1. Denial of Service on SIP VoIP Infrastructures Using DNS Flooding
Attack Scenario and Countermeasures
Ge Zhang, Sven Ehlert, Thomas Magedanz and Dorgham Sisalem
Fraunhofer Institute FOKUS

2. Outline Background: DNS usage in SIP network Vulnerability and Attack
Experiment Test bed
Previous Limited Solutions
Cache Solution
Conclusion and Future Work

3. Background DNS Usage in SIP Infrastructures (3).
(1) Domain Names contained in SIP message headers. (e.g. INVITE, TO, FROM, VIA)
(2) Telephone number mapping (ENUM). (e.g. Translate to e164.arpa)
(3) Server location. (e.g. SRV, NAPTR request)

4. Background 1 Parsing message 2 3 Resolving Domain name 4 5 DNS Server
Continue…

5. Scope of the Attack 1 Parsing message 2 3 Resolving Domain name
4 Blocked!!
5 waiting….
DNS Server
Continue…

6. Scope of the Attack

7. Scope of the Attack INVITE: SIP:u1@so6f.columbia.edu SIP/2.0
Via: SIP/2.0/UDP ; branch=z9hG4bk29FE738
CSeq: INVITE
To:
Content-Type: application/sdp
From: SIP: tag=24564
Call-ID:
Subject: Message
Content-Length: 184
Contact: SIP: …
<SDP part not shown>

8. Experiment test bed Internet SER (outgoing proxy) A SIP proxy
A DNS server
An attacking tool
100 external SIP providers
User Agents (SIPp): a SIP traffic generator tool.
Attacking tool
UA (SIPp)
unresolvable
SER (outgoing proxy)
DNS server
SIP providers
Internet

9. Limited Solutions Message Scheduler DNS ... Message Forward
Increasing Parallel Processes
...
Process n
Process 2
Process 1
Message Scheduler
DNS
Message Forward

10. Limited Solutions

11. Limited Solutions
Asynchronous Scaling through Message Processing Interruption

12. Limited Solutions

13. Cache Solution Parsing message Resolving Domain name DNS Cache
DNS Server
Continue…

14. Cache Solution (n is the parallel processes number)
how to detect the attacking?
(n is the parallel processes number)
How to prevent being blocked?
1 emergency process
Whenever H ≥ n – 1, alarm!
The next DNS request will not be forwarded to external DNS server, instead, it will only look up in the cache and reply immediately.
Hence the proxy will absolutely be blocked at time t when H = n

15. Cache Solution For example, n = 4.
Occupied processes H ≥ n – 1 ( 3 ≥ 4 - 1)
emergency
waiting
waiting
waiting
Process 4
Process 3
Process 2
Process 1
DNS Cache
DNS Server

16. Cache Solution

17. Cache Solution Cache replacement policies
Motivation: As the number of cache entries (e) can not practically cope with the unlimited number of possible domain names, we have to find a way to optimally use the limited number of cache entries.
FIFO
LRU
LFU

18. Cache Solution

19. Cache Solution
Investigate the relationship between the number of cache entries and the performance of proxy
e = number of cache entries
Less than 270, growth
Greater than 270, stop

20. Conclusion and future work
attack is easy to launch .
compared with previous solution, the cache solution is better .
4 parameters affect the performance: cache replacement policy, cache entries number, processes number of proxy and attacking interval.
Accurate the research result (INVITE, ACK, BYE)
Consider the new threat (DNS cache poisoning)
Build an scalable defense system for it

21. Questions