Subject: [RPSEC] Topic 3: Section 4.4 Spoofing

From: [email-masked]
Date: Tue, 11 Mar 2003 17:38:17 -0500 (EST)

The text itself recognizes that spoofing in and of itself is
often not the true attack:

   Spoofing is special in that it can be used to carry out other threat
   actions causing other threat consequences.   For example, after an
   attacker spoofs successfully, it can send out unrealistic routing
   information that might cause disruption of network services.  Please
   note these consequences are directly resulted from other threat
   actions instead of spoofing, which are also discussed in this
   documentation.

So by spoofing, you might inject bogus routing information - but that's
falsification, section 4.5.  You might send more messages than your
neighbor can handle - but that's overload.  You might get access to
routing information than you are not entitled to - but that's, er,
"deliberate exposure"?  (I'm actually not sure about deliberate exposure,
see later message.)

There are a few cases where spoofing is in and of itself an attack.

  - If a router established a neighbor/peering relationship, spoofing
  the identity of a legitimate router, and by that action was able
  to prevent the legitimate router from establishing a relationship,
  that would be an attack, denying service to the good router.
  (Hm.  Denial of service  - to the routers - is not on any list.  Hm.
  Maybe that falls under "interference.")

  - If a router is doing auditing, then the ability to spoof an
  identity would be an attack - because the audit data would be
  false.  Oops, maybe that makes this a falsification attack.

So I would say that the text in this section should recognize the
circumstances where spoofing is in and of itself an attack, and
distinguish this from the cases where spoofing is a means to launch
other attacks.

--Sandy
_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec