Re: [Speermint] FW: I-D Action:draft-niccolini-speermint-voipthreats-03.txt

Saverio,

The document looks quite good.  On behalf of VOIPSA, I'll say again  
thanks for the mention of the Threat Taxonomy. (I know I've said this  
to you personally in the past but also want to do so publicly.)

A couple of minor nits, mostly related to formatting:

- In sections 2.1.x and 2.2.1-2, you list out individual attacks as  
bullet items.  In section 2.2.3, you mention several attacks but do  
not list them as bullet items.  For the sake of consistency you might  
want to consider doing so.

- Sections 2.1.1 and 2.2.1 do not have introductory sentences but  
purely include bullets. I don't know if you care about being  
consistent with the other sections.

- In section 2.2.3, there is a missing "the" in the first sentence:  
"The LF can be THE object of DoS attacks."

- In section 2.3 there are a couple of places in the first sentence  
where you use "signaling function" but I think to be grammatically  
correct it should be "the signaling function".  (As I wonder if I'm  
going to unleash another grammar rathole... )

- In sections 2.3.2.1 and 2.3.2.2 the bullets suddenly disappeared  
(at least on http://www.ietf.org/internet-drafts/draft-niccolini- 
speermint-voipthreats-03.txt )

- Section 2.4.1 again has no bullets while 2.4.2-2.4.3 do

Like I said, really all just formatting issues.

The only real substantive comment I'll make is to ask this - have you  
considered if there is a threat of what I'll call a "self-inflicted  
DoS" within the SPEERMINT architecture?  By that I mean what happens  
when, for instance, there is a power outage and upon the return of  
power there is a large flood as all the SIP devices send INVITEs to  
the registrar.   Obviously that instance doesn't impact the SPEERMINT  
architecture, but are there similar issues?  For instance,  
misconfiguration of one SIP provider's servers sending a flood of  
bogus packets within the peering fabric?  If there are such  
situations it may make sense to at least mention them in this  
document.  I find that people often focus on the external attackers  
and forget to look at how to protect against internal configuration  
problems that can have the same ultimate effect as an external attacker.

Overall a great document,
Dan

On Feb 22, 2008, at 1:25 PM, Saverio Niccolini wrote:

> Hi,
>
> a new version of the VoIP Threats draft is available.
> Main changes are:
> -- adapted to the terminology draft
> -- added the BCPs
>
> Comments are appreciated,
> Saverio
>
>> -----Original Message-----
>> From: i-d-announce-bounces@ietf.org
>> [mailto:i-d-announce-bounces@ietf.org] On Behalf Of
>> Internet-Drafts@ietf.org
>> Sent: Friday, February 22, 2008 1:45 PM
>> To: i-d-announce@ietf.org
>> Subject: I-D Action:draft-niccolini-speermint-voipthreats-03.txt
>>
>> A New Internet-Draft is available from the on-line
>> Internet-Drafts directories.
>>
>> 	Title           : SPEERMINT Security BCPs
>> 	Author(s)       : S. Niccolini, et al.
>> 	Filename        : draft-niccolini-speermint-voipthreats-03.txt
>> 	Pages           : 22
>> 	Date            : 2008-02-22
>>
>> This memo presents the different security threats related to
>> SPEERMINT classifying them into threats to the Location
>> Function, to the Signaling Function and to the Media
>> Function.  The different instances of the threats are briefly
>> introduced inside the classification.  Finally the existing
>> security solutions in SIP and RTP/RTCP are presented to
>> describe the countermeasures currently available for such
>> threats.  The objective of this document is to identify and
>> enumerate the SPEERMINT-specific threat vectors in order to
>> specify security-related requirements.  Once the requirements
>> are identified, methods and solutions how to achieve such
>> requirements can be selected.
>>
>> A URL for this Internet-Draft is:
>> http://www.ietf.org/internet-drafts/draft-niccolini-speermint-
>> voipthreats-03.txt
>>
>> To remove yourself from the I-D Announcement list, send a
>> message to i-d-announce-request@ietf.org with the word
>> unsubscribe in the body of the message.
>> You can also visit https://www1.ietf.org/mailman/listinfo/I-D- 
>> announce
>> to change your subscription settings.
>>
>> Internet-Drafts are also available by anonymous FTP. Login
>> with the username "anonymous" and a password of your e-mail
>> address. After logging in, type "cd internet-drafts" and then
>> 	"get draft-niccolini-speermint-voipthreats-03.txt".
>>
>> A list of Internet-Drafts directories can be found in
>> http://www.ietf.org/shadow.html or
>> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>>
>> Internet-Drafts can also be obtained by e-mail.
>>
>> Send a message to:
>> 	mailserv@ietf.org.
>> In the body type:
>> 	"FILE
>> /internet-drafts/draft-niccolini-speermint-voipthreats-03.txt".
>>
>> NOTE:   The mail server at ietf.org can return the document in
>> 	MIME-encoded form by using the "mpack" utility.  To use this
>> 	feature, insert the command "ENCODING mime" before the "FILE"
>> 	command.  To decode the response(s), you will need "munpack" or
>> 	a MIME-compliant mail reader.  Different MIME-compliant
>> mail readers
>> 	exhibit different behavior, especially when dealing with
>> 	"multipart" MIME messages (i.e. documents which have been split
>> 	up into multiple messages), so check your local documentation on
>> 	how to manipulate these messages.
>>
>> Below is the data which will enable a MIME compliant mail
>> reader implementation to automatically retrieve the ASCII
>> version of the Internet-Draft.
>>
> ============================================================
> Dr. Saverio Niccolini
> Senior Researcher
> NEC Laboratories Europe, Network Research Division	
> Kurfuerstenanlage 36, D-69115 Heidelberg
> Tel.     +49 (0)6221 4342-118
> Fax:     +49 (0)6221 4342-155
> e-mail:  saverio.niccolini@nw.neclab.eu <-- !!! NEW ADDRESS !!!
> ============================================================
> NEC Europe Limited Registered Office: NEC House, 1 Victoria
> Road, London W3 6BL Registered in England 2832014<draft-niccolini- 
> speermint- 
> voipthreats-03.URL>_______________________________________________
> Speermint mailing list
> Speermint@ietf.org
> http://www.ietf.org/mailman/listinfo/speermint

-- 
Dan York, CISSP, Director of Emerging Communication Technology
Office of the CTO    Voxeo Corporation     dyork@voxeo.com
Phone: +1-407-455-5859  Skype: danyork  http://www.voxeo.com
Blogs: http://blogs.voxeo.com  http://www.disruptivetelephony.com

Bring your web applications to the phone.
Find out how at http://evolution.voxeo.com