Subject: [stir] draft-peterson-stir-threats-00.txt

From: Russ Housley <[email-masked]>
Date: Fri, 20 Sep 2013 17:23:17 -0400

http://www.ietf.org/id/draft-peterson-stir-threats-00.txt

Should the working group adopt this I-D as the starting point for the STIR threat docuent?

Russ

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Fri, 20 Sep 2013 21:52:29 +0000

Russ,

Could we have one more week to review?

Thank you,

Martin

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Friday, September 20, 2013 5:23 PM
To: IETF STIR Mail List
Subject: [stir] draft-peterson-stir-threats-00.txt

Russ

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Russ Housley <[email-masked]>
Date: Fri, 20 Sep 2013 18:01:24 -0400

Please post your thoughts as soon as you have read it.  I would really like to have a draft-ietf-stir-threats document for discussion of open issues in Vancouver.

We have a few more weeks until the cut-off (see http://www.ietf.org/meeting/cutoff-dates-2013.html#IETF88), but I really want to get there.

Russ

---

From: Russ Housley <[email-masked]>
Date: Thu, 26 Sep 2013 16:37:07 -0400

It has been six days, I'd like to hear from more people about this document.  Martin asked for an additional week, so I'm sure we will hear from him soon.

Russ

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Thu, 26 Sep 2013 20:42:57 +0000

With Hadriel comments incorporated, it is a start

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Thursday, September 26, 2013 4:37 PM
To: IETF STIR Mail List
Subject: Re: [stir] draft-peterson-stir-threats-00.txt

Russ

---

From: Robert Sparks <[email-masked]>
Date: Mon, 30 Sep 2013 11:46:47 -0500

> With Hadriel comments incorporated, it is a start
Hi Martin -

Just to make sure - I think you're referring to Hadriel's comments on 
the problem statement document?
I don't think Hadriel's commented directly on stir-threats yet.

In any case, we _are_ talking about a starting place, not a finished 
product.

If there's no other objection, I'd like to get Jon to submit the threats 
document as a WG -00 as soon as it's convenient.

RjS

---

From: "DOLLY, MARTIN C" <[email-masked]>
Date: Mon, 30 Sep 2013 16:57:30 +0000

Yes, ok

Martin Dolly
Lead Member of Technical Staff
Core Network & Gov't/Regulatory Standards  
AT&T Labs - Network Technology
+1-609-903-3360
[email-masked]

> On Sep 30, 2013, at 12:47 PM, "Robert Sparks" <[email-masked]> wrote:
> 
> Just to make sure - I think you're referring to Hadriel's comments on the problem statement document?
> In any case, we _are_ talking about a starting place, not a finished product.
> 
> If there's no other objection, I'd like to get Jon to submit the threats document as a WG -00 as soon as it's convenient.
> 
> RjS
>>

---

From: "Richard Shockey" <[email-masked]>
Date: Mon, 30 Sep 2013 16:10:42 -0400

+1  

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
DOLLY, MARTIN C
Sent: Monday, September 30, 2013 12:58 PM
To: Robert Sparks
Cc: [email-masked]
Subject: Re: [stir] draft-peterson-stir-threats-00.txt

Yes, ok

Martin Dolly
Lead Member of Technical Staff
Core Network & Gov't/Regulatory Standards AT&T Labs - Network Technology
+1-609-903-3360
[email-masked]

product.
>> It has been six days, I'd like to hear from more people about this
document.  Martin asked for an additional week, so I'm sure we will hear
from him soon.

---

From: Alex Bobotek <[email-masked]>
Date: Mon, 30 Sep 2013 17:06:14 -0700

Here are several comments that should feed into the IETF Peterson draft:  

*	Remove any assumptions that the solution cannot be in-network [IMO, both endpoint and in-network solutions should be facilitated]
*	Add a sessionless attack scenario.  A spam payload may be carried in a SIP INVITE or MESSAGE, which might contain stock market advice even in a display name field.  These attacks do NOT require session establishment.  More generally, we should be mindful of the fact that SIP is used in telephony form more than voice session setup.   

Here's some suggested markup:

1.    Replace 2nd sentence of 2nd paragraph of 1.0 Introduction with:

The primary attack vector is
   therefore one where the attacker contrives for the calling telephone
   number in signaling to be a particular chosen number that the
   attacker does not have the authority to call from.  

2.  Replace 3rd paragraph of 2.1 Endpoints with:

      Smart devices are generally based on computers with some degree of programmability, the capacity to access the Internet, and capabilities of rendering text, audio and/or images.  This includes smart phones, telephone applications on desktop and laptop computers, IP private branch exchanges, and so on.

3.  Add to 3.3 Attack Scenarios:

	Impersonation, IP-Mobile Text Message

  	 An attacker with an computer sends a high volume of SIP MESSAGE spam message to IP-enabled smart phones using randomized calling party numbers.  

   	Countermeasure: in-band authenticated identity

Regards,

Alex

> Richard Shockey
> Sent: Monday, September 30, 2013 1:11 PM
> To: 'DOLLY, MARTIN C'; 'Robert Sparks'
> Cc: [email-masked]
> >>> Should the working group adopt this I-D as the starting point for
> >>> the
> STIR threat docuent?
> >>>
> >>> Russ