Subject: [nemo] Re:risk LFN sees MR CoA and HA address (was: Last call for draft-ietf-nemo-basic-support-01.txt)

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 12 Nov 2003 18:49:47 +0100

Cwng:
> Hello Felix,
> 
> Interesting, in fact if I read the problem correctly, it is also a 
> 'problem' (sort-of) in MIPv6 as well.  Consider CN in non-optimized 
> mode sending a ill-formed packet that will cause an ICMP error be 
> generated within the HA-MN tunnel, and thus learn information about 
> home-network of the mobile node. (Since according to the text you 
> quoted, the HA must relay the ICMP error to the sender -- CN -- as 
> well)
> 
> However, having said that, in both cases (i.e. (i) CN is the sender 
> and (ii) LMN/MN is the sender), it is questionable on how this can be
>  achieved, since the 'ill-formed' packet must be constructed such 
> that (a) from the sender to the tunnel entry point, an error will not
>  be detected by forwarding nodes and thus no ICMP error messages will
>  not be generated, and (b) a forwarding node within the path of the 
> tunnel will actually trigger an error due to the inner packet.
> 
> Like to hear others' view on this.

If I understand the threat correctly, please correct me if I'm wrong.

The attacker is LFN.  The protected information is MR's CoA and HA
address. The risk is that LFN may gain knowledge of those two addresses.
   So what?

There are other simpler means for LFN to obtain those two addresses:
traceroute is but one example, no need to generate badly formatted packets.

Also, this is not a "location privacy" problem issue per se (I tried a
definition of "location privacy" in the draft I've just sent on this
thread).

What are the other risks that LFN gaining access to MR's CoA and MR's HA
address might involve?  Also I think the protection against this risk
might lie in  AAA, PANA, EAP and even SEND might offer to MR (if MR is
the target) to protect against malicious LFN's.

I'm also thinking that chewing on this kind of threat might lead to
a valuable description, so include it in a document; but also thinking
that sending malformed packets to any destination and hoping for a reply
back containing valuable information is a part of everything.

Look, if an attacker MR could malform a packet, send it to a legitimate
MR's HA, obtain in response that HA's secret keys it holds with the
legitimate MR, (eventually as a result of attacker nesting under
legitimate), then we really have a NEMO threat.

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 12 Nov 2003 18:49:47 +0100

Alex
GBU

---

From: Chan-Wah NG <[email-masked]>
Date: Thu, 13 Nov 2003 03:31:12 +0800

Hello Alex,

well, there is no threat (or more appropriately 'problem' since nobody
mentioned the word 'threat').  I think in the first read, we
misinterpreted the "original packet" to include the outer packet as
well.  It turn out to be a mistake.

Other random thoughts inline.

/rgds
/cwng

On Thu, 2003-11-13 at 01:49, Alexandru Petrescu wrote:
<snipped>

> address. The risk is that LFN may gain knowledge of those two addresses.
I didn't foresee any harm in that, but it was something not intended,
and as such, implications of unintended effects may not be very well
thought of, and thus its good that Felix bring it to the discussion
list.

> traceroute is but one example, no need to generate badly formatted packets.
Pardon my ignorance, is there a traceroute mechanism in IPv6?

> a valuable description, so include it in a document; 

Yup, exactly why I contributed my random thoughts in response to Felix's
mail.  Though it turn out to be a 'false alarm', it might generate
useful materials for analysis.

> but also thinking
If an attacker can do so, we better had anticpated it and took meaures
to prevent it! 

/rgds
/cwng

---

From: Chan-Wah NG <[email-masked]>
Date: Thu, 13 Nov 2003 03:31:12 +0800

Hello Alex,

/rgds
/cwng

/rgds
/cwng