[Perc] SSRC splicing attach in perc double when MID/BUNDLE is used (i.e. WebRTC)

[Sergio Garcia Murillo <[e-mail]>]

In the media framework it is stated the following regarding SSRC 
splicing attacks:

    The splicing attack is an attack where a Media Distributor receiving
    multiple media sources splices one media stream into the other.  If
    the Media Distributor is able to change the SSRC without the receiver
    having any method for verifying the original source ID, then the
    Media Distributor could first deliver stream A and then later forward
    stream B under the same SSRC as stream A was previously using.  By
    not allowing the Media Distributor to change the SSRC, PERC mitigates
    this attack.

However, if BUNDLE and MID are used, and there is no ssrc signaling done 
in SDP, the following RTP demuxing rules from BUNDLE spec applies:

    If the packet has a MID, and the packet's extended sequence number
    is greater than that of the last MID update, as discussed in
    [RFC7941], Section 4.2.6  <https://tools.ietf.org/html/rfc7941#section-4.2.6>, update the MID associated with the RTP
    stream to match the MID carried in the RTP packet, then update the
    mapping tables to include an entry that maps the SSRC of that RTP
    stream to the "m=" section for that MID.

Given that MID is by definition HBH as it must match the negotiated SDP 
O/A, then the MD could arbitrarily change the MID for an RTP packet and 
associate it with whatever transceiver it wishes, effectively having the 
same effect than the SSRC splicing attack (at least in perc double where 
all participants share the same inner e2e key and there).

Best regards

Sergio