Subject: RE: [mobile-ip] RE: Is RR only enough ?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 7 Jan 2002 15:18:49 +0100

Hi Erik, 

[Also Pekka N, the attack we've been discussing 
here is the same one you outlined in your mail]

  > > => Well, this is a much simpler attack. That is, assuming
  > > the MITM is in the right location, this attack
  > > is easily done by one BU and steals all connections.
  > 
  > So your point is that the attack program that a hacker 
  > needs to write
  > would be significantly shorter and easier to develop?
  > You're probably right, but I don't think that means there 
  > is more harm - once
  > the attack software is written and distributed to the 
  > attackers out there
  > they can cause the same amount of harm.

=> You're right, sorry I wrote the last 
mail in a haste and should have clarified my 
point a lot more. 

I see some common assumptions between the attacks 
you mention in 'today's Internet' and the attack
I'm referring too. These common assumptions are
basically that MITM is in the right location. 

Now there are differences between the two types
of attacks (the one you refer to and the one I
mentioned on this thread). The 2 major differences
are:

1. You implied that today's MITM attacks (or at 
least the ones you mentioned in this thread)
can be avoided be e2e encryption. The attack I'm
referring to can not be avoided by e2e encryption. 

2. If I understood you correctly, you were implying
that the MITM in the scenario you mentioned is 
intercepting packets. I.e. the MITM has the ability
to receive the packets, modify them and hence cause
a situation where both a MN-CN connection 'goes 
through him'. On the other hand, in the attack I'm 
referring to, the MITM only needs to 'see' the 
packets addressed to the Home address of the MN. 
He doesn't need to intercept any packets.

So lets consider this scenario:

- Bad Guy is on the path between the CN and the HA. 
For simplicity lets assume Bad Guy is on an ethernet. 

- Bad Guy forms an address based on the RA on that 
  ethernet. Bad Guy also puts his card in promiscuous
  mode. 

- Bad Guy sees one packet addressed to the MN's Home 
  address. From that he gets the CN's address and 
  the MN's home address (he could have the home address
  before anyway, it would be public knowledge). 

- No Bad Guy can launch this attack regardless of whether
  e2e security is used between the MN and CN. 

So I think the significant differences between our 
attack scenarios are (1) and (2). In particular, 
I believe (1) is a dangerous difference.

Sorry for not making myself clearer before. 

  >  
  > > Furthermore, if the MITM happens to be close enough
  > > to the HA, he can do this attack for all MNs served
  > > by that HA (assuming that he is close enough so
  > > that most of the traffic addressed to the HA will
  > > be seen by him). 
  > 
  > Yes, but this doesn't seem any more diffenrent than an 
  > attacker close to
  > the border router of e.g. sun.com being able to be a MiTM for most
  > of the traffic to/from all of Sun.

=> Yep. You're right

  > 
  > > I would assume that in the cases you mention, the
  > > MITM would have to do more work to be able
  > > to steal a TCP connection for example. Actually
  > > I don't know how the MITM can 'steal' the TCP 
  > > connection in the scenario you mention. Please
  > > note that I'm talking about stealing the existing
  > > conneciton (receiving the information addressed
  > > to the MN), rather than modifying packets and 
  > > causing the connection to be dropped.
  > 
  > I depends what the attacker want to do.
  > For instance with the TCP packet stream in both directions 
  > the attacker
  > can easily respond to a HTTP get from the MN to the CN which 
  > completely different data, while consuming the actual HTTP 
  > response from the
  > CN.

  > 
  > In the TCP MiTM case I don't think a DoS attack is needed on the MN.
  > The attacker on path is presumably capable of supressing 
  > packets from
  > being delivered as was as injecting its own (spoofed) packets.

=> Here is why I think you imply that the attacker can 
'receive' packets or intercept them.

I don't know how to assess whether an attack is 
significantly worse than another, perhaps someone
can point me to some general guidelines, but AFAICS,
this attack (I mention above) seems to be significantly
different from the ones existing today.

Just to overload this email a bit, I'd like to suggest
that IF all agree that this attack is significantly
different from today's attacks we can choose between
two options I have in mind:

- CGAs combined with RR as one obvious option

- Extending BU3WAY or BUSEC to make them BU4WAY :)
So in this case the MN would send 'half' the secret
through the HA, and the other half directly from
its CoA. The CN would also reply in both paths
(i.e. one to the Home address and one to the CoA). 

One assumption: ingress filtering on source addresses 
is widely used. 

Based on this suggestion and the assumption above, 
the attacker will not be able to use the MN's Home
address as a source address since the packet will be 
dropped by ingress filtering. 
I don't know if this is a realistic scenario (assuming
ingress filtering everywhere). But... just a thought.

Cheers,
Hesham

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 7 Jan 2002 19:54:23 +0100 (CET)

> referring to can not be avoided by e2e encryption. 

If e2e security is done right any MiTM attack would just be capable of
performing a DoS attack by preventing communication.
"Done right" assumes that the peers some how know the identity of each
other and the public keys associated with those identities
and that's what is required to be able to securely be able to communicate with
a known entity.

> He doesn't need to intercept any packets.

Yes, there is such a subtle difference.
But Maruc Leech said in the MobileIP meeting in SLC that for on-path
attacks we shouldn't worry about the distiction between an active
and a passive attacker. 
This seem to make sense to me - if somebody uses ARP/ND spoofing to gain access
on multi-access links or hacks a switch/router in the path it would be easy
for them to modify packets.

>   e2e security is used between the MN and CN. 

But without binding updates the additional piece that is needed
in today's internet is to spoof the ARP packets for the routers'
and victim's IP addresses and now all packets will go through the attacker.

There is a subtle difference in that an ARP spoofing attack might be more
"visible" than snooping the wire - if an admin happens to look at the
content of the ARP cache during the attack the admin might observe that it
doesn't look like the router's Ethernet address.
But an admin is pretty unlikely to look.

> different from the ones existing today.

I agree there are differences but I find them rather subtle.
I don't have a magic way to tell the difference other than by trying to
put myself in the shoes of a determined attacker. If the attacker can get
access to a multi-access link in the path what can be done?
If the attacker can break a switch/router in the path what can be done?

> - CGAs combined with RR as one obvious option

I agree that CGA+RR is stronger than just RR.
I'm just trying to make sure we all understand what the differences are
in terms of residual attacks.

> (i.e. one to the Home address and one to the CoA). 

BU4WAY wouldn't address an attacker on the CN's link, right?
I think it is easier to attack at the edges (where there are lots of hosts)
than in the middle of the network. 
And even with BU4WAY an attacker between the CN and HA can just claim to
itself be the CoA, thus it would be on both of the paths.

> dropped by ingress filtering. 

If the attacker is on the path between the HA and the CN
it sits on the path where packets normally tracel what have the HoA as a source
thus ingress filtering can't filter those out.

   Erik