RE: Flooding Attacks and MIP6 (was RE: [Mipshop] Review of draft-arkko-mipshop-cga-cba-04)

[Christian Vogt <[e-mail]>]

Vidya,

the attack I was describing is different:  Here the (flooding) attacker
does not use a fake home address, but it uses its current on-link IP
address as a home address.

E.g., the attacker attaches to a public WLAN, receives an RA with prefix
P, autoconfigures an IP address A with prefix P, and uses A as the IP
source address (i.e., the home address) in a HoTI which it sends to the
CN.  The HoT goes back to A, where the attacker can obviously receive
the message.  So the HoA test works fine, and the CN thinks that the
HoTI/HoT exchange went through an HA.

Now, why would an attacker want to do this?  A plausible reason would be
because it wants to redirect traffic to a particular victim node.  Hence
the attacker uses the victim node's IP address B as its CoA, and asks
the CN to send packets to B.

If A is on the path from the CN to B, then the attacker is able to pass
the CoA test.  But then the CN's packets will also hit the attacker
itself, so I don't see a good motivation for such an attack. Otherwise, 
if A is not on the path from the CN to B, then a flooding
attack against B would be more attractive (from the attacker's point of
view).  But the attacker cannot pass the CoA test in such a situation.

The point I was trying to make relates to the HoA test:  Whether or not
a real HA exists, and whether the HoA is with the HA or with the
attacker itself, doesn't matter from the perspective of the CN.

FWIW, IMO this is not a weakness of the HoA test.  The purpose of the
HoA test is solely to verify reachability at the HoA, and the test
meets this objective quite well.  I don't think it would help if the CN
could determine from the HoTI/HoT exchange whether a real HA exists or
not (given that we do not assume a security/trust relationship between
the HA and the CN).

Getting to your question about OSPF/BGP spoofing:  I do agree that we
have a serious problem if an attacker is able to forge OSPF or BGP
messages.  But as outlined above, OSPF/BGP spoofing is not necessary to
spoof the HoA test.  And obviously it is also not the right thing for
spoofing the CoA:  Advertising the CoA prefix through a routing
protocol is really the opposite of what a flooding attacker would want
to do.  After all, its intent is to direct packet not to itself, but to
a victim.

Besides, IMO, OSPF or BGP spoofing is a threat that is orthogonal to
mobility.  It is true that an attacker capable to do this is in a
position to circumvent the HoA test.  But such an attacker can anyway
steal other node's IP addresses arbitrarily.

Ok, take care,
and have a good week end!

- Christian

|
| Christian Vogt
| Institute of Telematics, University of Karlsruhe
| www.tm.uka.de/~chvogt/
|



Zitat von "Narayanan, Vidya" <[e-mail]>:

> Hi Christian,
> Getting back to this thread again :) Please see inline below.
>
>>
>> Another thing is that there may actually be no home agent and
>> home domain admin which a victim could contact.  (I mentioned
>> this in the previous email, but I guess it was lost in the
>> noise.)  E.g., an attacker may attach to a public WLAN,
>> acquire a (possibly temporary) IP address, and use this IP
>> address as a HoA in combination with a false CoA.  The
>> attacker itself would then play the HA part during the HoA test.
>>
>
> I thought I had addressed this in one of my emails, but perhaps I
> hadn't. If we assume that an attacker can fake an HA (which includes,
> among other things, injecting routes for the serving fake home subnet
> into the IGP/EGP so that the HoA test can occur correctly), I would also
> assume that it is equally feasible for the attacker to intercept the CoA
> test messages between the CN and the victim and spoof the CoA test. In
> fact, interception and spoofing of messages is potentially simpler than
> injecting routes into OSPF or BGP.
>
> Would you agree?
>
> Regards,
> Vidya
>
>> Of course, the HoA test would in this case guarantee the
>> attacker's reachability of the alleged "HoA", and hence a
>> victim could theoretically track the attacker down by
>> contacting the public WLAN provider.  But there is no clear
>> and, more importantly, fast procedure that the victim could follow.
>>
>> Also note that the business relationship between the attacker
>> and the public WLAN provider may only be of temporary nature
>> (e.g., an hourly subscription).
>>
>



----------------------------------------------------------------
This message was sent using ATIS-Webmail: http://www.atis.uka.de


_______________________________________________
Mipshop mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mipshop