Spoofed invite protection?

[akg1330]

Greetings:

I'm setting up Skype Connect for inbound calls to an Avaya environment, terminating on an Acme Packets SBC.

Because the transport is UDP, there doesn't seem to be any way to prevent someone from spoofing an INVITE and causing our phones to ring.  I've tried this successfully.

I've tried both IP authentication and registration.  Again, because both use UDP, I'm must implicitly trust any UDP packet sourced from 2.sip.skype.com or 1.sip.skype.com.

Anyone have any ideas on how to mitigate this risk?  Will we ever see either TCP or TLS as a transport for this service?  What about authenticated INVITEs?

Thanks.

[VictorS]

Hello agk1330,

I've only heard this question once.  That user found that the Skype's Fraud Department and the Skype Enterprise Support teams have the tools to TRACE EVERY call coming in and going out of our SBC's. We can trace BACK to any user that tries to place malious or fraudulent calls into Skype.  We value the security of our users and protect you around ever corner.  If you have issues with this, please come into our Live Chat immediately and we will start tracing for you and escalate this to Skype's Security and Fraud departments.

You can Chat with us 24/7 by loggig into your Skype Manager and clicking on the Chat button in the top right of that screen.

I hope this answers your question.

Regards,

Victor S.

Skype Enterprise Support

[akg1330]

Thanks for the quick reply. 

My concern isn't someone placing fraudulent calls through the Skype network (though its good to know we've got help if that happens), but rather someone not associated with Skype can send a SIP INVITE with a source address of the Skype SBCs (which are well known).  Because UDP (which is, currently, the only supported transport protocol) is trivial to spoof, and because many ISPs don't implement anti-spoofing measures, we have no way of knowing if the packet really did come from Skype or from someone else.

The only way to prevent this would be to implement TCP, or better yet, TLS.  Some vendors are supporting something called Authenticated Invites, though I don't believe this is standard.

Thanks.

[VictorS]

Hello akg1330,

I response to your response, your question would have to be answered by our Program Engineers.  In order to do that, a "Trouble Ticket" would have to be created and sent up the line to get to the GearHeads that create all of this stuff.  They might have to contact you directly though.

If you would, log into you Skype Manager and Click on the Chat button on the top right hand of the screen and start a Chat session with us here, and ask the agent to have a JIRA ticket created "to answer a technical question about security and your system". Tell the agent that you just need a couple of questions answered by the "Big Boys" in Programming. 

I hope that helps you.   Thanks for using the Skype Connect Forum.

Regards,

Victor S.

Skype Enterprise Support

[akg1330]

Great.  Thanks for the advice.

[ChrisK · Accepted solution]

Hello akg1330,

We have now introduced TLS capability to our system.  You would need to enable it on your PBX and use port 5061.

Hope this gives you new comfort for the security of our system.

Regards,

Chris K.

Skype Enterprise Support

[akg1330]

Glad to hear this.  This make it much more likely we will more widely use Skype Connect.

I'm working with our vendor for the procedure to implement TLS on our side.

Thanks for the follow up.

[ChrisK]

Hello akg1330,

Thanks for your feedback and for being a frequent visitor of our forums. We appreciate your questions.

Regards,

Chris Knott
Skype Enterprise Support
113