[MMUSIC] ICE Issue #10: ICE hammer

The ICE spec talks about the voice hammer attack. This is a particularly 
devastating attack, where an attacker sends an INVITE, and places the 
IP/port of a target in the m/c-line. THe answerer, if its an automata 
(like a voicemail server) will answer and send media to the target.

ICE prevents this attack, by making sure you don't send media until a 
check succeeds. However, the checks themselves are sent out at a pace of 
one every 50ms. This opens another attack, whereby an attacker can send 
a SIP INVITE with lots of candidate lines, each of which points to the 
same host or network, with the objective of flooding that network.

This may not be much better than the voice hammer itself, except that 
its fairly limited in duration. THis is especially true if we allow 
checks to get paced faster, on par with the media stream itself.

So, it would be good to try and do something to reduce the impact of the 
ICE checks themselves. Some possibilities:

1. limit the number of candidates permitted for any media stream
2. limit the number of candidates with the same IP address for any media 
stream (this would protect a host but not a network)
3. slow down the pacing of new ICE checks if the previous doesn't 
succeed (will impact call setup times)

I like (2). Option (1) will require us to pick the number. I'm not that 
fond of (3).

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@cisco.com                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

_______________________________________________
mmusic mailing list
mmusic@ietf.org
https://www1.ietf.org/mailman/listinfo/mmusic