Subject: Re: I-D ACTION:draft-ietf-dhc-subnet-option-02.txt (Fwd)

From: Ted Lemon <[email-masked]>
Date: Thu, 17 Jun 1999 16:01:42 -0400 (EDT)

> what benefit does the attacker obtain in any dos attack?

None whatsoever, other than the sick satisfaction of having caused
harm.

> is there harm in acknowledging it as a security issue?

Not at all.   I'm sorry I was so careless as to imply that it
shouldn't be mentioned (I definitely do seem to have implied that, and
that was not my intention).   I'm still feeling a little jumpy after
the bloodbath over the relay agent information option at the last
working group meeting, so I worded my response more strongly than I
should have.   Sigh.

			       _MelloN_

---

From: "Glenn Waters" <[email-masked]>
Date: Thu, 17 Jun 1999 17:41:31 -0400 (EDT)

i have put some words about this security issue in the next draft.  the new
version will be submitted before the cutoff.

/gww

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ted
> Lemon
> Sent: Thursday, June 17, 1999 16:02
> To: Multiple recipients of list
> Subject: Re: I-D ACTION:draft-ietf-dhc-subnet-option-02.txt (Fwd)
>
>
>

---

From: [email-masked] (by way of Ralph Droms <[email-masked]>)
Date: Thu, 17 Jun 1999 22:32:53 -0400 (EDT)

message sent to [email-masked] by [email-masked] follows.
--------------------------------------------------------------
Erik,

> Did you see these responses?

nope

> I guess it is an attribute of the mail filters that you don't
> show up as the sender causing responses to only go to the list.

most likely broken list software which forces
  Reply-To: listname

Ted Lemon <[email-masked]:
>> 5. Security Considerations
>> 
>>    DHCP currently provides no authentication or security mechanisms.
>>    Potential exposures to attack are discussed is section 7 of the
>>    protocol specification [RFC2131].
>> 
>> does this not protocol not open up a new security risk, requesting on an
>> arbitrary subnet?
> 
> I'm not sure that the incremental risk is substantial.   I suppose it
> makes it possible for an address-pool exhaustion DoS attack to be more
> complete, but other than that, what benefit do I obtain by acquiring
> an IP address on a subnet to which I'm not connected?

> We already have to deal with the address-pool exhaustion DoS attack,
> so I don't see any reason to think of this as a significant new
> concern.

Glenn Waters <[email-masked]>
> although it is probably useful to at least mention this issue in the
> security section.

thank you.  that's all i was trying to say.

randy

---

From: [email-masked] (by way of Ralph Droms <[email-masked]>)
Date: Thu, 17 Jun 1999 22:32:12 -0400 (EDT)

message sent to [email-masked] by [email-masked] follows.
----------------------------------------------------------------------------
> None whatsoever, other than the sick satisfaction of having caused

Actually, Denial of Service attacks can be used as one stage in a
multi-stage attack.  As an example, many TCP-based attacks are easier
the real host being impersonated/spoofed is out of the picture and
can't send RST's to confuse the issue..

				    - Bill