Subject: [MEXT] Energy consumption attacks

From: Pars Mutaf <[email-masked]>
Date: Mon, 21 Mar 2011 11:43:57 +0200

Hello,

I was wondering if solutions to energy consumption attacks on battery
powered mobile hosts would be of interest to IETF Mobile IPv6 community.

The attack consists of sending frequent request packets e.g. SIP INVITE or
TCP SYN to a victim's home address.

For example, experiments showed that the battery of a mobile phone with
802.11 access can be remotely consumed in 3 hours (full battery). Attacks on
phones using an outdoor technology would result in more energy consumption
because of the longer distance to the base station.

The victim becomes unusable.

Regards,

Pars

---

From: Pars Mutaf <[email-masked]>
Date: Mon, 21 Mar 2011 13:06:38 +0200

Some details that may not be obvious:

The victim consumes energy for:

- Receiving the messages (continuously waking up from sleep mode)
- Processing them and preparing reply packets (L2 and L3)
- Sending replies (L2 ACKs and upper layer replies e.g. SIP or TCP replies)

Sending replies especially consumes more energy. It was shown that in 802.11
sending 1 bit over the air consumes as much as executing 1,000 CPU
instructions.

Regards,

Pars

---

From: "QIU Ying" <[email-masked]>
Date: Tue, 22 Mar 2011 11:05:21 +0800

This topic is interesting. 

But I am afraid that there is an efficient way to prevent this kind of DOS
attacks because the mobile node must wake up from sleep to receive and
process these required messages before simply drop them.

Could you please provide more details?

Regards

Qiu Ying

From: [email-masked] [mailto:[email-masked]] On Behalf Of Pars
Mutaf
Sent: Monday, March 21, 2011 7:07 PM
To: [email-masked]
Subject: Re: [MEXT] Energy consumption attacks

Regards, 

Pars

Hello, 

Regards, 

Pars

Institute for Infocomm Research disclaimer:  "This email is confidential and may be privileged. If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you."

---

From: Julien Laganier <[email-masked]>
Date: Mon, 21 Mar 2011 20:27:41 -0700

Pars -

How is this attack related to MIPv6?

--julien

On Mon, Mar 21, 2011 at 2:43 AM, Pars Mutaf <[email-masked]> wrote:
> _______________________________________________
> MEXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mext
>
>

---

From: Pars Mutaf <[email-masked]>
Date: Tue, 22 Mar 2011 10:30:19 +0200

Hi Qiu,

> Could you please provide more details?

I am not entering in the solution space, various solutions may be possible.
You cannot simply drop the incoming packets as you suggested because you
would become unreachable in this case. The attacker can spoof source IP
addresses so you cannot differentiate between malicious and legitimate
packets.

Regards,

Pars

> Regards
>
> Qiu Ying
>
>
>
>
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf Of
> *Pars Mutaf
> *Sent:* Monday, March 21, 2011 7:07 PM
> *To:* [email-masked]
> *Subject:* Re: [MEXT] Energy consumption attacks
>
>
>
> Sending replies especially consumes more energy. It was shown that in
> 802.11 sending 1 bit over the air consumes as much as executing 1,000 CPU
> instructions.
>
> Regards,
>
> Pars
>
>  Institute for Infocomm Research disclaimer: "This email is confidential
> and may be privileged. If you are not the intended recipient, please delete
> it and notify us immediately. Please do not copy or use it for any purpose,
> or disclose its contents to any other person. Thank you."
>

---

From: Pars Mutaf <[email-masked]>
Date: Tue, 22 Mar 2011 10:59:52 +0200

Hi Julien,

MIPv6 is mostly about battery powered mobile hosts, so I think this topic
should be of interest to Mobile IPv6 community. Secondly, when you think
about solutions, you may realize that it is an IP layer problem. Any upper
layer host identifier (FQDN or SIP URI etc) would be resolved to the "fixed"
home address of the mobile host and once the attacker has learned it, the
attack is possible. The attacker can remotely consume the victim's energy.
Application layer solutions like spam filtering would be useless because the
attacker is simply sending bogus packets, not even opening sessions.

In fact, we may expand the problem space since there may be other problems
due to having a fixed MIPv6 home address. But I think the remote energy
consumption attack is the most serious one. Serious design efforts are being
made at MAC layer to enable energy conserving sleep mode. The attack would
not only foil these efforts, but also consume energy by "forcing" the victim
to reply to frequent malicious packets purportedly coming from random IP
addresses.

Thanks,

Pars

---

From: Pars Mutaf <[email-masked]>
Date: Thu, 24 Mar 2011 10:00:55 +0200

> Could you please provide more details?

Hi Ying, all,

You can also find an example solution briefly described in the following
I-D:

http://tools.ietf.org/html/draft-mutaf-dhoa-00

But protocols are necessary for securely distributing disposable home
addresses to correspondent nodes.

For further discussion you may subscribe to humanresolvers.

Thanks,

Pars