Subject: Re: [RPSEC] IP spoofing threat

From: "Mohammad Awad" <[email-masked]>
Date: Thu, 27 Mar 2003 16:03:12 +0200

Then could understand that only the authorized users are those who can 
launch attacks to the routers resulting in IP spoofing. And that the routers 
nowadays are well secured against the non-Bezantine attacks?
Moh Awad

>From: Stephen Kent <[email-masked]>
>To: "Mohammad Awad" <[email-masked]>
>CC: [email-masked]
>Subject: Re: [RPSEC] IP spoofing threat
>Date: Wed, 26 Mar 2003 21:13:39 -0500
>
>>Do you mean that the Byzantine attack is the one in which those routers to 
>>be forged are frauded, and that this attach is much more likely?
>>
>
>The phrase "Byzantine attacks" refers, loosely, to attacks launched by 
>authorized entities that are misbehaving.
>
>Steve
>_______________________________________________
>RPSEC mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/rpsec

_________________________________________________________________

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Thu, 27 Mar 2003 10:33:45 -0500

At 4:03 PM +0200 3/27/03, Mohammad Awad wrote:
>Then could understand that only the authorized users are those who 
>can launch attacks to the routers resulting in IP spoofing. And that 
>the routers nowadays are well secured against the non-Bezantine 
>attacks?
>Moh Awad
>

I think we still have terminology confusion here.

If a packet carries an inaccurate source address, then it is spoofed, period.

If we can distinguish between authorized and unauthorized entities 
(insiders vs. outsiders) then attacks by insiders are often referred 
to as Byzantine failures (attacks).

Sending a packet with a spoofed address claiming to be that of an 
insider, is still a spoofing attack, not a Byzantine attack.

Steve

---

From: Tony Tauber <[email-masked]>
Date: Thu, 27 Mar 2003 10:58:44 -0500 (EST)

Mohammed, let me try and re-construct this thread a little.
Hopefully, I'll add some clarity:

At first you wrote:

++> Hi all,
++> Regaring the IP spoofing threat,
++>
++> 1- If an attacker has chosen to send packets with a forged source
++> IP address (e.g. 207.1.1.1), which genuinely belongs to another
++> existing host (not among the attacker's subnet), is he then able
++> to perpetrate any spoofing attack to the routers in order to be
++> able catch back the replies that would of course be targeted to
++> the legitimate host of the address (207.1.1.1)?

What you seem to be asking is "Can routing be subverted so that an
attacker who spoofs his source address is able to receive the reply
traffic from the victim intended for the host whose identity he is
assuming?"

I believe the answer to this question is "yes, through a variety of
tactics some which could involve sending spoofed packets to the router
(eg. bogus update) or which could involve injecting an inappropriate
routing update from a legitimate source (eg. breaking into an ISP's
router and reconfiguring it or inducing the ISP staff to do the same)."

++> 2- If Answer#1 is yes, how likely could such an attack happen
++> taking into consideration the level of security already
++> implemented nowadays in the intermediate routers?

The answer to the question of "How likely...?" is pretty much
impossible to quantify, though it's generally accepted that a
determined attacker could perpetrate such an attack successfully.

++> 3- Is there any reported incidents at CERT or any other
++> publisher's telling the stories about similar attacks?

Good question, I don't know, specifically.  If you do such a search,
feel free to summarize your findings to the list.

++> thank you all, in advance.
++> Moh. Awad

On to the exchange with Steve, below:

> > > > we ought not rely on the correct operation of other routers to
> > > > protect us, i.e., we ought to be able to deal with Byzantine
> > > > attacks.

> > > Do you mean that the Byzantine attack is the one in which those
> > > routers to be forged are frauded, and that this attach is much
> > > more likely?
> >
> > The phrase "Byzantine attacks" refers, loosely, to attacks
> > launched by authorized entities that are misbehaving.
> >
> >Steve

Steve's asserting that a solution to this problem, though not part of
your question, would protect against either of the approaches I cited
above (data insertion or system mis-configuration, either accidental
or intentional).

> can launch attacks to the routers resulting in IP spoofing.

This sentence doesn't really parse in English.  IP spoofing is not
generally understood to be a result of an attack but perhaps a means
to execute an attack.  It's easy to conceive of two ways that IP
spoofing might be involved given the discussion thus far:

- Attacker sends a spoofed packet to the victim to induce some desired
  result on that victim.

- Attacker sends a spoofed packet to one or more router to induce some
  desired result such as diverting traffic from its intended path or
  simply interrupting it.

The two might be combined together so that an attacker can receive the
reply packets addressed to the host whose identity he is assuming
which is what I thought you were describing in your first message
above.

> And that the routers nowadays are well secured against the
> non-Bezantine attacks?
>
> Moh Awad

Again, hard to quantify and quite variable.  Moreover, the router
design is only one part of the picture.  Also to consider is the
protocol design (can the design of it be exploited to do the "wrong"
thing) as well as the operator practice (do they use the available or
recommended features within the routers and/or protocols?)

Hope this clarifies the answers to your questions and Steve's somewhat
terse replies.

Tony