[VOIPSEC] Actual Attacks

[Geoff Devine]

Brian Rosen writes:

> Okay, but what is the difference between a DoS attack on the SBC
> and a DoS attack on the endpoint?  

The difference is that even a trivial DoS attack will take out a
residential broadband connection.  The pipe to the end user is easy to
fill and the processor on the endpoint device is easy to saturate.  All
the customer knows is that they can't make phone calls.  A box
engineered to handle multiple wire speed Gig-Es has significantly more
resources so it takes far more resources for the attacker to deny
service.  The pipes are orders of magnitude bigger.  The processors are
engineered so they don't saturate at full load.  The box is actively
monitored so the service provider is well-aware that an attack is
happening.

> And what makes you think that making the endpoint "anonymous", but
> addressable (albeit indirectly) stops a DoS attack?

The endpoint is indirectly addressable only while a media stream service
flow is established and that is from one specific IP address for a
relatively short period of time.  The SBC has a policy to shape media
traffic that exceeds a specified flow spec. The SBC has policy to
prevent signaling from unknown SIP Proxies.  You can install a policy to
shape signaling traffic to limit damage from spoofing/replay attacks.
If you're running security on the SIP interface between the SIP Proxy
and the SBC, you can also protect from spoofing on the signaling
interface.

> This is a form of security by obscurity, and does not offer any real
> security.  

I disagree.  Part of security is privacy.  You maintain privacy by
encrypting the payload and anonymizing the IP address.

> SBCs may have some positive security benefits, but
> anonymization of the addresses is not one of them.  In  fact it makes
> the system more brittle by increasing the number of vulnerablilities
> (you have two chances to have a broken implementation instead of one).


The algorithm run inside an SBC isn't all that different from the
NAT/Firewall run in virtually every residential and corporate edge
router.  Are you saying the internet as it exists today is unworkable
because of broken implementations?

Geoff