Columbia - Verizon Research Security : VoIP Denial-of-Service Somdutt B. Patnaik Gaston Ormazabal Columbia University Verizon Labs CS Department Friday, November 09, 2018Friday, November 09, 2018

Agenda Project Overview Previous Work Problem Areas Goals The SIP Threat Model DoS attack taxonomy Detection and Mitigation strategy Testbed and Validation strategy Demo Discussion Friday, November 09, 2018Friday, November 09, 2018

Previous Work Successfully implemented a large scale SIP-aware Firewall (using dynamic pinhole filtering) The filter is used as a first-line of defence against DoS attacks at the network perimeter and it enforces the following: Only signalled media channels can traverse the perimeter End systems are protected against flooding of random RTP or other attacks. End-points are dumb, we focus on signaling services Friday, November 09, 2018Friday, November 09, 2018

Extension to Previous Work The firewall(pinhole filtering) approach is a great first-line of defense but it does not address the following: Attackers can still traverse the perimeter through the signalling port and media ports; viz., Pinholes cannot distinguish legitimate from illegitimate traffic This lead us to define the new problem... Friday, November 09, 2018Friday, November 09, 2018

Mitigation Solution Schematic Description Untrusted Trusted Filter I Filter II sipd DPPM SIP SIP SIP VoIP Traffic Attack Traffic RTP RTP Friday, November 09, 2018Friday, November 09, 2018

Motivation Telephony services migrating to IP become an attractive DoS attack target Attack traffic that traverses the perimeter could target the availability of signalling VoIP service Attack targets could be supporting services (e.g. DNS), SIP infrastructure elements (proxy, softswitch, SBC) and end-points (SIP phones) Friday, November 09, 2018Friday, November 09, 2018

VoIP Threat Taxonomy (adopted from VOIPSA) Scope of our research Refer to http://www.voipsa.org for more details on this taxonomy Friday, November 09, 2018Friday, November 09, 2018

Scope of Our Research Scope of current work Friday, November 09, 2018Friday, November 09, 2018

Goals Study VoIP DoS Definition – define VoIP specific threats Detection – how do we detect an attack? Mitigation – defence strategy and implementation Validation – validate our defence strategy Generate requirements for future security network elements and test tools for their validation Friday, November 09, 2018Friday, November 09, 2018

THE SIP THREAT MODEL REFERENCES: VoIP Security and Privacy Threat Taxonomy, VoIPSA October 2005 Friday, November 09, 2018Friday, November 09, 2018

The SIP Threat Model Eavesdropping Impersonation of a SIP entity Interception and modification of SIP messages Service Abuse Denial of Service Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (1) Eavesdropping Attacker can monitor signalling/media streams, but cannot or does not alter data itself Signalling channel is not confidential Call Pattern Tracking Discovery of identity, affiliation, presence Traffic Capture Packet recording Number harvesting Unauthorized collection of numbers, emails, SIP URIs Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (2) Impersonating of a SIP entity Impersonate a UA Absense of assurance of a request's originator Registration Hijacking – attacker deregisters a legitimate contact and registers its own device for that contact Impersonate a Server UAs should authenticate the server to whom they send requests Attacker impersonates a remote server and intercepts the UA's request Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (3) Interception and modification of SIP messages Man-in-the-middle attack UA is using SIP to communicate media session keys Call Re-routing Attacker might modify the SDP in order to route media streams to a wire-tapping device Conversation Degradation Attacker might cause intentional reduction in QoS False Call Identification Change “Subject” so message considered Spam Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (4) Service Abuse Call Conference Abuse Hide identity for the purpose of committing fraud Premium Rate Service Fraud Artificially increase traffic in order to maximize billing Improper Bypass or Adjustment to Billing Avoid authorized service charge by altering billing records Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (5) Denial of Service Denial-of-Service – preventing users from effectively using the target services Complete loss of service Service degradation to a “not usable” point Distributed denial-of service attacks continue to be the main threat facing network operators* Most attacks involve compromised hosts (bots), with botnets sized from a few thousands to over 100,000* *- Worldwide ISP Security Report, September 2005, Arbor Networks Friday, November 09, 2018Friday, November 09, 2018

SIP Threat Model details (6) Denial of Service (contd.) Worldwide ISP Security Report, September 2005, Arbor Networks Friday, November 09, 2018Friday, November 09, 2018

SIP Denial of Service Attacks – A detailed view Friday, November 09, 2018Friday, November 09, 2018

DoS Attack Taxonomy Implementation flaws Application level Flooding Implementation flaws – codenomicon (PROTOS), Oulu university Conclusions – not focusing on implementation flaws, protos signatures could be integrated with a firewall device Friday, November 09, 2018Friday, November 09, 2018

DoS Attack Taxonomy details (1) Implementation flaws Attacker send carefully crafter packet(s) that exploits a specific implementation flaw Target vulnerability might originate in different levels of the network protocol stack or in the underlying OS/firmware. Might cause excessive memory/disk/CPU consumption and/or system reboot or crash Examples could be: The ping-of-death attack – used to target a bug in the implementation of the IP stack Invalid call setup messages - sending a number of invalid calls set up messages (e.g., ACKs when none is expected) that could cause the endpoint to crash, reboot, or exhaust all its resources. Invalid media - - injection of invalid media into the call processor by the caller or by a third party (by guessing the appropriate control headers of the media stream) could cause the endpoint to crash, reboot, or exhaust all call processing capacity. Dynamic pinhole filtering can help alleviating the problem by blocking media sent by hosts that are not part of the signaled call. A more sophisticated attacker might spoof the IP address of a host that participates in the call and then inject invalid media to the call. Malformed signaling - sending malformed SIP messages (e.g., unusually long or syntactically incorrect) to the UA degrading its performance resulting in inability to process normal messages, setup and teardown calls - testing tools such as PROTOS condumnicom Friday, November 09, 2018Friday, November 09, 2018

DoS Attack Taxonomy details (2) Application level – a feature of SIP is manipulated to cause a DOS attack Registration Hijacking Attacker registers his device with another user's URI Call Hijacking Attacker can inject a “301 Moved Permanently” message to an active session Modification of media sessions Attacker can spoof re-INVITE messages thereby reducing QoS, redirecting media, modifying security attributes Attacker can request arbitrarily large bandwidth in SDP thereby choking the available bandwidth of the proxy Friday, November 09, 2018Friday, November 09, 2018

DoS Attack Taxonomy details (3) Application level (Contd.) Session teardown Attacker can spoof a BYE message and inject it to an active session thereby tearing down the session Amplification attacks Attacker can create bogus requests with falsified Via header field that identifies a target host UAs/proxies generates a DDoS against that target Media streams attack Attacker can inject spoofed RTP packets with high SEQ numbers into the media streams thereby changing the playout sequence Friday, November 09, 2018Friday, November 09, 2018

DoS Attack Taxonomy details (4) Flooding Attacker can flood the network link or overwhelm the target host Usually requires more resources from the attacker Harder to defend against – even the best maintained networks can become congested Variant could be: UDP floods, ICMP echo attacks, SYN floods, etc. Floods of INVITE or REGISTER messages could cause excessive processing at a SIP proxy UDP floods, SYN attacks can be protected by other products in the market. I.e. Arbor Networks, Cisco/Riverhead Technologies For sip threre is no solution and this is where we come, It’s like “peeling the onion” Friday, November 09, 2018Friday, November 09, 2018

Our Mitigation Strategy Friday, November 09, 2018Friday, November 09, 2018

Basic Strategy and motivation Implementation flaws are easier to deal with: Systems can be tested before used in production Systems can be patched when a new flaw is discovered Attack signatures could be integrated with a firewall Application level and flooding attacks are harder to defend against SIP end-points are “dumb” - try to defend SIP infrastructure elements There are commercially available solutions for general UDP/SYN flooding (Arbor Networks, CISCO/Riverhead) but none for SIP Friday, November 09, 2018Friday, November 09, 2018

