Subject: [Simple] Presence and a potential DDos attack?

From: "Vesa Torvinen (LMF)" <[email-masked]>
Date: Thu, 30 Jan 2003 12:09:24 +0100

I have a question related to Presence and a potential DDos 
attack. I am thinking the following scenario: 

1) We have anonymous watcher (the attacker) subscribing to 
the presence information of a presentity. The victims 
IP-address is defined in the Contact header. 

2) The subscription policy of the presentity allows anonymous 
subscriptions. 

3) The presence server has a local policy of challenging all 
anonymous watchers with HTTP Digest. 

4) The watcher replies to the HTTP challenge with 'anonymous' 
username and empty password as described in RFC 3261. 

5) The presence server accepts the subscription and the victim 
receives the notifications. 

Is this attack possible? 

Or maybe you have already discussed the issue... 

Vesa 
_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 31 Jan 2003 09:10:22 -0500

This attack is addressed in rfc3265 itself, since its possible to launch 
against any event system. The remedy for it is that the notifier cancels 
a subscription if it receives a 481 or a transaction timeout (both of 
which would signify lack of interest from the attacked-watcher).

Also, anonymous watchers are not such a great idea.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com