Identify your SIP Internet peers – use TLS authentication!
♫ Tuesday, April 13th, 2010TLS, Transport Layer Security, is the IETF standard for TCP session security, based on Netscape’s old SSL technology. TLS delivers both confidentiality to a TCP session and authentication of the server and the client (if requested). TLS is used in the Session Initiation Protocol, SIP, for signalling protection and/or authentication on a hop by hop basis.
When opening up your SIP services to the Internet, you face the same issues as with other protocols, like e-mail (SMTP). We have already seen many types of SIP attacks, mostly simple attacks targeting weak usernames and passwords used by SIP system administrators. If authentication succeeds – or if it’s not used at all – the SIP service is used for placing expensive International calls.
There are many proposals out there on how to set up trusted federations between SIP services. The simplest way forward is to use TLS. Only accept connections protected by TLS, using a well known certificate authority you trust. Could be your own, a commercial CA or a free CA that you trust. That way, you can always find the other party and you can easily block if there is misuse. And you will get rid of a lot of misuse attempts, because if there’s one thing they don’t want, it’s traceability.
The usage of TLS in SIP is not well understood. The original SIP RFC was not very clear in the use of TLS, something which has been clarified later. We have run trainings on SIPit a few times and started automated self-tests of TLS and SIP. We will continue these efforts in order to educate developers and get better implementations, as well as to run tests the new RFCs on the use of TLS in SIP.
This is only one area of all where participation in SIPit helps you improve your product. Register for SIPit today!