Main Focus of our Strategy... VULNERABILITY: A common vulnerability to SIP over UDP attacks is the ability to spoof SIP requests Registration/Call Hijacking Modification of Media sessions Session teardown Request flooding Bandwidth over-claim using SDP requests MITIGATION: Perform return routability check For UDP use SIP's built-in digest authentication mechanism Use null-authentication when no shared secret is established Rate-limit spoofed sources Maintain a Cloudshield CAM database of INVITE IPs to verify and accept a BYE message only from legitimate IP addresses Limit bandwidth grants to SDP requests (based on some heuristics) For TCP perform SYN relay Friday, November 09, 2018Friday, November 09, 2018

The Scheme sipd DPPM VoIP Traffic Attack Traffic Untrusted Trusted Filter I Filter II sipd DPPM SIP SIP SIP VoIP Traffic Attack Traffic RTP RTP Friday, November 09, 2018Friday, November 09, 2018

SIP Digest Authentication (1) User Agent Client (UAC) Proxy Server INVITE Generate the nonce value 407 Proxy Authentication Required (nonce, realm..) (nonce, response…) Authentication: compute F(nonce, username, password, realm) and compare with response ACK nonce – a uniquely generated string used for one challenge only and has a life time of X seconds Compute response = F(nonce, username, password, realm) Friday, November 09, 2018Friday, November 09, 2018

SIP Digest Authentication (2) The introduction of digest authentication accounts for nearly 80% of processing cost of a stateless server and 45% of a call stateful server* 70% of additional cost is for message processing and 30% for authentication computation (hashing)* we can see that using authentication has a performance price. This is why we suggest to use the cloudshield to protected the proxy from generating a lot of challenges *- SIP Security Issues: The SIP Authentication Procedure and its Processing Load, Salsano et al., IEEE Network, November 2002 Friday, November 09, 2018Friday, November 09, 2018

Mitigation Solution Overview Untrusted Trusted Filter I Filter II sipd DPPM SIP SIP SIP VoIP Traffic Attack Traffic RTP RTP Friday, November 09, 2018Friday, November 09, 2018

Mitigation Implementation (1) Use the Cloudshield to rate-limit SIP authentication attempts to the proxy Use the firewall controlling proxy model Columbia's SIP Proxy sipd controls the Cloudshield 2000 Deep Packet Inspection Server Utilize wire-speed deep packet inspection State is only kept at Cloudshield Utilize the Firewall Control Protocol to establish filters in real time Insert filters for SIP UAs that are being challenged Friday, November 09, 2018Friday, November 09, 2018

Mitigation Implementation (2) Return-Routability Succeeds INVITE sip:test1@cs.columbia.edu SIP/2.0 Via: SIP/2.0/UDP 128.59.21.70:5060 Max-Forwards: 70 From: sip:test5@cs.columbia.edu To: sip:test1@cs.columbia.edu Contact: sip:test5@128.59.21.70:5060 Subject: sipstone invite test CSeq: 3 INVITE Call-ID: 1736374800@lagrange.cs.columbia.edu Content-Type: application/sdp Content-Length: 211 Proxy-Authorization: Digest username="anonymous", realm="cs.columbia.edu", nonce="6ydARDP51P8Ef9H4iiHmUc7iFDE=", uri="sip:test1@cs.columbia.edu", response="0480240000edd6c0b64befc19479924c", opaque="", algorithm="MD5"   v=0 o=user1 53655765 2353687637 IN IP4 128.59.21.70 s=Mbone Audio t=3149328700 0 i=Discussion of Mbone Engineering Issues e=mbone@somewhere.com c=IN IP4 128.59.21.70 t=0 0 m=audio 3456 RTP/AVP 0 a=rtpmap:0 PCMU/8000 INVITE, Proxy-Authorization INVITE INVITE sip:test1@cs.columbia.edu SIP/2.0 Via: SIP/2.0/UDP 128.59.21.70:5060 Max-Forwards: 70 From: sip:test5@cs.columbia.edu To: sip:test1@cs.columbia.edu Contact: sip:test5@128.59.21.70:5060 Subject: sipstone invite test CSeq: 1 INVITE Call-ID: 1736374800@lagrange.cs.columbia.edu Content-Type: application/sdp Content-Length: 211   v=0 o=user1 53655765 23587637 IN IP4 128.59.21.70 s=Mbone Audio t=3149328700 0 i=Discussion of Mbone Engineering Issues e=mbone@somewhere.com c=IN IP4 128.59.21.70 t=0 0 m=audio 3456 RTP/AVP 0 a=rtpmap:0 PCMU/8000 407 Needs Auth SIP/2.0 407 Proxy Authentication Required Via: SIP/2.0/UDP 127.0.0.1:7898 From: sip:test5@cs.columbia.edu To: sip:test1@cs.columbia.edu; tag=2cg7XX0dZQvUIlbUkFYWGA Call-ID: 1736374800@lagrange.cs.columbia.edu CSeq: 1 INVITE Date: Fri, 14 Apr 2006 22:51:33 GMT Server: Columbia-SIP-Server/1.24 Content-Length: 0 Proxy-Authenticate: Digest realm="cs.columbia.edu", nonce="6ydARDP51P8Ef9H4iiHmUc7iFDE=", stale=FALSE, algorithm=MD5, qop="auth,auth-int" Mitigation Implementation (2) Return-Routability Succeeds Untrusted Trusted DPPM sipd SIP UA Add Filter (128.59.21.70, ”nonce”) Remove Filter (128.59.21.70, ”nonce”) NPU 407 Needs Auth INVITE, Proxy-Auth INVITE INVITE CAM RAM IP 128.59.21.70 (128.59.21.70, nonce="6ydARDP51P8Ef9H4iiHmUc7iFDE=" ) Friday, November 09, 2018Friday, November 09, 2018

