Re: ICMP PTB spoofing attacks

[Fernando Gont <[e-mail]>]

On 02/05/2016 05:25 PM, Templin, Fred L wrote:
>>>
>>> By "accurate" I mean:
>>>
>>> - the router that sends the ICMP PTB is telling the truth that there is a restricting link
>>> - the MTU value that the router writes in the PTB is in fact the true MTU of the
>>>    restricting link
>>
>> Well, most of these protocols run on "good faith", right? -- If I cannot
>> trust the router to tell the truth, why should I trust it to e.g.
>> forward my packets?
> 
> A router's trustworthiness for forwarding packets and for telling the truth
> in any ICMP PTB message it sends are mutually exclusive - the first question
> is one of availability and the second is one of integrity.

I think that, at the end of the day, its about trust. Can I trust the
device, or not?

I my goal as an attacker is to DoS your communications, I don't care
whether I achieve that by simply throwing your packets away, or by
sending you some packet that will cause yourself to shutdown and not talk.

I should say, however, that in the IPv6 case, the worst case scenario is
a 1280-byte MTU link...


> Plus, it is not necessarily just the on-path routers - any off-path "router"
> could also inject spurious PTBs.

For off-path attackers, you validate ICMP PTBs. If you don't, well...
prepare for trouble.  And, yes, if EHs are in use, you may not be able
to verify them.

-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492