[core] FW: New Version Notification for draft-mattsson-core-coap-attacks-00.txt

[John Mattsson <[e-mail]>]

Hi,

I made an updated to draft-mattsson-core-coap-actuators, renamed the document and submitted it as draft-mattsson-core-coap-attacks-00. Except a few editorial updates, the big addition is a new section on amplification attacks. I think draft-mattsson-core-coap-attacks should be published as an informal document similar to e.g. RFC 7457. 

I think CORE needs to discuss and take more concrete action against amplification attacks. Typical CoAP deployments have quite high amplification factors 10-100, CoAP amplification attacks are happening in the wild, and they are getting quite much media attention: 

https://www.netscout.com/blog/asert/coap-attacks-wild

https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/

https://www.zdnet.com/article/fbi-warns-of-new-ddos-attack-vectors-coap-ws-dd-arms-and-jenkins/

https://www.helpnetsecurity.com/2019/03/08/iot-coap-ddos-weapon/

https://blog.mazebolt.com/understanding-the-coap-ddos-attack-vector

https://www.securityweek.com/attackers-use-coap-ddos-amplification

https://medium.com/nsc42/what-is-coap-and-is-it-the-next-ddos-for-iot-de8ee97e57e6

https://www.globaldots.com/resources/blog/iot-devices-using-coap-increasingly-used-in-ddos-attacks/

CORE has considered amplification attacks since the start, but the current recommendations are quite soft. There might be reason to strengthen the recommendations or even enforce certain behavior. QUIC has e.g. decided on a maximum amplification factor of 3.... Observe and multicast has the risk of significantly increasing amplification.

I have already received some comments from Carsten who also helped transforming the XML to markdown. I will submit -01 version before the cutoff. Big thanks Carsten! (I never want to manually edit XML again....).

A repository for the draft can be found here:
https://github.com/EricssonResearch/coap-actuators
(The draft does not compile after the name change and format change, we will fix that in the coming weeks).

This was previously discussed here
https://mailarchive.ietf.org/arch/msg/core/i6bf9C0ObT5FIplkHPms9gaC47U/

Cheers,
John

-----Original Message-----
From: "[e-mail]" <[e-mail]>
Date: Sunday, 16 May 2021 at 19:04
To: Christian Amsüss <[e-mail]>, Göran Selander <[e-mail]>, John Mattsson <[e-mail]>, Christian Amsuess <[e-mail]>, Francesca Palombini <[e-mail]>, Göran Selander <[e-mail]>, John Fornehed <[e-mail]>, John Mattsson <[e-mail]>
Subject: New Version Notification for draft-mattsson-core-coap-attacks-00.txt


A new version of I-D, draft-mattsson-core-coap-attacks-00.txt
has been successfully submitted by =?utf-8?q?John_Preu=C3=9F_Mattsson?= and posted to the
IETF repository.

Name:		draft-mattsson-core-coap-attacks
Revision:	00
Title:		Summarizing Known Attacks on CoAP
Document date:	2021-05-16
Group:		Individual Submission
Pages:		21
URL:            https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-00.txt
Status:         https://datatracker.ietf.org/doc/draft-mattsson-core-coap-attacks/
Htmlized:       https://datatracker.ietf.org/doc/html/draft-mattsson-core-coap-attacks
Htmlized:       https://tools.ietf.org/html/draft-mattsson-core-coap-attacks-00


Abstract:
   Being able to trust information from sensors and to securely control
   actuators are essential in a world of connected and networking things
   interacting with the physical world.  This document summarizes known
   attacks, and show that just using CoAP with a security protocol like
   DTLS, TLS, or OSCORE is not enough for secure operation.  The goal
   with this document is motivating generic and protocol-specific
   recommendations on the usage of CoAP.  Several of the discussed
   attacks can be mitigated with the solutions in
   [I-D.ietf-core-echo-request-tag].




Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat