Subject: [mobile-ip] comments on draft-ietf-mobileip-mipv6-18++

From: Mauro Tortonesi <[email-masked]>
Date: Mon, 7 Oct 2002 23:27:10 +0200 (CEST)

on section 5.2.5, point 2a, page 15, it states:

The message is sent to the mobile node via the home
agent; the protocol relies on the assumption that the route                                                  
between the home agent and the mobile node is secure.

does this mean that the protocol is prone to man-in-the-middle
attacks?

in theory, if an attacker is able to read both the care-of test
and the home test messages during the return routability procedure,  
he can impersonate the mobile node and perform malicious binding 
updates. 

in practice, the communication path MN-CN and MN-HA-CN are likely to be 
quite different, so it would be extremely difficult for an attacker to 
listen on both the paths. moreover, such an attacker would probably need 
to know both the Home Address and the Care-of Address of the Mobile Node, 
to perform a mitm attack. and then there's the sequence number mechanism 
of the BU message for the attacker to break. this could in theory be done 
if an attacker could be able to listen to binding update messages and
prevent them to be delivered to the CN, so that he/she can produce fake 
binding update messages.

am i wrong? perhaps this kind of considerations should be included in the 
next version of the draft?

-- 
Aequam memento rebus in arduis servare mentem...

Mauro Tortonesi			[email-masked]
				[email-masked]
Ferrara Linux Users Group	http://www.ferrara.linux.it
Project6 - IPv6 for Linux	http://project6.ferrara.linux.it

---

From: Vladislav Yasevich <[email-masked]>
Date: Tue, 08 Oct 2002 10:23:01 -0400

> does this mean that the protocol is prone to man-in-the-middle

The RR protocol is prone to the MitM only on the
HA-CN link.  A malicious node on that link can
impersonate the MN, create flase bindings and
delete valid bindings and anything else it wishes.

It would be able to cause havoc whether the mobile is
at home or away.

> he can impersonate the mobile node and perform malicious binding 

All it needs to intersept is the home test messages.  It can then
use it's own address as coa (or forge an address) and redirect trafic.

> next version of the draft?

The goal behind RR was "do no harm".  That is, it
does not open any additional problems to the ones
that already exist for stationary nodes.

I think the security considerations section already covers this (section 14.4.2)

-vlad
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich		Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 		Tel: (603) 884-1079
Nashua, NH 03062		ZKO3-3/T07