Mitigation Implementation (3) Return-Routability Fails Untrusted Trusted DPPM sipd SIP UA NPU Add Filter (1.2.3.4,”nonce”) INVITE INVITE 407 Needs Auth INVITE X 407 Needs Auth CAM RAM IP 1.2.3.4 (1.2.3.4, nonce="6ydARDP51P8Ef9H4iiHmUc7iFDE=" ) Friday, November 09, 2018Friday, November 09, 2018

Mitigation Implementation (5) Integrated DDOS and Dynamic Pinhole filter Linux server ASM sipd SIP SIP DDOS Table CAM DPPM FCP/UDP Static Table CAM CAM Dynamic Table ***This diagram will be important to have in a working version to include in the final paper to be sent for publication. Outbound Inbound Lookup Switch Drop Friday, November 09, 2018Friday, November 09, 2018

Testbed and Validation Strategy SIPStone SIPStone is benchmarking tool for SIP proxy and redirect servers SIPStone attempts to measure the request handling capacity of a SIP server or a cluster of servers The implementation performs a series of tests that generates a pre-configured workload For our project SIPStone was enhanced with: Null digest authentication Optional spoofed source IP address SIP requests Friday, November 09, 2018Friday, November 09, 2018

Testbed and Validation Strategy Methodology Use the SIPStone testing tool in a distributed environment to generate SIP traffic Generate both spoofed and legitimate source address requests Measure the following calls/sec throughput values: Legitimate requests, without authentication (Capacity) Legitimate requests, with authentication (Normal) Legitimate and spoofed requests, without authentication (Attack) Legitimate and spoofed requests, with authentication (Defense) Identify the impact of spoofed addresses floods on the calls/sec rate of legitimate requests We should see A << N, and ideally, D = N Friday, November 09, 2018Friday, November 09, 2018

Testbed Architecture SIP Proxy Legitimate Loaders (SIPStone) Attack Call Handlers (SIPStone) Controller (SIPStone) GigE Switch GigE Switch The Cloudshield SIP Proxy Friday, November 09, 2018Friday, November 09, 2018

Demonstration Flood of spoofed INVITE requests Session teardown attack Acquire a legitimate UA IP address Send a flood of spoofed INVITE requests using the UA’s IP address While the firewall blocks the attacker source IP, try to send an INVITE from the legitimate UA The UA’s INVITE is blocked Session teardown attack Sniff on the signaling channel Acquire an active session’s dialog identifiers (Call-ID, tags) and UAs SIP URIs Send a spoofed BYE message Friday, November 09, 2018Friday, November 09, 2018

