<div dir="ltr"><div class="gmail_default" style="color:rgb(102,0,0)">Does the delayed reply also delay the next auth request from being processed? I'm not familiar enough with the protocol to know if overlapping requests are prevented. If not, then an attacker simply ignores all negative responses regardless of delay and looks for a positive response, negating any benefit by using delayreject.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Nov 11, 2013 at 3:49 PM, Mark Michelson <span dir="ltr"><<a href="mailto:mmichelson@digium.com" target="_blank">mmichelson@digium.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 11/09/2013 05:59 AM, Eugene Varnavsky wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello!<br>
<br>
Delayreject option means that, if auth is unsuccessful, delay reject answer by 1000 ms.<br>
It's off by default.<br>
<br>
I see no reason to have it off. Only if we want to help bruteforcers.<br>
<br>
I think default value should be changed to 'on' and I see no drawbacks in this.<br>
</blockquote>
<br></div></div>
I've been giving this a look, and I don't like this idea. Someone with more IAX2 knowledge can feel free to correct me about specifics, but in general it feels wrong to treat auth rejection replies differently than other rejection replies.<br>
<br>
If I'm attacking an Asterisk system with a variety of IAX2 messages and I start noticing that rejection replies start having a one second delay on them, I know that I am triggering chan_iax2's code to check authentication, and that is where my attempt is failing. I know now that I am not in violation of anything that may have prevented my call from even reaching authentication code. Similarly, if my attack attempts initially start by receiving rejections with a one second delay, but then they all of a sudden don't, that's even worse. It means I have successfully cracked an account and password and that there is something much milder that is preventing me from making my malicious calls. In either case, if the option is not in use, then there is no easy way for me to know why my attacks are failing.<br>
<br>
In all, this option feels more like a "security through obscurity" option anyway. Good encryption and password selection is better than delaying rejection attempts by an extra second.<br>
<br>
Just my two cents.<span class="HOEnZb"><font color="#888888"><br>
Mark Michelson<br>
<br>
-- <br>
______________________________<u></u>______________________________<u></u>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
<br>
asterisk-dev mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-dev" target="_blank">http://lists.digium.com/<u></u>mailman/listinfo/asterisk-dev</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><img alt="Digium logo" src="https://my.digium.com/images/graphics/digium_RGB_signature.gif" width="288" height="50" style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<strong style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Scott Griepentrog</strong><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"><span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Digium, Inc · Software Developer</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">445 Jan Davis Drive NW · Huntsville, AL 35806 · US</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">direct/fax: +1 256 428 6239 · mobile: +1 317 507 4029</span><br style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">
<span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px">Check us out at: </span><a href="http://www.digium.com" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" target="_blank">http://digium.com</a><span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px"> · </span><a href="http://www.asterisk.org" style="font-family:Arial,Helvetica,sans-serif;font-size:12px" target="_blank">http://asterisk.org</a><br>
</div>
</div>