Subject: RE: [mobile-ip] Piggybacking - DT recommendation

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 4 Mar 2002 17:39:17 +0100

=> The only major difference I see is the 
amplification aspect of the attack. I.e.
start the TCP connection then forward it 
to the victim, and do some TCP sequence
number guessing to keep the connection 
up. 

  >    It took me some time to understand
  >    whether there is a significant difference 
  >    between bombing someone directly or via a CN. 
  > 
  > => there is a clear difference: directly you should use 
  > forged source
  > addresses and go through ingress filtering, via a CN *with RO* you
  > only expect the target doesn't notice the RH in each packet (:-).

=> It doesn't matter if the target notices the RH or not. 
The point is you would not be able to prevent it. 
You will detect the attacker of course, but you
won't prevent the attack.

  >    I must admit I'm still not 100% convinced
  >    that there is a significant difference. But 
  >    I'm not as sure as you are that it is irrelevant. 
  >    
  > => do you agree with my argument?
  > 

=> As I said, I see the main difference being 
the amplification, but I also see a performance
loss when always mandating RR for the CoA. Hence, 
the internal debate with myself :) 
The question is how secure we want RO to be 
given the performance loss. 
I can't answer it yet without looking into
it in more detail. 

Hesham

---

From: Francis Dupont <[email-masked]>
Date: Sun, 17 Mar 2002 18:26:15 +0100

=> The only major difference I see is the 
   amplification aspect of the attack.

=> I can't see an amplification aspect, this is only a variation of
the fake HAO reflection attack...

=> this is already the case with a direct attack or an indirect attack
through a rogue CN. I can't see what are your requirements here?

   the amplification

=> there is no amplification, only reflection.

   but I also see a performance
   loss when always mandating RR for the CoA.

=> this is my concern: RR gives nothing more.

   Hence, the internal debate with myself :)
   The question is how secure we want RO to be 
   given the performance loss. 
   I can't answer it yet without looking into
   it in more detail. 
   
=> (:-)

Regards

[email-masked]