Subject: Re: [seamoby] DOS in wireless

From: Alper Yegin <[email-masked]>
Date: Tue, 12 Jun 2001 11:36:50 -0700 (PDT)

> 
> We all got wrapped up in this discussion of DOS and, in particular, CT
> related DOS. It put a smile on my face last night to recall that with
> wireless, it is almost trivial to mount a DOS attack without referring
> to any protocol nor invading the access network. The traditional term is
> "jamming". With the trend to lower power devices, it would not be difficult
> nor expensive to mount a fairly widespread, difficult to stop attack (and
> I'll stop there).
> 
> Perhaps too much attention is being given to putting bars on the windows
> when the front door is missing.
> 
> Gary

I'd like to add to that...

You don't even need to use access technology specific jamming. Now that 
bandwidth is very limited with wireless networks, a malicious node on the 
Internet can pump IP packets towards wireless link (to an existing IP address on 
this link), which would eat up bandwidth. Depending on access technology, this 
may or may not affect other devices on the wireless network.

Or, malicious node can send packets to random addresses in the wireless network. 
The access router would need to send neighbor solicitations for each different 
address... that eats up bandwidth.. [one solution to this problem is to have a 
large enough neighbor cache on the access router that holds all the attached 
nodes. And as soon as a device attaches to this network, this devices should 
send an unsolicited neighbor advertisement.. Now any node that doesn't exist in 
the neighbor cache doesn't exist on the link. And access router never solicits 
for random addresses.]

alper

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 12 Jun 2001 11:37:09 -0700

> may or may not affect other devices on the wireless network.

Of course, this is very wireless technology specific. There are certain technologies
that require that a channel be established with the "access point", and the "access
point" must authorize any requests for channel establishment.

> the neighbor cache doesn't exist on the link. And access router never solicits 

Again, this assumes that the wireless technology allows each node to communicate
directly, which is not an assumption that you can make that easily, given differing
technologies out there. Furthermore, sending random packets is always something
one can do, but only given its allowable bandwidth. If one is on a wireless link
that does not impose any bandwidth limitations, then I agree that would be a possible
DoS.

Of course, keep in mind that these are not CT specific DoS, and don't need to be
addressed in the CT protocol. Again, we are concerned with CT-specific attacks.

Thanks,

PatC