Subject: [RPSEC] -02 Threats Draft review

From: Jean-Jacques Puig <[email-masked]>
Date: Thu, 4 Sep 2003 16:39:22 +0200

Hello,

	Some parts we may need to work on:

A]

>2. Routing Functions Overview
>
>   This section provides an overview of common functions that are shared
>   among various routing protocols. In general, routing protocols share
>   the following common functions:

Wouldn't
	'Routing protocols share the following functions:'
	be sufficient ?
	
B]

Are the words authorized/unauthorized used consistently ?

>3. Generic Routing Protocol Threat Model
>
>   The model developed in this section can be used to identify threats
>   to any routing protocol. It examines attacks which can be launched
>   against routing from subverted entities within the routing system,
>   and from entities outside the routing system. Both of these types of
>   entities are called >>unauthorized<< entities.

I agree on this one, but:

>3.1.1 Threat Sources
>...
>   o  Threats that result from subverted devices (e.g. routers): A
>      subverted device (router) is an >>authorized<< router that may have
>      routing software bugs, hardware defects, incorrect or unintended
>      configurations. Devices can be susceptible to such threats due to
>      the lack mechanisms to verify system integrity (For example, the
>      router is working correctly as been intended by the authoritative
>      network administrator), or such mechanisms can be circumvented.
>      Such threats may enable attackers to inappropriately claim
>      authority for some network resources, or violate routing
>      protocols, such as advertising invalid routing information.

That is: Section 3 intro states that subverted devices are unauthorized,
while threat sources states the opposite. Is a clarification needed ?

C]

>3.1.2 Threat Consequences

The list is big. Yet, I would also propose:

o	Performance: data traffic destined for the network is forwarded on a
	path which has performance caracteristics that would not have been
	elected for this traffic.

(Performance, or incorrect allocation of ressources)

Let's take an instance:
                +-----------R1----------R2-----------+
    Left_Nets -<------------R3----------R4------------>- Right_Nets
                +-----------R5----------R6-----------+

An attacker has interest in a certain application somewhere in
Right_Nets. Links within Left_Nets and Right_Nets satisfy the attacker
requirements, in terms of bandwidth, rtt, etc. Normal path between
Left_Nets and Right_Nets is through R3 - R4, in both ways. The attacker
may confuse routers to change to a faster path (e.g. R1-R2). He
can also behave differently if his application has asymetric
requirements, and confuse routers to set up a path in one way with great
bandwidth and in the other way with, say, low latency. This is
interesting if link medias provide different bandwidth or latency, or if
some path offer more bandwidth merely because they host less traffic, or
also because of the scheduling policy on the routers if they provide
QoS.

On the other hand, the attacker can also damage applications using the
same means: long latency paths will cause timeouts in many apps.

Note that this is different from congestion: congestion may be obvious
if it lasts long, but here tcp congestion control will react to
congestion, and the pb is less detectable.

Of course, we are concerned about the network, and not applications.
Damage to the network is other consumption of resources, corruption of
forwarding policies, reduction of the forwarding quality.

Does it make sense ? Is it redundant with a fore-mentionned consequence
?

D]
(overclaiming)

>   o  Where deception is concerned, the consequence zone covers the
>      routers that >>do not believe<< the attacker's advertisement and use
>      the attacker to reach the claimed subnets (Router B and other
>      deceived routers on the Internet in Figure 2 and Figure 3).

How can they be deceived by the attacker if they do not believe it ?

-- 
Jean-Jacques Puig

[homepage] http://www-lor.int-evry.fr/~puig/

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Jean-Jacques Puig <[email-masked]>
Date: Wed, 10 Sep 2003 09:38:58 +0200

On Tue, Sep 09, 2003 at 09:40:59AM -0400, Sandy Murphy wrote:
> I would say that a legitimate router that was subverted (which, by the
> way, is defined in the draft as meaning a router with software bugs, hardware
> defects or misconfigurations, not one that was broken into) was still an
> authorized router - it might be using its authorization improperly but
> it still holds the authorization.  To say otherwise is to make
> authorization a property that changes magically if a hardware defect
> occurs.  Which would hardly be within the capability of a peer router
> to detect.

Agree. But should threat sources mention only legitimate routers that
was subverted, or should it rather mention all subverted routers, among
which a sub-category are also authorized participants ? I had the
feeling from the intro to the threat model that by default all subverted
devices were under consideration.

> The draft includes:
>    o  Delay: data traffic destined for the network or host is forwarded
>       along a route that is in some way inferior to the route it would
>       otherwise take,
> 
> as a damage that might accrue to a host or network address.  The "in
> some way inferior" covers almost any measure of quality, but the use
> of the term "delay" hints that the motivation was to cover routes that
> were longer (in hops, in source-destination round-trip time, etc.)
> than the protocol would otherwise find.  This is very important in
> some applications as you note.  And it is important in some networking
> environments, like wireless, where excess resource consumption is an
> issue.

I partly agree. The fact is the goal of the attack may also be the
opposite: to get a data traffic forwarded along a route that is in some
way superior (that is: promote a traffic). The attacker may be clever
enough to limit side effects significantly so that no delay variation
appears for normal traffic.
In a nutshell, he steals resources that are currently unused. e.g. on
some links (satellite & wdm ?) more bandwidth than required may be
available. Bandwidth consumption on these links will have almost no
influence on delay.

> Surely a typo.  (But rather a critical one.)

That's both the good and the bad part of not having a good level of
English: I'm quickly unseated by such things :) 

-- 
Jean-Jacques Puig