Re: [radext] Fwd: RE: Fwd: RE: Fwd: RE: Mail reguarding draft-ietf-radext-dynamic-discovery

[Stefan Winter <[e-mail]>]

Hi,

>   What about the discovered server?  It would be subject to attacks by
> third parties.
> 
>   i.e. realm A lists proxy B as it's server via DDNS.  It then publishes
> an article saying "free net access by using user@realmA".  Everyone
> wanting free net access contacts proxy B.  Repeat for 10,000 domains,
> and Proxy B gets a DoS.

It also just occured to me that your attack is too complex to be useful
for an attacker; it would require actual humans lured into trying to log
into realmA in masses, so that their login attempts overload proxy B. It
would require hundreds or thousands of humans trying to log in per
second so that proxy B feels the load.

If realmA really wants to DoS proxy B, they would take note of proxy B's
IP address and port, and hire a cheap botnet. The botnet would simply
not care whether there is a reverse IP to check.

In short... once your server is up in the open, it can be contacted by
anyone, like it or not. An implementation needs to cope with that.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]