Subject: RE: [SIP] VIA header encryption?

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 28 Feb 2001 09:57:43 -0500

> -----Original Message-----
> From: Henning G. Schulzrinne [mailto:[email-masked]]
> Sent: Wednesday, February 28, 2001 9:21 AM
> To: Jonathan Rosenberg
> Cc: 'Sean Olson'; Neil Deason; [email-masked]
> Subject: Re: [SIP] VIA header encryption?
> 
> 
> 
> > 
> > I've seen this requirement for hiding from wireline 
> providers as well - not
> > because the number of servers is sensitive information to 
> be hidden from
> > competitors - but because of hackers. The primary issue, in 
> my mind, is
> > allowing outside parties to learn the IP address of servers 
> within the
> > network. Once that happens, lots of tools are at their 
> disposal to attack
> > these machines. Given that phone companies have 
> historically been a favorite
> > attack point for hackers, and given that these attacks are 
> much easier when
> > we are talking voip, I think paranoia is a good thing here.
> 
> These providers should be informed that they are clueless :-) 
> There are
> port scanners around that search millions of IP addresses 
> very quickly,
> automatically and without the hacker lifting a finger. Thus, 
> this offers
> almost no protection, except assuring PHBs that "yes, we're hiding our
> network".

Well, there is a big difference. With the port scans, you find a device, but
don't necessarily know what it does or why you might want to beat it up.
Without via hiding, an attacker can know what the device is (a proxy), what
provider its with, what calls get routed through it, and so on. It makes for
much more selective, focused attacks.

-Jonathan R.

---
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.cs.columbia.edu/~jdrosen         PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
This list is for continuing development of the SIP protocol.
The sip-implementor's list is the place to discuss implementation,
and to receive advice on understanding existing sip.
To subscribe to it, send mail to 
[email-masked] with "subscribe" in the body.

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Wed, 28 Feb 2001 10:03:05 -0500

> much more selective, focused attacks.

Scan for TCP port 5060 and you'll know it's a proxy. You'll know the IP
address range by looking at the packet to your 3GPP device (or the
public allocations and domain names). I agree Via hiding makes the work
somewhat more difficult, but I doubt that it offers any real protection,
given other leakage (such as Record-Route) and other ways to find out
things (max-forward).

My primary concern is that 3GPP seems to be mandating architectures that
are, at best, useful for a subset of providers and scenarios, imposing
complexity on everyone.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs