Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt)

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 4 Feb 2014 02:17:03 +0000

Thanks for these notes.

I¹ve incorporated these ideas into Section 3 in a number of different
locations.

I did not however introduce text based on impersonating a calling name,
versus a calling number. We have a particular scope distinction here
between STIR and the proposed CNIT work, and the STIR threat scope doesn¹t
include protecting against name impersonation. I have tried to add to the
voicemail and robocalling cases some language describing ³analogous²
attacks along the lines that you describe below, so they will be less
narrow, but I think they are the main attacks discussed in the problem
statement and they merit a place of prominence here.

Good catch on the redundancy at the end of 2.1, that has been zapped.

Jon Peterson
Neustar, Inc.

On 1/26/14, 10:39 AM, "David Frankel" <[email-masked]> wrote:

>Just a few more thoughts on the sorts of "attacks" (or at least abuses)
>that
>involve Caller-ID, which I think support the sort of distinction Penn is
>making:
>
>1) Robocalling / SPIT: The caller's objective is to get the called party
>to
>answer the phone and engage in some interaction (initially automated, then
>human). Caller-ID is manipulated for at least three reasons:
>
>A. Encourage the called party to answer (or at least discourage them from
>ignoring the call).
>
>B. Provide anonymity; avoid trace-back; evade blocking schemes.
>
>C. Lend credibility to the call.
>
>These objectives can be achieved to varying degrees through several
>mechanisms including: misappropriating a number belonging to some
>legitimate
>institution, or by using a (perhaps random) number from the local calling
>area (making it look like a neighbor or local business), or by acquiring
>numbers specifically for this purpose (see, for example,
>www.callerid4u.com,
>which permits their clients to associate a specific calling NAME with an
>acquired number).
>
>These are "mass calling" campaigns where, typically, the called party is
>non-specific.
>
>2) Denial-of-Service: The caller attacks a specific target (PSAP, other
>service provider, or even an individual), perhaps as part of an extortion
>scheme. Caller-ID is manipulated primarily to provide anonymity, avoid
>trace-back and evade blocking, using schemes similar to those noted above.
>
>3) Impersonation / Hacking: By using a specific caller-ID belonging to a
>particular individual, the caller is trying to gain access to an
>institution
>or system that relies on caller-ID for "authentication." Voice-mail
>hacking
>is perhaps the most obvious example (and is not specific to "mobile"
>telephones noted in first sentence of 3.1), but there are other systems in
>use at banks, airlines, calling-card services, conferencing providers,
>ISPs
>and other "customer support" operations where callers are fully or
>partially
>granted access to information or services based on caller-ID.
>
>4) Impersonation targeting an individual: The caller uses an ID with some
>"trust" association to fool the called party for nefarious purposes. For
>example, a student-loan debt collector might call you with the ID of your
>bank or mortgage lender or even your employer to add credence to some
>threat
>if you don't pay up. Or an estranged spouse/parent might call a women's
>shelter using "POLICE" or "FBI" to extract the whereabouts of somebody
>they
>seek to harm or kidnap.
>
>I'm not suggesting all this go into the document; just trying to help
>clarify the range of threats and nuances associated therewith. (Perhaps
>some
>of this could augment section 3.)
>
>Also, by the way, the last two paragraphs of section 2.1 appear to be
>near-duplicates (assuming I'm looking at the latest version).
>
>David Frankel
>ZipDXR LLC
>
>-----Original Message-----
>From: stir [mailto:[email-masked]] On Behalf Of PFAUTZ, PENN L
>Sent: Sunday, January 26, 2014 7:42 AM
>To: 'Peterson, Jon'; [email-masked]
>Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG
>Last Call on draft-ietf-stir-threats-00.txt)
>
>Thanks, Jon
>I'll defer to you on terminology. I do think that the attack sections 3.1
>and 3.2 should be made more generic along the lines I suggest:
>-impersonation to hide caller identity (e.g., in support of robocalling)
>-impersonation of the specific identity associated with the calling number
>(voicemail hacking, phishing)
>
>Penn Pfautz
>AT&T Access Management
>+1-732-420-4962
>

---

From: "PFAUTZ, PENN L" <[email-masked]>
Date: Wed, 5 Feb 2014 20:52:50 +0000

Jon:
This will do.

Penn Pfautz
AT&T Access Management
+1-732-420-4962

-----Original Message-----
From: Peterson, Jon [mailto:[email-masked]]
Sent: Monday, February 03, 2014 9:17 PM
To: PFAUTZ, PENN L; [email-masked]
Subject: Re: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last Call on draft-ietf-stir-threats-00.txt)

I've added these to a brief subsection before the attacks (there are now
three attacks that follow, including TDoS) which provides an introduction,
dividing attackers' techniques into your two categories, and then says
that "concrete attacks" based on those techniques are given in the
following sections. Good enough?

