Subject: [Mip6] Vulnerability of MIPv6 in RO mode

From: Suresh Krishnan <[email-masked]>
Date: Thu, 22 Jan 2004 19:12:34 -0500 (EST)

Hi folks,
	I was thinking of possible attacks on MIPv6 RO mode and I found 
one, which I think may be interesting. I have read the ro security 
design document and this has not been covered. 

Let's say there is a mobile node MN1 which has a session with a server CN. 
The mobile node wants to kill another mobile node MN2 by flooding it with 
data. In my scenario MN1 has the capability to sniff packets going to 
MN2 (say by virtue of being on the same broadcast network as MN2, or by 
being on the direct path from MN2 to CN). The MN1 sends a HOTI and COTI to 
the CN that its new Care of address is CoA(MN2). The MN1 gets the HOT 
through its home agent and gets the CoT by sniffing the packet sent to 
MN2. It can now make the BU and succesfully complete the handover. It can 
initiate a high rate data stream from the server before it does this so 
that MN2 is flooded with data it does not need. Am I missing something 
here or is this a legitimate threat? 

Regards
Suresh

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Greg Daley <[email-masked]>
Date: Fri, 23 Jan 2004 11:43:54 +1100

Hi Suresh,

> here or is this a legitimate threat? 

I'm not sure if this specific attack has been defined,
but it is well known that return-routability tests in MIPv6
are not well protected from devices which are on the path to the
MN(2).

I hope this helps,

Greg

---

From: Suresh Krishnan <[email-masked]>
Date: Thu, 22 Jan 2004 20:00:50 -0500 (EST)

>are not well protected from devices which are on the path to the

Hi Greg,
  Thanks for the quick reply. I would have thought so except for the 
following statement in the RO security design

+   The binding update authorization mechanism used in the MIPv6 security
+   design is primarily intended to mitigate this threat, and to limit
+   the location of attackers to the path between a correspondent node
+   and the home agent.

which implies the insecurity is the the path between the CN and the 
<B>HA</B> rather than the path between the CN and MN.

Regards
Suresh

---

From: gabriel montenegro <[email-masked]>
Date: Fri, 23 Jan 2004 02:47:13 +0100

>>are not well protected from devices which are on the path to the

Yes. This is mentioned in 4.1.2 (Care-of-Address check):

    The Care-of Test traverses only one leg, directly from the
    correspondent node to the mobile node. It remains unprotected all
    along the way, making it vulnerable to eavesdroppers near the
    correspondent node, on the path from the correspondent node to the
    mobile node, or near the mobile node.

> <B>HA</B> rather than the path between the CN and MN.

The above is not conclusive. It only mentions those attacks deemed
to be more serious. The attack you mention is already described,
however. Please look at section 5.3 (Pretending to be your neighbor).

-gabriel