonathan, for this exact reason (to my knowledge most) RTSP server implementations
today would refuse to stream except toward the originating RTSP IP address
(or at least this feature can be turned on)
...
which is actually a problem for NAT traversal in case the NAT attributes
a different IP address for the RTSP and RTP traffic !

regards,

Philippe Gentric
[email-masked]
http://www.platform4.philips.com

                                                                                                                                       
                                                   To:   "Jonathan Rosenberg" <[email-masked]>                                
                                                    <[email-masked]>                                                                  
                                                   cc:   (bcc: Philippe Gentric/MP4-SUR/CE/PHILIPS)                                    
                                                   Subject:    RE: [MMUSIC] RTP denial of service                                      
               "Hearty, John"                                                                                                          
               <[email-masked]>            Classification:                                                                     
                                                                                                                                       
               Sent by:                                                                                                                
               [email-masked]                                                                                                   
                                                                                                                                       
               02/07/2003 18:49                                                                                                        

My security knowledge is weak, and I would like some help understanding
why the following from the draft is true:

There
   is no requirement that the calls come from unauthenticated sources.
   The attack can be launched even if the device requires
   authentication. Of course, authentication might provide some amount
   of traceability.

Wouldn't it be more difficult to launch the attack if authentication was
required?  I would think RTP would not start sending if the original
request could not be authenticated.

John

> -----Original Message-----
> From: Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Tuesday, July 01, 2003 11:16 PM
> To: [email-masked]
> Subject: [MMUSIC] RTP denial of service
>
> Folks,
>
> I'd like to draw your attention to the following I-D that I submitted
> recently:
>
> http://www.ietf.org/internet-drafts/draft-rosenberg-mmusic-rtp-
> denialofservice-00.txt
>
> This draft describes a denial-of-service attack using RTP. This attack
> can be launched using any protocol that uses an offer/answer-like SDP
> exchange, including SIP and RTSP. The draft also discusses ICE as a
> solution to the problem.
>
> Comments welcome.
>
> Thanks,
> Jonathan R.
>
> --
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
>
>
>
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 02 Jul 2003 23:47:27 -0400

> or if the attacker IP address can be traced etc ...

Yes. But its easier than that. Many media services don't even require 
the user to pay. For example, if you connect to the free world dialup 
voicemail server without needing to pay anyone anything. Just go to 
their website and sign up.

> (or at least this feature can be turned on)

Sure, and the draft discusses this. All this means is that the client 
needs to spoof the source address.

> a different IP address for the RTSP and RTP traffic !

Yup, exactly.

-Jonathan R.