[MMUSIC] ICE TCP and TCP amplification attack (mitigation)

[Ari Keranen <[e-mail]>]

Hi all,

Flemming identified a possible TCP amplification attack in ICE TCP:

On May 10, 2011, at 5:06 AM, Flemming Andreasen wrote:
> - Section 12
> I believe there is a TCP amplification attack similar to the STUN amplification attack that requires consideration, since the TCP connection is established prior to any STUN/ICE checks and involves TCP state creation on the part of the attacked party.

That is, an attacker could put in the SDP offer a set of passive reflexive candidates with the address of the victim and the answerer would make a bunch of TCP connections towards the victim.

A possible mitigation, as Flemming suggested, would be to limit the number of outstanding TCP connection attempts to the same IP-address. That sounds reasonable to me, since having many (un-frozen) candidates from the same IP address seem unlikely anyway, but are there any other ideas?


Cheers,
Ari