Re: [rtcweb] Comments on draft-ietf-rtcweb-security-06

[Magnus Westerlund <[e-mail]>]

On 2014-02-24 19:58, Martin Thomson wrote:
> On 24 February 2014 02:05, Magnus Westerlund
> <[e-mail]> wrote:
>> My position is that the above mitigation is unlikely to have significant
>> impact on this attack.
> 
> That was my sense too.
> 
>> There are two reasons I wanted this attack to be considered. First, it
>> provides a clear requirement on having congestion control as first level
>> mitigation.
> 
> Congestion control.  Check.
> 
>> Secondly, I think this could become a significant issue as data channel
>> PeerConnections can be opened without user consent. A malicious JS that
>> is sufficient well spread with a well working find and connect could
>> establish a large mesh of peer connections that could come close to
>> saturate each endpoints local access link, resulting in very heavy loads
>> on the network, even with congestion control. With congestion control
>> you can likely prevent congestion collapse, but you should be fully
>> capable of driving a network into a state of "mostly useless",
>> especially a network suffering from buffer bloat inside of the ingress
>> nodes.
> 
> So the concern is that even with congestion control, a single bad
> actor can use more than their "fair" share of network resources.
> 
> Sadly, this is already true on the web.
> 
> No harm in writing down the potential.  Are you looking for anything
> more than that?

No, I think the main thing is to have something to point at why
congestion control is a MUST. Secondly, at least make people aware that
this mechanism may give a malicious entity more potential for driving
traffic load where they want to cause it than some of the previous
mechanism, due to the ease of finding endpoint and keeping traffic more
localized than in other DDoS attacks. But, sure it will more difficult
to drive the targeted network into completely uselessness.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------