Subject: Re: [Idr] change in draft-ietf-idr-bgp-vuln-00.txt

From: Sandy Murphy <[email-masked]>
Date: Tue, 11 May 2004 13:11:37 -0400 (EDT)

> If
>insertion of bogus data is the attacker's goal a packet boundary must
>be matched and the insertion must match a packet boundary or a cease
>will be caused and the bogus insertion lost.

Yes, I've been wondering about the "blind data injection" part
of the tcpm-tcpsecure draft.  First, not all TCP implementations buffer
out-of-order packets.  Second, unless the segment's bytes exactly
match a later arriving segment's upper boundary, then some of the
out-of-order segment's bytes could be overwritten.  But isn't this also
implementation specific?

And then comes the problem, as you say, of trying to match up the
BGP framing.  If the bogus data does get delivered to the application
(BGP) (depending on the timing of the reads and the arrival of the
real data), then not parsing as a proper BGP packet could cause a
CEASE.  Which would be yet another way to bring down a connection,
presuming that you needed another ;-}.

But the TCP issues, particularly implementation specific, are probably
off-topic for this list.

--Sandy

_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 11 May 2004 15:05:57 -0400

> out-of-order segment's bytes could be overwritten.  But isn't this also

BGP message have to be aligned.  If they are not aligned a cease
occurs.  If a cease occurs all information is refreshed so the
attacker did not successfully inject anything.

> presuming that you needed another ;-}.

A cease is a very temporary DoS.  In order to be effective the attack
must be somewhat continuous.  Injection of bad routing is a
semipermanent DoS which if successful would be hard to detect.
Therefore the latter is far more dangerous.  Knowing that we are much
more safe against the dangerous form of attack is significant and
should be mentioned, unless the goal is just to bash BGP.

> But the TCP issues, particularly implementation specific, are probably

BGP security discussion is not off topic therefore if TCP issues
impact BGP security its not off topic.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 11 May 2004 15:05:57 -0400

Curtis