Subject: [SIP] DoS attacks and UDP

From: David Frascone <[email-masked]>
Date: Wed, 24 Jan 2001 16:21:10 -0600

Ok, not that I want to stir up the hornets' nest any more but . . .

It seems like the INVITE message is very susceptible to a DoS attack.  What's
to keep someone from generating hundreds of SIP INVITEs, and sending them
from bogus UDP addresses?

Even if the requests had SIP URLs that were not known, the server would spend
quite a bit of time retransmitting the 4xx response, which would never be
ACK'ed.

And, if it was a proxy, it might spend lots of time looking up domains, and
querying other servers, to only be spinning its wheels, and wasting valuable
CPU time.

Has anyone addressed this possibility?  Is there a draft that offers a
solution?  Perhaps a mandatory provisional response, and PRACK?

Or, is everyone else using TCP?

-Dave

P.S.  I have thought of using authentication, but that would only work
on your local sip proxy, not if you were trying to query sip.foo.com about
[email-masked], [email-masked], etc.

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementer's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to [email-masked] with
"subscribe sip-implementors" in the body.

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Wed, 24 Jan 2001 17:42:58 -0500

IPsec has a anti-clogging mechanism, but any such mechanism requires
additional round-trip times, by definition. You can also do a 3xx to a
TCP connection...

PRACK doesn't help here.
-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: David Frascone <[email-masked]>
Date: Wed, 24 Jan 2001 16:50:38 -0600

I guess you're right.  The retransmission timer on the PRACK is the same as
on the invite.

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Wed, 24 Jan 2001 17:53:41 -0500

> I guess you're right.  The retransmission timer on the PRACK is the same as

If anything, reliable prov. responses make the problem worse, not
better. Also, the UAC indicates whether it wants that feature, so one
cannot rely on it to do anything that the UAC may not be interested in.

---

From: David Frascone <[email-masked]>
Date: Wed, 24 Jan 2001 23:19:09 -0600

So, when do you think that a global PKI infrastructure will be in place?  I
had assumed it was still pretty far away.  The infrastructure would have to
be available to ANYONE globally and work with ANY sip server.

I agree that my post would be moot with a global PKI in place, so, if you'll
just send me a pointer to information on the PKI infrastructure, I'll consider
this discussion closed.

But, until then, there is a nasty DoS vunerability in SIP over UDP.

-Dave

On Wed, Jan 24, 2001 at 02:42:44PM -0800, Michael Thomas wrote:
> David Frascone writes:
>    Crypto.
> 			Mike