Subject: [NSIS] NATFW NSLP; attack in Section 5.10.1 is not specific to NATs

From: Ali Fessi <[email-masked]>
Date: Fri, 21 Apr 2006 00:12:07 +0200

Hi,

the attack described in Section 5.10.1 (Misuse of mobility in NAT 
handling) is actually not specific to NATs. Firewalls need also to 
update their policy rules to support mobility.

I would modify the description of the attack accordingly and call it 
"Miuse of Mobility Support" or something like this.

Also: in the figure 42, the end host does not necessarly need to be on 
the private side of the network. a Mobile Node can be on both sides of 
the network; and in both cases, policy rules need to be updated.

So there shouldn't be a difference between the public and the private 
network sides.

Regards,
Ali
-- 
Ali Fessi
University of Tuebingen, Germany

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 21 Apr 2006 13:22:48 +0200

Hi Ali,

it is true that we should also depict a firewall in the scenario.
The difference between the NAT and the Firewall scenario is that an 
adversary could be able to modify the NAT binding and would be able to 
also see the data traffic.

If the policy rule at the firewall is changed by an adversary then the 
firewall would, for example, block the traffic.

Ciao
Hannes

---

From: Ali Fessi <[email-masked]>
Date: Fri, 21 Apr 2006 13:54:05 +0200

Hi,

> firewall would, for example, block the traffic.

This would be possible only if the firewall knows that it was an 
adversary! ;-) or did i misunderstand something?

Cheers,
Ali

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 21 Apr 2006 14:07:51 +0200

Hi Ali,

> adversary! ;-) or did i misunderstand something?

Look at the following figure:

        +----------+        +----------+          +----------+
        |  NAT     |        | Host A   |          |Malicious |
        |          |        |          |          |End host  |
        +----------+        +----------+          +----------+
             |                    |                     |
             | Data Traffic       |                     |
             |--------->----------|                     |
             |                    |      Spurious       |
             |                    | NAT binding update  |
             |---------<----------+--------<------------|
             |                    |                     |
             | Data Traffic       |                     |
             |--------->----------+-------->------------|
             |                    |                     |

If the adversary changes the NAT binding then it could receive the data 
traffic that was meant to be sent towards Host A.

If you replace the NAT with a firewall and if the adversary changes the 
policy rule at the firewall then packets might, as one possibilty, be 
dropped. The adversary would cause a denial of service against Host A. 
This attack would, however, be self-healing since Host A would 
periodically resend a refresh message and thereby changing the policy 
rule back again.

Ciao
Hannes