Subject: RE: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt

From: "Bora Akyol" <[email-masked]>
Date: Thu, 18 May 2006 09:08:07 -0700

Hi

I have one question regarding section 4.3 in this document.

Since the attacker needs to guess both ends of the TCP connection
including IP addresses and TCP ports, I am not sure what the benefit
of ICMP payload parsing is in this case.

I am sure I missed something here.

Thanks

Bora

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Fernando Gont <[email-masked]>
Date: Fri, 19 May 2006 01:57:58 -0300

>I am sure I missed something here.

The "benefit" is being a good network citizen. When you perform 
egress-filtering, you preventyour own users from performing 
ICMP-based attacks against systems that belong to other networks.

Regarding that of having to guess the two-endpoints of the TCP 
connection, the answer is simple: Even TCP-based attacks, in which 
you have to guess not only both endpoints, but *also* the TCP 
sequence number, are of concern nowadays.

Have a look at Paul Watson's presentation at CanSecWest 2004, and at 
the tcp-secure document of this WG.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Fernando Gont <[email-masked]>
Date: Fri, 19 May 2006 01:41:28 -0300

Kindest regards,

---

From: Joe Touch <[email-masked]>
Date: Thu, 18 May 2006 22:47:07 -0700

Fernando Gont wrote:
> egress-filtering, you preventyour own users from performing ICMP-based 
> attacks against systems that belong to other networks.

What about errors based on loose source routes, or just misdirected 
traffic? I.e., how do you know that it's not appropriate to indicate 
that a host (especially) isn't in your net when asked; that would cause 
certain ICMPs never to be issued (net unreachable, host unreachable) if 
they reach a forwarding point in your net that isn't a valid address for 
your net (which is entirely reasonable).

Joe

---

From: Joe Touch <[email-masked]>
Date: Thu, 18 May 2006 22:50:49 -0700

Joe

---

From: Joe Touch <[email-masked]>
Date: Thu, 18 May 2006 22:50:49 -0700

Fernando Gont wrote:
...
> Have a look at Paul Watson's presentation at CanSecWest 2004, and at the 
> tcp-secure document of this WG.

FWIW, the citations in tcp-antispoof are more complete (include a URL, 
e.g., for Paul's presentation, as well as a number of other citations) 
on this issue.

Joe

[email-masked]>
	<[email-masked]>
Cc: [email-masked]

Fernando Gont wrote:
...
> Have a look at Paul Watson's presentation at CanSecWest 2004, and at the 
> tcp-secure document of this WG.

FWIW, the citations in tcp-antispoof are more complete (include a URL, 
e.g., for Paul's presentation, as well as a number of other citations) 
on this issue.

Joe

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 01:29:08 -0300

At 15:26 19/05/2006, Joe Touch wrote:

>>>Your analysis (and some of the work of many throughout this WG, as 
>>>well) tends to assume that everything unexpected is a deliberate 
>>>attack, and thus must be quenched. What if the unexpected is 
>>>legitimate? What capability are you disabling as a result?
>>Joe,
>>That's exactly the questions I'd like you to answer regarding your 
>>suggestion that ignoring ICMP error messages (wrt. IPsec for 
>>instance) is good thing to do
>
>I don't think it is in general. I think that IF you have a security
>concern, then you can decide to turn them off FOR YOURSELF (or at your
>firewall). But that's no different from blocking certain ports or 
>protocols due to security concerns.

"If you have a security concern"?????

Who doesn't have a security concern?

Even if the only thing I did with the Internet was to download 
pirated music and porn, as a user I would still be concerned about my 
downloads being interrupted by some idiot firing ICMP messages.

>I don't want to dictate that sort of behavior for the protocol as a 
>rule exactly because it turns off a capability for those not under attack.

Yea... And the door you have in your house turns off a capability in 
those cases in which there are no thieves out there.

C'mon Joe. There's a point in which what is supposed to be religion 
turns into something else....

Kindest regards,

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 01:29:08 -0300

At 02:47 19/05/2006, Joe Touch wrote:

>What about errors based on loose source routes,

Loose source routes? Does anybody still use this? Or, well, even 
worse, does any body still process this?

>or just misdirected traffic? I.e., how do you know that it's not 
>appropriate to indicate that a host (especially) isn't in your net 
>when asked; that would cause certain ICMPs never to be issued (net 
>unreachable, host unreachable) if they reach a forwarding point in 
>your net that isn't a valid address for your net (which is entirely 
>reasonable).

With the same argument, you could never implement ingress/egress filtering.

Joe, the E in IETF stands for Engineering!

Kindest regards,

02BG-LH
	for [email-masked]; Sat, 20 May 2006 01:24:13 -0400
Date: Sat, 20 May 2006 02:19:00 -0300
To: "Bora Akyol" <[email-masked]>,
	"Templin, Fred L" <[email-masked]>, [email-masked]
From: Fernando Gont <[email-masked]>
Subject: RE: [tcpm] ICMP and TCP
Cc: 

At 18:19 19/05/2006, Bora Akyol wrote:

>The point is that TCP IMHO is powerless to secure ICMP messages.
>By making changes to TCP to declare ICMP errors as soft errors
>depending on the state and ignoring some errors altogether,
>we are trying to create a workaround for a problem with another layer
>in the protocol stack.

Engineering, maybe?

>This is all and well to solve a short term goal, but what is the long
>term answer?

Well, you are probably getting into "architecture" issues.

You would end up asking other questions such as:
Shouldn't multihoming be a network layer thing, rather than a 
transport protocol thing?
Where should we really be doing congestion control?

etc.

Kindest regards,

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 01:29:08 -0300

Kindest regards,