Subject: RE: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt security

From: "Sami Vaarala" <[email-masked]>
Date: Tue, 30 Apr 2002 10:29:42 +0300

Francis,

As NATs are entities "out of control", attackers and NATs
cannot really be distinguished (in a sense, a NAT is an
attacker).  Since we have to blindly trust the NATted
source address of a RRQ, the current draft therefore allows
an attacker on the route between the MN and the HA to divert
the mobility binding to a bogus address.

I think the only countermeasure would be in the spirit of
IPv6 RR, i.e., a four-message registration request where
the routability of the NATted source address of the RRQ
is ensured.  This would only defeat attackers that cannot
receive packets destinated to the bogus address they are
using.

I personally think the best alternative is to use the draft
as is.  We should add a more verbose description about the
change in Mobile IPv4 security as a result.  We could also
add a note that short mobility binding lifetimes alleviate
the attack;  unless the attacker is constantly active, the
attack causes only temporary disruption.

I don't think IPsec alleviates the problem, though.  IPsec
can prevent redirected traffic from being read, but that is
a service that Mobile IPv4 does not provide anyway.  IPsec
does nothing to authenticate the NATted source address.

-Sami

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: 28 April 2002 16:19
> To: Henrik Levkowetz
> Cc: [email-masked]
> Subject: Re: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt
> security
> 
>    	Ah, I see what you are getting at now. Do you happen to have
>    some text discussing this already?
> 
> => no, I raised the issue during a presentation at the IPCN meeting
> and it seemed the importance was enough to send a short message
> in the list to open a discussion ASAP.
> 
>    If not, would you consider the text below a decent discussion of
>   this problem, and a meaningful conclusion?
> 
>    	"Although using UDP tunnelling as such does not introduce new
>          vulnerablilities, it has to be pointed out that communicating
>          across a NAT in fact does change the situation. Without a
NAT,
> the
>          care-of address in the registration request will be directly
used
>          by the home agent to send traffic back to the mobile node,
and
> the
>          care-of address is protected by the mobile-home
authentication
>          extension. When communicating across a NAT, the effective
care-of
>          address from the home agent point of view is that of the NAT,
>          which is not protected by any authentication extension, but
>          inferred from the apparent IP source address of received
packets.
>          This means that by using the mobile IP registration
extensions
>          described in this document to enable traversal of NATs, one
is
>          opening oneself up to having the care-of address of a mobile
node
>          spoofed. The implication is again that it is RECOMMENDED that
> this
>          mechanism for NAT traversal be used together with IPsec or
>          equivalent mechanisms to further mutually authenticate the
>          communicating parties, and protect the communication."
> 
> => as soon as the problem is explained I am happy.
> I am afraid you have to consider the use of forged care-of address in
> Denial of Service attacks too (IMHO this is far less critical but
> I don't believe nobody won't complain).
> 
> Thanks
> 
> [email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 30 Apr 2002 11:16:55 +0200

attacker).

=> I agree: NATs are evil!

   Since we have to blindly trust the NATted

=> we have to: we should not but we have no choice, is it what it means?

   
=> this introduces a lot of complexity for a weak result.

=> IMHO this is better.

=> I agree: IPsec is efficient only against a part of the threat.
This is why I am afraid the other part (DoS) will be a real concern...

Regards

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Tue, 30 Apr 2002 11:48:28 +0200

Francis and Sami,

	Ok, so we need to add:

	1. A paragraph that describes the mechanism - part of the
text I proposed a couple of mails back might do that if the part
about IPsec is removed

	2. Further text to point out how this can be used for DoS
attacks on a third party, if you are in the path between a MN and
a HA

	3. A recommendation that a short mobility binding lifetime be
used, to alleviate the problem.

	Anything else?

	Regards,
		Henrik

Francis Dupont wrote:
> 
> 
>  In your previous mail you wrote:
>

---

From: Francis Dupont <[email-masked]>
Date: Tue, 30 Apr 2002 12:30:59 +0200

=> I don't understand the part about IPsec: we have to explain
that without IPsec an attacker can get the traffic and read it.
(I believe you'd like to do the right thing but you ask explicitely
my opinion).

   
=> fine!

Regards