Subject: RE: [Mip6] use of IPsec

From: "Soliman Hesham" <[email-masked]>
Date: Thu, 6 May 2004 04:50:46 -0400

> > => Not really, I remember having a discussion (I think
 > > on the list) where we thought it was possible for the bombing
 > > node to continue to provide feedback by guessing the
 > > TCP sequence no. For instance in the case where a streaming
 > > server is being used to bomb the victim.
 > 
 > That would require some pretty clever synchronization
 > and guesstimation of round trip times between victim
 > and correspondent node.  "Possible" (p <= .00...1),
 > I'll agree with, sort-of ...  Did anyone ever _show_ this??

=> I guess answering this will address your earlier correction. 
I'm not sure that how clever the estimate should be. It might
not be trivial but I don't think the RTT needs to be guessed.
If the segment sizes are known (i.e. before redirecting to
the victim), the attacker can ack the right seq numbers. 
They might not be the latest seq no's but 
that doesn't matter because if the attacker acknowledges seq
no 2000 and the server already sent up to 4000, acknowledging
2000 will not cause the server to stop, on the contrary it will
retransmit segments. 

Obviously I don't have any data to support the attack. OTOH,
other types of attacks (e.g. MITM) can also be a bit fictitiuos
IMO if the MITM is not on the MN or CN links. So while we don't
have data that attacks like this already happen, it's hard to
dismiss the requirement.

 > >> Or we can try to justify by way of the distributed
 > >> denial of service attack, whereby bazillions of
 > >> devices in the Internet attempt to use a sophisticated
 > >> Mobile IPv6 mechanism instead of just bombing the heck
 > >> out of the victim with pings...  (?)
 > > 
 > > => The difference here is that the attacker is not traceable.
 > 
 > 1) The correspondent node certainly knows the responsible
 >    home address ==> traceability

=> But in this case the home address belongs to the victim.

Hesham

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 06 May 2004 07:35:51 -0700

Hello Hesham,

>have data that attacks like this already happen, it's hard to
But if I compare this with, say, the other trivial attacks in the news
recently, it does look pretty esoteric.

Furthermore, I am not at all claiming that we should just forget about
such attacks.  I am claiming that these attacks do not and did not
provide sufficient justification for the subject of discussion, which was
why IPsec was originally proclaimed insufficient to secure the original
format of the Binding Update.  To me it looked like piling on for who
knows what purpose.

>=> But in this case the home address belongs to the victim.
I thought we were talking about the case where a mobile node maliciously
claims ownership of a care-of address belonging to another node (the 
victim),
==> the home address belongs to the mobile node, the care-of address 
does not.
What is the attack where the home address belongs to the victim?

Regards,
Charlie P.