Subject: RE: [Monami6] RE: CoA verification for HA

From: Sam Xia <[email-masked]>
Date: Fri, 17 Aug 2007 14:42:14 +0800

> 
> Hi Ryuji,
> 
> [snip]
> > This problem is not specific to monami6, but more general 
> issue of MIP6.
> [Ben] Not really. I feel the issue should be view as so:- 
> 
> 1) Degree of threat. 
> In MIP6, an attacker can only launch a single DoS attack. But 
> in Monami6, due to multiple CoA bindings support, an attacker 
> can launch multiple DoS attack.
> 
> 2) Form of threat. 
> In MIP6, once the attacker launch the DoS, the attacker loses 
> communication means (as the HoA, CoA binding is taken up for 
> attack). However, in Monami6, one of the multiple CoAs can be 
> used by the attacker to control the DoS attack for the other 
> CoA bindings. (e.g. set filter rules at HA)

Sam> Yes. In monami6, attacker can lauch more attack than in mip6. But I
think that it is a general issue for mobile IP.  The real question is that
even HA has authenticated with MN, how can HA believe the   
            CoA in BU is actually belonged to MN. I agree that it is a
issue, not solved by mip6.  Of course, if coa and hoa are both CGA,
verification could be performed.

> 
> > However, I'm not sure this is real scenario, because MN 
> must establish 
> > SA before sending BU... MN is always identified by HA 
> before sending BU.
> [Ben] The CoA used for binding at HA need not be the source 
> address of the BU. i.e. AltCoA option, BUI option. So does 
> this means HA should trust the CoAs in such options?

so, what do you want to do?

Regards,
Sam.Xia.

_______________________________________________
Monami6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/monami6

---

From: "Benjamin Lim" <[email-masked]>
Date: Fri, 17 Aug 2007 16:20:29 +0800

Hi Sam,

> issue, not solved by mip6.  
[Ben] You seem to left out the fact that in Monami6, an attacker can still
be contactable via HoA. This by virtue is not something that cannot be
achieved in MIP6. I illustrate with an example.

An attacker initiates a download for a big file to his MIP6-MN.
Concurrently, MIP6-MN sends BU to HA changing the CoA to a victim's CoA.
Thus, victim is flooded with useless packets. Now to deny service to an
organization, the attacker needs an army of MIP6-MN to perform such attack
in order to shut the system down. Similarly, all MIP6-MN cannot use their
HoA for communication now as it is being used for the attack.

However, if the attacker was using a Monami6-MN, all the attacker needs to
do is to maintain 1 CoA binding with HA (to control where the flows go) and
create other CoA bindings that belong to victims. All this can be done by
just using a single MN as opposed to the army of MNs need when MIP6 is used.
Also, the attacker can still use HoA for communication with other nodes (as
it can setup up flow filtering rules at HA to direct the flows from other
nodes)

> Of course, if coa and hoa are both CGA,
[Ben] I'm not really familiar with CGA, but I thought CGA was more for
address authenticity and not address reach-ability.

> so, what do you want to do?
[Ben] Like I said in the first mail, I'm asking if such issue should be
documented into the analysis draft. Of course if the WG feels that such
issue needs to be addressed, solution discussion can be done via the ML.

Regards,
Benjamin Lim