[saag] Classifying MITM attacks

[Jonathan Hoyland <[e-mail]>]

Hi SAAG,

So I've been thinking about classifying MITM attacks a little over the
winter break, à la draft-richardson
<https://www.ietf.org/archive/id/draft-richardson-saag-onpath-attacker-01.html>,
and did a quick literature survey to see what academia has to say about
MITM attacks, and their variations.

The best paper I found was "A survey of man in the middle attacks" [1],
which doesn't propose any terminology, but does group the attacks.

I think a decent ontology would be a useful bit of work.

To that end, I was thinking about what kind of attacks should be in scope,
and thus should unambiguously be captured in a taxonomy.

Some potentially ambiguous examples:

   1.

   If both endpoints are anonymous, is the attack still a MITM attack?
   What's the line between two separate connections and a MITM attack in an
   anonymous scenario?

   a. What about in a scenario where identities can't be verified, such as
   vehicle-to-vehicle / vehicle-to-environment communications in a remote
   area?
   2.

   If I put a probe on a bus am I performing a MITM attack? At what point
   does a MITM attack shade into compromise of the endpoint?


   1.

   In a group chat scenario does impersonating another user count as a MotS
   attack? Consider Alice, Bob, and Carol all legitimately participating in a
   group chat. If Carol impersonates Bob to Alice (and herself) in the group
   chat, how would we describe that attack?


   1.

   If I stick a malicious QR code over an on-boarding QR code, what kind of
   MITM attack have I performed?

   a. If Mallory swaps the registration QR codes of two devices, and Alice
   then registers Bob's device has she performed a MITM attack?

Another useful exercise might be to go through the attacks listed in [1]
and check any ontology describes them appropriately. (Finding this paper
online is surprisingly hard, but I'm happy to send anyone a copy.)

One final question is do we want a strict taxonomy, where each attack fits
into exactly one category, and relationships between attacks are captured
by distance in the tree, or do we want a more flexible ontology where we
can classify attacks more fuzzily, but still have basic groups?

One comment specific to the draft is that it currently uses the term
"in-the-rough", which I don't really like.

As a non-golf player "in-the-rough" makes me think of precious stones, not
a golf metaphor.

Esp. as no dictionary I could find [1]
<https://www.merriam-webster.com/dictionary/in%20the%20rough> [2]
<https://www.dictionary.com/browse/in--the--rough> [3]
<https://www.collinsdictionary.com/dictionary/english/in-the-rough> [4]
<https://www.urbandictionary.com/define.php?term=in%20the%20rough> lists
the golf meaning even as a subsidiary meaning, I think we should come up
with something more understandable, esp. to non-golf players and non-native
English speakers.

Suggestions for better terminology would be welcome.

I've also pushed a PR <https://github.com/mcr/saag-onpath-attacker/pull/1>
cleaning up some of the text.

Regards,

Jonathan

[1] Conti, Mauro, Nicola Dragoni, and Viktor Lesyk. "A survey of man in the
middle attacks." *IEEE Communications Surveys & Tutorials* 18.3 (2016):
2027-2051.