Jon Peterson
Neustar, Inc.

On 1/26/14, 7:41 AM, "PFAUTZ, PENN L" <[email-masked]> wrote:

>-impersonation of the specific identity associated with the calling
>number (voicemail hacking, phishing)
>
>Penn Pfautz
>AT&T Access Management
>+1-732-420-4962
>From: Peterson, Jon [mailto:[email-masked]]
>Sent: Friday, January 24, 2014 9:48 PM
>To: PFAUTZ, PENN L; [email-masked]
>>I'd like to suggest a somewhat different taxonomy for the document:
>
>Thanks for these notes, Penn.
>
>>I think there is one basic threat:  delivery of a calling number that the
>>caller is not authorized to use.
>>This threat enables two kinds of attacks building on that threat:
>>-impersonation of the specific identity associated with the calling
>>number (voicemail hacking, phishing)
>
>I went through a spin on this document already with Steve Kent about what
>should be considered an ³attack² versus a ³threat² versus what have you. I
>take it in the security community these are terms with a particular
>meaning, and I tried to bring the text here into conformance with his
>guidance. I don¹t think we¹d say the ³threat² is the delivery of the
>calling number in that fashion; that¹s a technique used by attackers to
>accomplish their attacks.
>
>>I think the " Endpoints" section might be better called "Targets"
>
>In the architecture that the Actors section describes, endpoints originate
>calls and receive them, and so necessarily originators of calls aren¹t in
>that sense ³targets.² There goal of the Actors section is to explain who
>the all parties are that originate, forward, and receive calls, just so
>the Attacks and Attack Scenarios can refer to these.
>
>>Section 4.1 on solution specific attacks either needs to be expanded with
>>sufficient detail to be meaningful or else deleted before the document
>>can become and RFC.
>
>Here, agreed. I don¹t want to lose those bullet points though; maybe the
>right thing to do is to just say that these points are out of scope, but
>that future work should remember to consider issues like these.
>
>Jon Peterson
>Neustar, Inc.
>
>>Penn Pfautz
>>AT&T Access Management
>>+1-732-420-4962
>>
>>From: stir [mailto:[email-masked]] On Behalf Of Robert Sparks
>>Sent: Tuesday, January 21, 2014 12:14 PM
>>To: [email-masked]
>>Subject: [stir] WG Last Call Extended : Responses Needed (was Re: WG Last
>>Call on draft-ietf-stir-threats-00.txt)
>>
>>There have been no on-list responses to this last call.
>>We're extending it through this Friday, Jan 24.
>>
>>Please let us know that you've reviewed this document and believe it is
>>ready for publication, or if you have any issues that still need to be
>>resolved.
>>Capturing your review on list is important, even if it's just a "ready"
>>note.
>>
>>RjS
>>
>>
>>On 1/2/14, 11:46 AM, Russ Housley wrote:
>>> The authors have posted an updated Internet-Draft on the STIR threat
>>>model.  It can be found here:
>>>http://www.ietf.org/id/draft-ietf-stir-threats-00.txt.
>>>
>>> Is this document ready for the STIR WG to pass to the IESG, requesting
>>>publication as an Informational RFC?  Please provide your input on this
>>>mail list by end-of-business on 16 January 2014.  If you have issues or
>>>concerns, please tell us what changes to the document are necessary to
>>>resolve them.
>>>
>>> Russ
>>>
>>> _______________________________________________
>>> stir mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/stir
>>
>>_______________________________________________
>>stir mailing list
>>[email-masked]
>>https://www.ietf.org/mailman/listinfo/stir
>>_______________________________________________
>>stir mailing list
>>[email-masked]
>>https://www.ietf.org/mailman/listinfo/stir
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 14 Feb 2014 14:45:18 -0500

https://datatracker.ietf.org/doc/draft-ietf-stir-threats/

The -02 version has been posted, and some people have indicated that their concerns were resolved.  Please speak now if you have any lingering concerns.

Russ

On Jan 2, 2014, at 12:46 PM, Russ Housley wrote:

> The authors have posted an updated Internet-Draft on the STIR threat model.  It can be found here: http://www.ietf.org/id/draft-ietf-stir-threats-00.txt.
> 
> Is this document ready for the STIR WG to pass to the IESG, requesting publication as an Informational RFC?  Please provide your input on this mail list by end-of-business on 16 January 2014.  If you have issues or concerns, please tell us what changes to the document are necessary to resolve them.
> 
> Russ