Denial of Services on SIP VoIP infrastructures

Transcription

1 Denial of Services on SIP VoIP infrastructures Ge Zhang Karlstad University 1

2 Outline Background Denial of Service attack using DNS Conclusion 2

3 VoIP What is VoIP? What is its advantage? Cost Integration Easy-to-use What is its disadvantage? Reliability (no emergency call with skype (or other VoIP)!) Quality of Service Security 3

4 Session Initiation Protocol (SIP) SIP: an signalling protocol for creating, modifying and terminating VoIP sessions. SIP network elements: User Agents (UA), Proxy Server, Registrar, Location Server. Modeled on HTTP, user identity is similar to address (e.g., 4

5 Where s SIP SDP Application SIP RTP DNS(SRV) Transport TCP UDP Network IP Physical/Data Link Ethernet 5

6 SIP Call flow DNS Invite: Location server Invite: Proxy 200 OK internet Proxy 200 OK Invite: 200 OK Ack RTP Session Domain: lidl Domain: ica 6

7 Background (SIP message) INVITE SIP/2.0 Via: SIP/2.0/UDP workstation1000.lidl.de From: tag=1b34283 To: Call-Id: Cseq: 1 INVITE Contact: <sip:alice@workstation1000.lidl.de> Date: Sat, 16 Aug :50:15 GMT Content-Type: application/sdp Content-Length: 154 V=0 o=alice IN IP4 workstation1000.lidl.de s=let us talk for a while c=in IP t=0 0 m=audio RTP/AVP 0 7

8 Outline Background Denial of Service attack using DNS Conclusion and future works 8

9 DNS flooding (DNS usage) INVITE SIP/2.0 Via: SIP/2.0/UDP workstation1000.lidl.de From: tag=1b34283 To: Call-Id: Cseq: 1 INVITE Contact: <sip:alice@workstation1000.lidl.de> Date: Sat, 16 Aug :50:15 GMT Content-Type: application/sdp Content-Length: 154 V=0 o=alice IN IP4 workstation1000.lidl.de s=let us talk for a while c=in IP t=0 0 m=audio RTP/AVP 0 9

10 DNS usage 1 1 Message Authentication Resolving Domain name Continue DNS Server 10 SIP Proxy

11 DNS flooding (objective of DoS) 1 1 Message Authentication 2 Resolving Domain name 5 Waiting 3 4 blocked Continue DNS Server 11 SIP Proxy

12 DNS flooding DNS Root DNS com DNS de DNS net DNS se DNS lidl DNS ica alice tom bob 12

13 DNS flooding (Malicious request) INVITE SIP/2.0 Via: SIP/2.0/UDP workstation1000.lidl.de From: tag=1b34283 To: Call-Id: Cseq: 1 INVITE Contact: <sip:alice@workstation1000.lidl.de> Date: Sat, 16 Aug :50:15 GMT Content-Type: application/sdp Content-Length: 154 V=0 o=alice IN IP4 workstation1000.lidl.de s=let us talk for a while c=in IP t=0 0 m=audio RTP/AVP 0 13

14 Test bed A SIP proxy A DNS server An attacking tool 100 external SIP providers User Agents (SIPp): a SIP traffic generator tool. SIP providers Internet UA (SIPp) DNS server SER (outgoing proxy) unresolvable Attacking tool 14

15 Solution 1 Increasing Parallel Processes of the proxy Message Scheduler DNS Process 1 Process 2 Process n Message Forward

16 Result of Solution n = 2 n = 4 n = 8 n = 16 n = 32 n = messages repl i ed attacki ng i nterval (s)

17 Solution2 Asynchronous Scaling through Message Processing Interruption 17

18 Result of Solution1 18

19 Solution3 Message Authentication Resolving Domain name DNS cache Continue DNS Server 19 SIP Proxy

20 blocked - example For example, n = 4. waiting waiting waiting waiting Blocked! 20 Process 4 Process 3 Process 2 Process 1 DNS cache SIP Proxy DNS Server

21 Cache Solution how to detect the attacking? (n is the parallel processes number) 1, a domain resolve call in process queue q but not S q ( t) = returned at time t, 0, otherwise H = n q= 1 S ( t q ), How to prevent being blocked? 1 emergency process Whenever H n 1, alarm! The next DNS request will not be forwarded to external DNS server, instead, it will only look up in the cache and reply immediately. Hence the proxy will absolutely be blocked at time t when H = n 21

22 Unblock Solution - example For example, n = 4. Occupied processes H n 1 ( 3 4-1) emergency waiting waiting waiting Process 4 Process 3 Process 2 Process 1 DNS cache SIP Proxy DNS Server 22

23 Result of cache solution messages replied n=32 n=16 n=4 n=2 messages replied n=2 with DADP n=256 n=128 n= elapsed time (s) elapsed time (s)

24 Cache Replacement Policy Cache replacement policies Motivation: As the number of cache entries (e) can not practically cope with the unlimited number of possible domain names, we have to find a way to optimally use the limited number of cache entries. FIFO LRU LFU 24

25 Result of Cache Solution 5000 No cache FI FO LRU LFU messages repl i ed attacki ng i nterval (S)

26 Cache entries messages repl i ed DADP wi th LFU wi thout DADP Investigate the relationship between the number of cache entries and the performance of proxy e = number of cache entries Less than 270, growth Greater than 270, stop cache entri es

27 Conclusions Current VoIP system is far from secure Interface between VoIP system and other ICT-based system (DNS) The solutions are not perfect, open questions 27

28 Thanks! Questions &Thanks! 28