Subject: RE: [Isms] Questions for Call home

From: [email-masked]
Date: Thu, 15 Sep 2005 12:20:55 -0700

Hi David,

I can give you a typical example of Call Home from the Cable space since
I being going through some of their specifications.

PacketCable 1.0 uses SNMPv3 for part of the provisioning, TFTP is used
to download to the actual configuration file. Each MTA is required to
provisioned with a X.509 certificate (actually there are separate certs
for the cable modem and MTA) typically done at manufacturing. The MAC
address is used as CN within the X.509 cert 

The X.509 certificate is shared between SNMPv3 and IPSec that is used
for communication between the MTA and the Call Management Server.
Kerberized SNMPv3 is used for protection of SNMPv3 message, PKINIT is
used for initial authentication and ticket generation. The MAC address
is used as USM user name (identity) within the Kerberized SNMPv3
exchange, the cable modem (managed device) initiates the exchange. 

Hope this helps.

regards,
  kaushik!

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of David T. Perkins
Sent: Thursday, September 15, 2005 11:22 AM
To: [email-masked]
Subject: [Isms] Questions for Call home

HI,

In "call home",

1) What identities and credentials are being used?
2) How are those identities "put on the box"?
3) Are those identities and credentials there due to
   other management operations?
4) Are they used by other management interfaces?
5) What are the possible exploits that performed
   with identities and credentials from a
   compromized system?
6) Are there any changes that need to be made to
   existing security infrastructure to support
   the "call home" functionality, such as
   defining new RADIUS extensions?

Regards,
/david t. perkins

---------- Forwarded message ----------
Date: Wed, 14 Sep 2005 12:15:12 -0700 (PDT)
From: David T. Perkins <[email-masked]>
To: [email-masked]
Subject: [Isms] Tests for ISMS

HI,

In evaluating any candidate ISMS solution, I'd like to remind all of the
tests that I use:

1) What identity credentials does the candidate require from EACH end of
the SNMP operation pair? 

2) Does each end "already have" those credentials due to setting up some
other service? If they don't have the credentials, then REJECT the
candidate.

3) Does the candidate require that an existing security infrastructure
be modified (or extended) for the candidate to work? If so, then REJECT
the candidate.

4) Do other "management interfaces" use the same "operations model". If
not, then hold the candidate to higher scrutiny. 

Note that the following are NOT reasons to REJECT a candidate:
1) backwards compatibility with an existing SNMP security model
2) new code for SNMP agents or managers
3) new SNMP terminology and ways of viewing the management model

Regards,
/david t. perkins

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David T. Perkins" <[email-masked]>
Date: Thu, 15 Sep 2005 13:23:03 -0700 (PDT)

HI,

Thank you for providing this information. 

I believe that cable modems are a special case, which
can not be used to project to other network infrastucture
devices. That is, I believe the cable modems were
designed to be primarily (or only) managed via SNMP
and have no other management interface.

If a cable modem is compromised, I would guess that
the only sensitive info would be the private key for
the cablem modem's X.509 cert. With these, the exploits
could be any that required that identity. Could that
allow theft of service?

I do appreciate your response, and hope that similar
info can be provided for SSH CH.

Regards,
/david t. perkins