IETF Logo Mail Archive

Re: [Gen-art] Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13

Christian Huitema <huitema@microsoft.com> Sat, 11 July 2015 21:28 UTC

Return-Path: <huitema@microsoft.com>
X-Original-To: gen-art@ietfa.amsl.com
Delivered-To: gen-art@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B287D1ACD0A; Sat, 11 Jul 2015 14:28:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JQRNRk2R9lvt; Sat, 11 Jul 2015 14:28:34 -0700 (PDT)
Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0144.outbound.protection.outlook.com [207.46.100.144]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FA011ACCFD; Sat, 11 Jul 2015 14:28:34 -0700 (PDT)
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com (10.160.96.17) by DM2PR0301MB0654.namprd03.prod.outlook.com (10.160.96.16) with Microsoft SMTP Server (TLS) id 15.1.207.19; Sat, 11 Jul 2015 21:28:31 +0000
Received: from DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) by DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) with mapi id 15.01.0207.004; Sat, 11 Jul 2015 21:28:31 +0000
From: Christian Huitema <huitema@microsoft.com>
To: Warren Kumari <warren@kumari.net>
Thread-Topic: Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13
Thread-Index: AQHQvBYOio2GMoXGj0KV+1V72uLabJ3Wxu1A
Date: Sat, 11 Jul 2015 21:28:31 +0000
Message-ID: <DM2PR0301MB0655F71CD565888B3F1A4DCAA89E0@DM2PR0301MB0655.namprd03.prod.outlook.com>
References: <CE03DB3D7B45C245BCA0D2432779493613FF7529@MX104CL02.corp.emc.com> <55A13B30.4070208@bogus.com> <DM2PR0301MB065593620A6E227EB2D5421CA89E0@DM2PR0301MB0655.namprd03.prod.outlook.com> <CAHw9_iLS1BGmUfeUP7fX58QAZ4QmM72ZcTV6hZZwper40bG+=Q@mail.gmail.com>
In-Reply-To: <CAHw9_iLS1BGmUfeUP7fX58QAZ4QmM72ZcTV6hZZwper40bG+=Q@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: kumari.net; dkim=none (message not signed) header.d=none;
x-originating-ip: [24.16.156.113]
x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0654; 5:J95+brjed10xqCuqpk5egrs6decAMA/g3ywKKc6wCJlZ+QcgQ7wIWgqGDzGVi3RphLwEmGoS0P4oRg87GT0BueEW6rTWOVVDJDVgVNulkPzBHIyGiyefwa46Hpi2vuA0Ez6wyM8obIrPiLalKHDXoQ==; 24:/SDDwZQEJ+6LcKU6OoOEKrnqrcUkoPR8QJeO/dam4/p+eQz2DcypuH5k+i9qoAE6AFYLt07DP1KsaUSYhnFmLqO9GWlcM+Jmkz0INLRt2CA=; 20:YeLos0ySeXwqam9LG1rcodrkYALkesmbCXvllSg3JCv0efS6jTEWWBkfRPpRcUVF/eazZGVC0y/f6795TBkFUQ==
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0654;
x-microsoft-antispam-prvs: <DM2PR0301MB0654286CF44D1412BAF5FE6CA89E0@DM2PR0301MB0654.namprd03.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(108003899814671);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:DM2PR0301MB0654; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0654;
x-forefront-prvs: 0634F37BFF
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(24454002)(377454003)(51704005)(86362001)(106356001)(77156002)(62966003)(106116001)(99286002)(122556002)(40100003)(46102003)(2950100001)(76176999)(50986999)(54356999)(74316001)(92566002)(189998001)(110136002)(2900100001)(86612001)(5001960100002)(5002640100001)(66066001)(93886004)(5003600100002)(230783001)(76576001)(2656002)(19580405001)(102836002)(19580395003)(77096005)(87936001)(33656002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0654; H:DM2PR0301MB0655.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jul 2015 21:28:31.6088 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0654
Archived-At: <http://mailarchive.ietf.org/arch/msg/gen-art/uGod0tGQEhA8o18yEvS1CN3B92c>
Cc: "dhcwg@ietf.org" <dhcwg@ietf.org>, "General Area Review Team (gen-art@ietf.org)" <gen-art@ietf.org>, "ops-dir@ietf.org" <ops-dir@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>
Subject: Re: [Gen-art] Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13
X-BeenThere: gen-art@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "GEN-ART: General Area Review Team" <gen-art.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/gen-art>, <mailto:gen-art-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/gen-art/>
List-Post: <mailto:gen-art@ietf.org>
List-Help: <mailto:gen-art-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/gen-art>, <mailto:gen-art-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 11 Jul 2015 21:28:35 -0000

On Saturday, July 11, 2015 1:13 PM, Warren Kumari [mailto:warren@kumari.net] wrote
> On Saturday, July 11, 2015, Christian Huitema <huitema@microsoft.com> wrote:
>
>> There is definitely an attack vector there. Suppose an attacker can monitor the traffic, say on an 
>> unencrypted Wi-Fi hot spot. The attacker can see a DHCP request or INFORM, and race in a fake 
>> response with an >> URL of their own choosing. The mark's computer automatically connects 
>> there, and download some zero-day attack. Bingo!
>
> An attacker with this level of access can already do this. They fake a DHCP response with themselves 
> as the gateway and insert a 302 into any http connection. Or, more likely they simply inject 
> malicious code into some connection. 
>
> Connecting to unknown/ unencrypted networks is inherently dangerous...

OK, you are probably correct that this is just one of the many attacks possible when connecting to insecure networks. Then, of course, there is the whole idea of letting an untrusted DHCP server direct one's browser to an arbitrary web page. Looks like an ideal setup for zero days and phishing tools. Ideally, we should only process the redirected page into a fairly tight sandbox...

-- Christian Huitema

v2.23.0 | Report a Bug | By Email