Subject: RE: [nemo] I-D ACTION:draft-na-nemo-nested-path-info-00.txt

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 18 Sep 2003 17:39:22 +0100

> > issue you address exactly?
> >
> Basically I mean the spoofing attack for RRH in which some
intermediate
> MR(faked or one victim of attacker) can easily insert arbitrary
address
> in arbitrary slot. In other words, that can cause the redirection of
the
> forward routing path under no detection in both HA and MR during some
> period time. The packet redirection by the spoofing attack means that
> the attacker can give us the following threats.
> 

Well, there's the RH type 2 forwarding rules that make the attacker get
The packets back to him, if the attacker is in the nested structure,
as we explain in the draft. I expect that in general the TLMR will be 
actually the AR, in order to prevent faking the Source of the packet as
seen
by the HA.

I believe that the result is the same exactly if the TIO extension you
propose
is faked. And I agree with your conclusion that the attacks that this
opens to
could be done in an easier fashion by other means.  Same exactly for RRH
:)

> 1) Information Disclosed - if the packets forwarded by HA are
redirected
> to the node(which is a repository for capturing some information for
the
> attacker) on Internet, that information will be used to do the second
or
> third attack. I think that it will be still helpful to the owner even
if
> it is encrypted because it can be an input to the traffic analysis or
to
> decrypt the cipertext.

Again, RH2 will not let the packet leave the nested structure once it is
in.
If you want, the nested structure is seen globally as a black bow. Once
the
packet is in, it will never get out. Always down the tree.

> 2) Active Denial of Service - if all packets sent from HA(/CNs) can be
> redirected to some targeted server(as a victim) on Internet, it
becomes
> one of holes for DOS attack.
> 
> Above two cases are just all of my instant thinking but I expect
another
> cases apparently exist in the real world. We should try to find more
> threats. Are above mentioned threats reasonable or not? It needs more
> discussion.

If the access router is not TLMR and if it does not check tke
topological
Coreectedness of the source, it may happen that an attacker forges the 
Source of the packet. But then you do not need all the MIP thing to do
that.

1) I expect AR to check the source address (per standard)
2) I expect AR to actually be the TLMR and the source of the packets as
seen by HA
3) I expect that the infrastructure is safe (if it is not, again, there
are other
    simpler attacks for a rogue on axis

So the threat you mention is covered.... for both drafts. Again, I do
not see what the
RH6 adds there since the info you have may be faked for all you know...

What do you think?

Pascal

---

From: "Jongkeun Na" <[email-masked]>
Date: Fri, 19 Sep 2003 15:43:06 +0900

Hi Pascal,

> actually the AR, in order to prevent faking the Source of the packet
as

I do not think that TLMR will be the AR. If not, we assume that all of
AR in the infrastructure should include the functionality of processing
RRH. It's not realistic.
I am sure that RRH is valid only in the context of mobile network.

> could be done in an easier fashion by other means.  Same exactly for
RRH

The result is not the same. In our extended scheme, the nested path
information(eg. MR1_COA->MR2-_COA..) which carried in RH6 is not
mutable, so that information can be protected by AH using SA established
between HA and MR. If the path information is forged, it will be
promptly detected by HA. The HA will discard the forged path information
by checking AH integrity and will never send the packets using RH2 which
contains that forged path. In case of the original RRH, the slot
information is mutable that means AH cannot be applied. So HA cannot
detect whether that slot information is valid or not.

> packet is in, it will never get out. Always down the tree.

I understand RH2's routing property you are now mentioning. However, to
my knowledge, there will be still a threat that redirects the RH2 routed
traffic to the outside of tree if TLMR can forge the slot information in
RRH. 

> Source of the packet. But then you do not need all the MIP thing to do

Actually the attacker in the nested RO context does not forge the source
address of the packet. The attack point is in the RRH information that
will be used to do RH2 by HA.

> 1) I expect AR to check the source address (per standard)
So do I.
> 2) I expect AR to actually be the TLMR and the source of the packets
as

Why do you think TLMR will be AR(in the infrastructure)? I think TLMR is
just one of MRs that aware/understand the network mobility.

>     simpler attacks for a rogue on axis
I agree. Let's assume the infrastructure is safe in this discussion.
The threats I said are not depend on the assumption that the
infrastructure is unsafe.

/Jongkeun.

---

From: "Jongkeun Na" <[email-masked]>
Date: Fri, 19 Sep 2003 15:43:06 +0900

Hi Pascal,

So do I.

/Jongkeun.