[VOIPSEC] Anyone aware of public disclosures of security incidents related to SIP trunks?

[Olle E. Johansson]

24 dec 2009 kl. 09.36 skrev Victor Pascual Avila:

> Hi,
> 
> On Thu, Dec 24, 2009 at 1:18 AM, ed guy <edguy at emcsw.com> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>> 
>> On 12/22/09 6:09 AM, J. Oquendo wrote:
>>> 
>>>> DY> Right.  An attacker could potentially spoof the IP and trigger
>>> many SIP INVITES, but would not be able to receive the return traffic
>>> and launch the actual call.
>>> 
>> Dan,
>> 
>> This threat is one of the reasons why sip identity (rfc 4474) is
>> available for asterisk
>> and openser/kamilio.   With the right configuration, it allows you set
>> control access
>> without significantly impacting Post Dial Delay.   e.g., after the
>> identity is authenticated,
>> one can make admittance decisions based on the identity or signer.
> 
> For the sake of completeness:
> http://tools.ietf.org/html/draft-elwell-sip-e2e-identity-important-03#section-3.5
> 
> "The reason SIP Identity does not work in common situations is that
> B2BUAs, and in particular Session Border Controllers (SBCs), have
> reasons to change some parts of the signed information when forwarding
> a SIP request, thus breaking the signature."
> 
Absolutely an issue.

Also, SIP identity is based on "someone else" assuring the identity of a SIP user. While this may work in some situations, is far from a complete solution.

/O