Subject: RE: [mobile-ip] A threat RR doesn't solve and that doesn't seem t o exist in IPv4

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 24 Jan 2002 14:11:43 +0100

Alex,

  > This is indeed a more likely scenario.  But without access 
  > to router,
  > attacker can do less harm and is also in danger of being detected by
  > its neighbours.  Windows, Solaris and HP-UX already do 
  > that, I think.
  > 
  > Besides, I do not think that the future attack against RR 
  > as described
  > by Pekka is feasible only by plugging a laptop and using ND.
  > 

=> The attack is certainly feasible without compromising
a router. In the 'Is RR only enough' thread, Erik 
also explained that it was feasible today. The difference
was that you could (if you look at ARP caches) see it 
today. Whereas you wouldn't be able to see it with an
attack on RR. Not a significant difference IMO.

The other (significant IMO) difference was that 
e2e security can stop this attack today, whereas
it would not stop it when using RR only. 

How significant this is ? I can't judge that
right now, there are too many factors to 
consider. But it is certainly something we should
be aware of. 

For more details please have a look at that thread.

Hesham

---

From: Alexandru Petrescu <[email-masked]>
Date: 24 Jan 2002 16:34:35 +0100

Hesham, thank you for pointing me to that thread, I must recognize I
haven't read it.  I won't reply further if things look already sorted
out.  Only one remark to one of your conclusions, inserted below.

> attack on RR. Not a significant difference IMO.

"The attack is certainly feasible without compromising a router"?  As
I said earlier, attacker must not only generate fake RR messaging to
CN but it must also block true RR messages from CN to reach true HA.
In the case of RR like BAKE, if HA receives a true Binding Request
from CN and forwards it to MN and MN does BKE to CN, CN will end up
with two BKE's, one that it can authenticate and one that it can not.
At that moment CN can realize something is wrong somewhere and shorten
the lifetime of the binding or make it 0 and log this event.

This exactly what happens in ARP or possibly ND.  Host listens and if
incoherences in addresses are heard then make them visible.

Alex

---

From: Alexandru Petrescu <[email-masked]>
Date: 24 Jan 2002 16:52:16 +0100

> the lifetime of the binding or make it 0 and log this event.

Sorry for following up on my own message, but CN can also re-RR n
times the MN if it gets two BKE's when it asked for one.  Some RR
schemes can be extended to make it very hard for attacker to use the
future attack without compromising routers.

Alex

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 24 Jan 2002 18:00:04 +0100 (CET)

> CN but it must also block true RR messages from CN to reach true HA.

The "block" aspects may or may not be needed.
For instance, in BU3WAY it is not needed; a MN receiving a BUC that has not
sent a BUR will silently ignore the BUC. I think this is necessary to avoid
DoS issues where an attacker sends spoofed BUC messages, potentially with
a spoofed source address, in order to use create state on the MN.
But I haven't thought about this in detail - but the point is that it
might not be as trivial as it looks at first sight.
 
But I'm not convinced the difference matters. Somebody that is on-path,
whether connected to a multi-access link using ARP/ND or physically
in a router or switch, is capable of sending and receiving packets as
well as blocking packets from being forwarded.
A possible case when this would not be the case is when the attacker has a 
passive leak/bleed (of the copper or optical wire) for receive and uses
a completely different interface to transmit packets.

   Erik