Subject: [tcpm] clarification of Steve Bellovin's attack discussion

From: Joe Touch <[email-masked]>
Date: Sun, 12 Nov 2006 09:48:56 -0800

Hi, all,

At the meeting in San Diego last week, Steve Bellovin presented a case
in favor of updating TCP/MD5.

As part of that discussion, there was a brief reference to an attack
which happened recently at Columbia Univ, in which a machine was
compromised and used to attack other machines on their network.

I believe Steve was asked whether an updated TCP/MD5 would have
protected some aspects of that attack (not the compromising of the
machine per se, but the subsequent opportunity for attack). I believe he
replied "yes". (please correct me if this is not the case on either point)

However, the slides (here) suggest that the attack inside the network
was ARP-level, and the compromising of the machine at the FTP level:
<http://www3.ietf.org/proceedings/06nov/slides/saag-3.pdf>

Steve: could you address whether - and specifically how - transport
security would be useful in this case?

While I remain in favor updating transport security for completeness (if
it can be done orthogonally), it'd be very useful to understand where it
might be of potential benefit.

Joe

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Ted Faber <[email-masked]>
Date: Mon, 13 Nov 2006 10:59:07 -0800

> security would be useful in this case?

While I'm certainly curious about how that attack proceeded and what one
could do to prevent others like it, I believe that this was a
non-motivating example for the MD5 update.  He brought it up at the
mike, not as a driver for the proposed work.

My recollection was that he asserted that the MD5 would have, at best,
affected the initial intrusion, and he didn't seem too sure about that.
:-)

I didn't think that this was a deciding factor in the hum, but people's
opinions were swayed significantly by this example, then I'm more
interested in delving into the details.

I'd love to hear from people who think that delving is important.

> might be of potential benefit.

I think it's pretty clear where this is of importance.  Any attack based
on tweaking the TCP header or where the loose semantics between IPSec
(later 3) and TCP (layer 4) are key.  You gave a nice example of the
latter with your FIN example at the meeting.

-- 
Ted Faber
http://www.isi.edu/~faber           PGP: http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See http://www.isi.edu/~faber/FAQ.html#SIG
_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Mon, 13 Nov 2006 11:04:48 -0800

Ted Faber wrote:
...
> latter with your FIN example at the meeting.

The general benefit of a transport solution is one thing (which I agree).

The widespread need or utility of such a solution is another (which I'm
not clear on at all).

Joe

---

From: Ted Faber <[email-masked]>
Date: Mon, 13 Nov 2006 11:21:18 -0800

> The widespread need or utility of such a solution is another (which I'm

Fair enough.  I really don't know how one could assess that objectively.

My sense of the room on Thursday was that overall the work was
interesting and important enough that the WG decided to proceed.