Subject: [sipcore] Any clue on recent attack on Callcentric?

From: Dean Willis <[email-masked]>
Date: Fri, 5 Oct 2012 16:36:13 -0500

I have a line hosted by Callcentric in the US. They're reporting a new and successful SIP-protocol DOS attack:

"For the past two days we have been experiencing a sophisticated type of attack. As soon we noticed the first attempt we commenced an immediate physical upgrade to all of our servers increasing capacity and CPU power by a factor of four in addition to other precautions. Unfortunately even though this is similar to a "typical" DDoS attack it is targeted specifically at the SIP protocol and causes server load to increase to 100% within 1 minute of initiation. As such, standard and extraordinary prevention measures were unable to prevent it. We do not know the specific methodology of the attack but are aware that it is *similar* in effect to a DNS TRASH flood attack. We are performing forensic analysis on the data we have and are capturing traffic to find an exact reason and solution."

Anybody have a clue what's happening? Is there a protocol design flaw here that we need to consider?