Subject: Security Considerations (was RE: [Sip] Alert-Info: header)

From: "Eric Burger" <[email-masked]>
Date: Tue, 6 Nov 2001 08:42:12 -0500

Kim's points are pretty significant.  Would it not be valuable to have some
language in the Security Considerations section of the draft pointing out
what happens if you don't implement some sort of a&a system?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Kim Liu
Sent: Wednesday, October 17, 2001 9:01 AM
To: Henning Schulzrinne
Cc: [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: [Sip] Alert-Info: header

Henning Schulzrinne wrote:
[Deleted]
> See earlier message about spam. In some cases, even if you allow random
> URLs, this can actually help. If I hear the local [your least favorite
> telephone company here] jingle, I will press the deep-six (603) button
> without bothering to lift the receiver. It is somewhat unfortunate that
> existing SIP phones don't have this button...
>

SPAM is not the major issue with the header as far as I see it.

  * Harrassment
    The phone 'rings' with "I'm watching you..."
    (Spoofed UDP INVITE that points to movie/TV sound web archive
    in Alert-Info, or free/anonymous web-hosting site.)
  * Mischief
    The phone 'rings' with the sound of a fire alarm and someone
    shouting 'Fire!  Someone pull the fire alarm!'
    (Spoofed UDP INVITE that points to movie/TV sound web archive
    in Alert-Info, or free web-hosting site.)
  * Serious mischief
    The phone 'rings' at a police station or such with 'Look out!
    He's got a gun!'
  * DOS
    Multiple phones in a building are sent INVITEs with Alert-Info
    pointing to 'wav' file that is 10 gigabytes long, tying up the
    bandwidth until the network admin can track down which unattended
    phones/IP addresses are doing this and kill off the connections.
  * Security issues
    If a helper application (i.e. your favorite web browser or
    media player) is used to deal with the information in the
    Alert-Info header, then this opens up a potential line of
    attack for things like those script viruses, buffer overflows,
    etc.  All the vulnerabilities that have been experienced to
    date with certain email and browser programs.  (It should be
    noted that in this case, even having a trust relationship
    with the calling party may not be enough if the calling
    party has gotten infected with a virus/trojan that spreads
    itself by calling everyone in the address/phone book with
    itself in the Alert-Info header.  The call will appear to
    have been from a trusted party.)
    If there is no helper application for dealing with various
    types of media files, then the phone itself will have to
    support them -- .wav, .au, .wma, .mp3, .jpg, .avi, .mov,
    .vbs, etc. etc. whatever.

That's not saying these are untraceable or unstoppable, but
it seems like the header pretty much cannot be used without
a very strong security relationship in place between the two
parties, and even that may fail in the last case.
[snip]

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 7 Nov 2001 23:29:56 -0500

Actually, I did add text in bis-05 about it. Its not in the security
section, but within the discussion of the headers themselves. The same
issues arise for Call-Info and Alert-Info.  Most of the text is in section
22.9 on call-info. Please take a look at the text.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

> From: Eric Burger [mailto:[email-masked]]
> Sent: Tuesday, November 06, 2001 8:42 AM
> To: Jonathan Rosenberg
> Cc: [email-masked]
> Subject: Security Considerations (was RE: [Sip] Alert-Info: header)
> 
>