Subject: RE: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt

From: "Bora Akyol" <[email-masked]>
Date: Fri, 19 May 2006 10:43:06 -0700

No

This is wrong. I have read the tcp secure document and seen
the presentation as well. I am not contesting that you need to guess
the sequence number to succeed, this is obvious. I also know that
it is easier than initially thought to guess the sequence number even
when the attacker is off-path.

My point is that you assume that a firewall somewhere in the network has
the information to decide what packets can originate from where and
filter it. 

The benefit of implementing this feature is minimal IMHO at a
considerable
complexity to hardware implementations.

Can you also document how this works with mobile IP and other protocols
that use
a care of address (I believe some of the Wireless LAN tunneling does
this too).

Bora

> -----Original Message-----
> From: Fernando Gont [mailto:[email-masked]] 
> Sent: Thursday, May 18, 2006 9:58 PM
> To: Bora Akyol; [email-masked]
> Subject: RE: [tcpm] Comments on draft-ietf-tcpm-icmp-attacks-00.txt
> 
> At 13:08 18/05/2006, Bora Akyol wrote:
> 
> >I have one question regarding section 4.3 in this document.
> >
> >Since the attacker needs to guess both ends of the TCP connection 
> >including IP addresses and TCP ports, I am not sure what the 
> benefit of 
> >ICMP payload parsing is in this case.
> >
> >I am sure I missed something here.
> 
> The "benefit" is being a good network citizen. When you 
> perform egress-filtering, you preventyour own users from 
> performing ICMP-based attacks against systems that belong to 
> other networks.
> 
> Regarding that of having to guess the two-endpoints of the 
> TCP connection, the answer is simple: Even TCP-based attacks, 
> in which you have to guess not only both endpoints, but 
> *also* the TCP sequence number, are of concern nowadays.
> 
> Have a look at Paul Watson's presentation at CanSecWest 2004, 
> and at the tcp-secure document of this WG.
> 
> Kindest regards,
> 
> --
> Fernando Gont
> e-mail: [email-masked] || [email-masked] PGP 
> Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
> 
> 
> 
> 
> 
> 
> 

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 01:56:39 -0300

>complexity to hardware implementations.

Ingress/egress filtering of ICMP packets is included as additional 
countermeasures that could be implemented.

The real fix for each attack is right after the corresponding attack 
description.

>a care of address (I believe some of the Wireless LAN tunneling does

Do you mean how simple ingress/egress filtering works with mobile IP? ;-)

Well, in many cases it will probably be troublesome.

Kindest regards,

--
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: Fernando Gont <[email-masked]>
Date: Sat, 20 May 2006 01:56:39 -0300

Kindest regards,