Re: [core] FW: New Version Notification for draft-mattsson-core-coap-attacks-00.txt

Hello John,

great work!

I left some comments as issue in

https://github.com/EricssonResearch/coap-actuators

Generally, I personally prefer, if the attack's descriptions also
includes, if some assumption tends to be "can not be excluded" or "can
be demonstrated".

best regards
Achim Kraus

Am 19.05.21 um 05:07 schrieb John Mattsson:
> Hi,
>
> I made an updated to draft-mattsson-core-coap-actuators, renamed the document and submitted it as draft-mattsson-core-coap-attacks-00. Except a few editorial updates, the big addition is a new section on amplification attacks. I think draft-mattsson-core-coap-attacks should be published as an informal document similar to e.g. RFC 7457.
>
> I think CORE needs to discuss and take more concrete action against amplification attacks. Typical CoAP deployments have quite high amplification factors 10-100, CoAP amplification attacks are happening in the wild, and they are getting quite much media attention:
>
> https://www.netscout.com/blog/asert/coap-attacks-wild
>
> https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/
>
> https://www.zdnet.com/article/fbi-warns-of-new-ddos-attack-vectors-coap-ws-dd-arms-and-jenkins/
>
> https://www.helpnetsecurity.com/2019/03/08/iot-coap-ddos-weapon/
>
> https://blog.mazebolt.com/understanding-the-coap-ddos-attack-vector
>
> https://www.securityweek.com/attackers-use-coap-ddos-amplification
>
> https://medium.com/nsc42/what-is-coap-and-is-it-the-next-ddos-for-iot-de8ee97e57e6
>
> https://www.globaldots.com/resources/blog/iot-devices-using-coap-increasingly-used-in-ddos-attacks/
>
> CORE has considered amplification attacks since the start, but the current recommendations are quite soft. There might be reason to strengthen the recommendations or even enforce certain behavior. QUIC has e.g. decided on a maximum amplification factor of 3.... Observe and multicast has the risk of significantly increasing amplification.
>
> I have already received some comments from Carsten who also helped transforming the XML to markdown. I will submit -01 version before the cutoff. Big thanks Carsten! (I never want to manually edit XML again....).
>
> A repository for the draft can be found here:
> https://github.com/EricssonResearch/coap-actuators
> (The draft does not compile after the name change and format change, we will fix that in the coming weeks).
>
> This was previously discussed here
> https://mailarchive.ietf.org/arch/msg/core/i6bf9C0ObT5FIplkHPms9gaC47U/
>
> Cheers,
> John
>
> -----Original Message-----
> From: "internet-drafts@ietf.org" <internet-drafts@ietf.org>
> Date: Sunday, 16 May 2021 at 19:04
> To: Christian Amsüss <c.amsuess@energyharvesting.at>, Göran Selander <goran.selander@ericsson.com>, John Mattsson <john.mattsson@ericsson.com>, Christian Amsuess <c.amsuess@energyharvesting.at>, Francesca Palombini <francesca.palombini@ericsson.com>, Göran Selander <goran.selander@ericsson.com>, John Fornehed <john.fornehed@ericsson.com>, John Mattsson <john.mattsson@ericsson.com>
> Subject: New Version Notification for draft-mattsson-core-coap-attacks-00.txt
>
>
> A new version of I-D, draft-mattsson-core-coap-attacks-00.txt
> has been successfully submitted by =?utf-8?q?John_Preu=C3=9F_Mattsson?= and posted to the
> IETF repository.
>
> Name:		draft-mattsson-core-coap-attacks
> Revision:	00
> Title:		Summarizing Known Attacks on CoAP
> Document date:	2021-05-16
> Group:		Individual Submission
> Pages:		21
> URL:            https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-mattsson-core-coap-attacks/
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-mattsson-core-coap-attacks
> Htmlized:       https://tools.ietf.org/html/draft-mattsson-core-coap-attacks-00
>
>
> Abstract:
>     Being able to trust information from sensors and to securely control
>     actuators are essential in a world of connected and networking things
>     interacting with the physical world.  This document summarizes known
>     attacks, and show that just using CoAP with a security protocol like
>     DTLS, TLS, or OSCORE is not enough for secure operation.  The goal
>     with this document is motivating generic and protocol-specific
>     recommendations on the usage of CoAP.  Several of the discussed
>     attacks can be mitigated with the solutions in
>     [I-D.ietf-core-echo-request-tag].
>
>
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> _______________________________________________
> core mailing list
> core@ietf.org
> https://www.ietf.org/mailman/listinfo/core
>