Re: [stir] DKIM-like key mgmt approach - MITM

[Stephen Farrell <[e-mail]>]

On 06/12/2013 05:56 PM, Hadriel Kaplan wrote:
> 
> On Jun 12, 2013, at 6:14 AM, Stephen Farrell <[e-mail]> wrote:
> 
>> One concern I have though is whether or not it'd be ok to leave
>> open potential spoof calls launched from e.g. a zombied home router
>> to a callee on the home network. If the final model had exactly
>> the same security properties as DKIM, then that would be an issue.
>> If the final model were based on Brian's 5280-based ideas that
>> threat would probably not be an issue. Or there may be ways to
>> look up a signer public key over a TLS channel that'd work too.
> 
> I understand what a "zombied home router" is and what a "callee on the home network" is, but I don't understand the case you're talking about.  Can you describe the scenario for how the attack would work/behave?

I guess bad-guy hacks my home router, then initiates a call from
or via there to me in my living room making it look like the call
comes from my bank.

If the key management was precisely the same as DKIM's then he'd
be able to feed me a public key to make it look like his signature
is ok for the bank's telephone number since I use my home router
for DNS as well. (Assuming my UA doesn't insist on DNSSEC.)

> One type of attack that we might have to worry about, that might be called a MITM attack because the attacker becomes a type of MITM during the attack: a malicious callee receiving a call and using the received signature to initiate an outbound call during the short time the signature is valid, spoofing the original caller.  
> 
> This is described in:
> http://tools.ietf.org/html/draft-kaplan-sip-baiting-attack-00

Don't have time to read that right now, will look later.

S

> 
> Basically it boils down to us needing to distinguish legitimate call-forwarding from malicious call-forwarding.  Unfortunately none of the possible solutions for it are very palatable, imho.
> 
> -hadriel
> 
> _______________________________________________
> stir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/stir
> 
>