Discussion... Friday, November 09, 2018Friday, November 09, 2018

Impact of TLS on DOS A good number of attacks identified will be eliminated TLS is not ready for “prime time” yet Few IP phone vendors are implementing SIP over TCP, a first step towards TLS Friday, November 09, 2018Friday, November 09, 2018

Conclusions Have demonstrated SIP vulnerabilities Have implemented some “carrier-class” mitigation strategies Have built a validation testbed to measure performance Need to generalize methodology to cover a broader range of cases and apply anomaly detection, pattern recognition and learning systems Friday, November 09, 2018Friday, November 09, 2018

Backup Slides… Friday, November 09, 2018Friday, November 09, 2018

CS-2000 Physical Architecture Deep Packet Processing Module (DPPM) Executes Network Application Inspecting and Controlling Packet Data Real-Time Silicon Database (128 bits wide X 512K long) and Unstructured Packet Processing CAM technology Single or Dual DPPM Configurations for HA, Performance or Multiple Use Physical Connectivity: Gigabit Ethernet and OC-3/OC-12/OC-48 POS Auxiliary Slots Future use for HDD Module Telemetry Inputs/Outputs Optical Bypass/HA Module Application Server Module (ASM) Hardened Linux Infrastructure Hosts Analysis Applications Network Element Management (Web, CLI, SNMP, ODBC) Mandatory Access Control Programmable High Performance packet processing server Deep Packet Processing Modules (DPPM) based on the Intel IXP 2800 Network Interface Card Silicon database (128 bits wide X 512K long) based on CAM technology Packet processing applications written in a propriety language called RAVE and “pushed” to DPPM Separate control processor to store application and management interface Since CAMs are an outgrowth of RAM technology, in order to understand a CAM, it helps to contrast it with a RAM. RAM is an integrated circuit that stores data temporarily. Data is stored in RAM at a particular location, which is called an address. In RAM, the user supplies the address and gets the data back. The number of address lines limits the depth of a memory using RAM, but the width of the memory can be extended as far as desired. With CAM, the user supplies the data and gets the address back. The CAM searches through the memory in one-clock cycle and returns the address where the data is found. The CAM can be preloaded at device startup and rewritten during device operation. CAM can accelerate any application requiring fast searches of databases, lists, or patterns, such as in image or voice recognition, or computer and communication designs. For this reason, CAM is used in applications where search time is critical and must be very short. For example, the search key could be the IP address of a network user, and the associated information could be a user’s access privileges and location on the network. If the search key presented to the CAM is present in the CAM’s table, the CAM indicates a match and returns the associated information, which consists of the user’s privileges. A CAM can thus operate as a data-parallel or single instruction/ multiple data (SIMD) processor. CAM can be used to accelerate any application ranging from LANs, database management, file-storage management, and table look up to pattern recognition, artificial intelligence, fully associative and processor-specific cache memories, to disk cache memories. Although CAM has many applications, it’s particularly well suited to performing search operations. In each one of these applications the user may not know the addresses of words that have particular pieces of information stored within a specific portion of the word length. Intel has IXP 2850 that already includes the crypto accelerator engines necessary to handle TLS Friday, November 09, 2018Friday, November 09, 2018

Session Border Controllers CS2K CALL SERVER COMPLEX XPM ISM SMDI VOICEMAIL SS7 LINKS MS/ENET FLPP STP PAIR CALEA PMA COAM (N240) COAM (N240) IW-SPM MS2010 BCT MAS SSL SESSION MANAGER SSL SYSTEM MANAGER SST SDM CMT/ IEMS MG9K EM XA-CORE SAM21 SIP ERS8600 BEARER LAN ERS8600 CS LAN AER LCR AER AER ADM AER LCR C6509 C6509 MG15K (PVG) ADM GWR SS8 C7206 S/BC S/BC GR303 MG9K OLT SS8 C2950 Session Border Controllers PON PSTN (CLASS 4/5 E911 TOPS AIS) ONT ISG2000 NETSCREEN Friday, November 09, 2018Friday, November 09, 2018 SC3100 SS8 VOICEMAIL