Advanced Flooding Attack on a SIP Server

1. Advanced Flooding Attack on a SIP Server Xianglin Deng, Canterbury University Malcolm Shore, Canterbury University & Telecom NZ

2. SIP Protocol • SIP is used as the connection mechanism for IP-based multimedia services, including VoIP • SIP is normally deployed as a service not requiring user authentication • SIP can be configured to operate in authenticated mode

3. SIP Flooding • SIP is vulnerable to flooding attacks. A typical attack would be an INVITE flood. Attacker SIP Proxy SIP Client INVITE TRYING RINGING INVITE TRYING Busy here INVITE TRYING Busy here INVITE TRYING Busy here INVITE TRYING Busy here INVITE TRYING Busy here

4. SIP Flooding • SIP with authentication is more vulnerable to flooding attacks. Attacker SIP Proxy SIP Client INVITE …nonce generate and store 407 …nonce generate and store INVITE 407 …nonce generate and store INVITE 407 …nonce generate and store INVITE 407 INVITE …nonce generate and store 407 …nonce generate and store INVITE 407

5. SIP Flooding • Firewalls can provide SIP anti-flooding protection. INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE Blocked… INVITE INVITE INVITE INVITE INVITE

6. SIP Flooding • We can defeat the firewall anti-flooding mechanism INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE INVITE

7. SIP Flooding • We propose an Security Enhanced SIP System (SESS) • Non authenticated SIP Proxy with optional firewall authentication • Involves enhancement of the firewall with predictive nonce checking (Rosenberg) • Involves priority queues (Ohta) • The SIP proxy maintains known user lists (D’Souza) • Incorporates a synchronisation protocol (KASP) • We enhance the predictive nonce checking, priority queues and user lists

8. Client SIP proxy server INVITE/REGISTER Generate predictive nonce 407/401 Nonce, realm Compute response= F(nonce,username,password,realm) INVITE/REGISTER nonce,realm, username,response Authentication: Compute F(nonce,username,password,realm) And compare with response Predictive Nonce Checking • Rosenberg 2001

9. Improved Nonce Checking

10. Priority Queues • Ohta 2006 • Assign different priority to SIP INVITE messages

11. Improved Priority Queues • Assign priorities based on the source IP address. • VoIP service provider would benefit from giving frequent users higher priorities

12. User Lists • D’Souza 2004 • Assigns high priority to known hosts

13. Improved User Lists • Enforce authentication on unknown hosts • Defines a dual-stage list • Adds expiry to the lists

14. KASP Packet Structure

15. Timer expire interrupt Is ACK? Reset Timer, update received time Yes Yes No Is a fu? Extract Source IP addr No In fu? No Yes Process SIP message No Yes Last call made in time t? In nu? Remove user from nu Remove user from fu No Yes Add user to nu, Promote user to fu, update received time Reset Timer, Send Update firewall info nu = userlist fu = frequent userlist SESS Listen on incoming packets

16. JAIN SLEE • Advantages: • it is designed for telecommunications low latency and high throughput environments (10-20 calls per second per CPU; ~10 events per call; <200ms RTT) • Its container-based infrastructure enables easy integration of new services and technologies • Better availability and scalability through clustering • A high-level programming language-JAVA is used – reduce the time to market

17. JAIN SLEE • JAIN SLEE main operation • When a message arrives at SLEE, it will first go through a resource adapter; • The resource adapter wraps the message, and sends it to an activity context; • SBBs that have subscribed to the activity context will receive the event, and process it.

18. SESS implementation • Modified the SIP proxy SBB • Observations on Use of JAIN SLEE • Enhancement was possible with existing knowledge of Java • Modifications easy/low risk due to component architecture resulting from JAIN SLEE approach • Enhancement completed and tested in 3 days • High level of confidence in the resulting server • Much simpler and so more reliable than C • No opportunity to trial throughput or availability claims • Existence of many Java Libraries provides rich source of re-useable code

19. Experimental Results Average setup delays: = 9.39;(7.06)7.14;0.675;0.487 seconds

20. Experimental Results No discernable impact on the SIP proxy CPU … no INVITE flood attack packets penetrate

21. SIP ACK flooding Average setup delay = 5.9 seconds 500 Server Internal error occured

22. Temporary User List • ACK Flood can still penetrate the SESS protection • We use a temporary user list to ensure that ACKs cannot be accepted without an INVITE INVITE 407 INVITE INVITE INVITE KASP+nu OK OK OK ACK ACK ACK

23. User 2000 makes 1st call Firewall SIP Proxy Internal client INVITE INVITE Temp. Allow User Internet INVITE 200OK 200OK ACK ACK Update user list ACK User 2000 makes 2nd call Voice stream INVITE INVITE INVITE 200OK 200OK ACK ACK Voice stream = Security-enhanced SIP proxy process = Improved Predictive nonce checking process ISESS

24. Experimental results Average setup delays: = 9.39; 8.356; 1.147; 0.975 seconds

25. SIP ACK FLOODING Average setup delays: = 0.815 seconds

26. Experimental Results With ISESS, no ACK flood packets penetrate

27. Conclusion • SIP is vulnerable to flooding attack • Commercial anti-flooding mechanisms can be defeated • Current research provides some mitigation but is incomplete • ISESS synthesises and extends current research into a substantially more complete solution to the problem of SIP flooding

28. Questions?