Subject: [Mip6] Issue 1: Third Party Bombing Through the HA

From: "James Kempf" <[email-masked]>
Date: Mon, 22 Mar 2004 09:40:05 -0800

I'd like to raise an issue that Francis brought up in
draft-dupont-mipv6-3bombing-00.txt to the list for some discussion. Charter
item 1 says that the WG will maintain an issues list on the current spec,
with interop being mentioned as the only reason, but I think this item,
which is a security item, also needs attention. If discussion of this issue
proves that the spec text needs amending, I think we ought to list it in the
issues list.

The issue is that the HA currently is not required to do a return
routability test on a BU sent from the MN. The issue list and discussion on
this from the time the decision was made, cited in Francis' draft, says that
the owner of the HA is expected to have a business relationship with the
MN's owner, and thereby to take action if an MN does third party bombing
through the HA, presumably by terminating the MN's account.

Is there any way that the home network can actuallly detect that a MN has
started a third party bombing attack and terminate it? Other than when the
victim contacts the home network operator out of band and tells them? If
not, then this could be a significant security vulnerability.

            jak

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6