Re: [Madinas] [Int-area] BoF and Non-WG Mailing List: madinas -- MAC Address Device Identification for Network and Application Services

[[e-mail]]

Re-,

Please see inline. 

Cheers,
Med

> -----Message d'origine-----
> De : Carsten Bormann [mailto:[e-mail]]
> Envoyé : lundi 2 novembre 2020 09:33
> À : BOUCADAIR Mohamed TGI/OLN <[e-mail]>
> Cc : [e-mail]
> Objet : Re: [Madinas] [Int-area] BoF and Non-WG Mailing List:
> madinas -- MAC Address Device Identification for Network and
> Application Services
> 
> Hi Med,
> 
> > On 2020-11-02, at 09:10, <[e-mail]>
> <[e-mail]> wrote:
> >
> > Hi Carsten,
> >
> > The DDoS attack in the slides is ** from ** a compromised device
> in a home network.
> >
> > Instead of deploying filters at the ISP side, which may impact the
> overall services offered to the home (collateral damage), the
> filtering is done at the CPE: the CPE should identify and then
> isolate the compromise device.
> >
> > The identification can be based on the MAC @, but as mentioned in
> the slides changing the MAC@ can bypass the filtering.
> 
> I think I understand all that.
> 
> > Randomization will further exacerbate this.
> 
> This is the part where I’m not sure that the impact is significant.

[Med] This will depend on how frequent the change will occur (or will be told to occur).   

> Once these countermeasures are widely deployed, attackers will do
> counter-countermeasures.  It is easy to change a MAC address on a
> compromised device.  Also, I don’t think MAC address randomization
> is effective enough to thwart the countermeasure (too slow time
> frames), so attackers will have every incentive to do their own MAC
> address changing.

[Med] Agree. This is the message in the last slide.  

> 
> Instead, I think we need to work on effectively jailing IoT devices
> in the home without trying to cop out by using the MAC address as a
> selector.

[Med] That’s a good target. Interim targets may be, for example, to locally coordinate MAC changes if a device want to continue be granted connectivity access. 

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.