IETF Logo Mail Archive

Re: [saag] can an on-path attacker drop traffic?

Nico Williams <nico@cryptonector.com> Wed, 02 September 2020 19:33 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 771C23A0D41 for <saag@ietfa.amsl.com>; Wed, 2 Sep 2020 12:33:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cryptonector.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QzzOj_C52i8y for <saag@ietfa.amsl.com>; Wed, 2 Sep 2020 12:33:07 -0700 (PDT)
Received: from fossa.birch.relay.mailchannels.net (fossa.birch.relay.mailchannels.net [23.83.209.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 376D73A0D3F for <saag@ietf.org>; Wed, 2 Sep 2020 12:33:07 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 165637011FC; Wed, 2 Sep 2020 19:33:06 +0000 (UTC)
Received: from pdx1-sub0-mail-a40.g.dreamhost.com (100-96-23-39.trex.outbound.svc.cluster.local [100.96.23.39]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id A56EF701394; Wed, 2 Sep 2020 19:33:05 +0000 (UTC)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from pdx1-sub0-mail-a40.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.18.9); Wed, 02 Sep 2020 19:33:06 +0000
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Lonely-Quick: 15c6b7af3c66a203_1599075185907_9076568
X-MC-Loop-Signature: 1599075185907:102620037
X-MC-Ingress-Time: 1599075185906
Received: from pdx1-sub0-mail-a40.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a40.g.dreamhost.com (Postfix) with ESMTP id 6EB7980A80; Wed, 2 Sep 2020 12:33:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h=date :from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=cryptonector.com; bh=PyKB3DvMTeT8py nEv0KQ6ybyT90=; b=X3TsD1wNHxe5TQ1l7uTUq6jMJUGLTded9xSTerK5BJOh5f gpTa0h+4PGHAVSJSX+XhBQF9zkGah6Vbt/1DJBqAOwLAkVSFekDC+MpwKAvp1R8O 4l1SGC3L5+DkAPBh2ZcaRQ+xhDDvEHvoMl20tVDfXHSwpXGqCITa5/5VwuAeE=
Received: from localhost (unknown [24.28.108.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a40.g.dreamhost.com (Postfix) with ESMTPSA id D2C2180A7F; Wed, 2 Sep 2020 12:33:03 -0700 (PDT)
Date: Wed, 02 Sep 2020 14:33:01 -0500
X-DH-BACKEND: pdx1-sub0-mail-a40
From: Nico Williams <nico@cryptonector.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: saag@ietf.org
Message-ID: <20200902193300.GW3100@localhost>
References: <4645.1599064072@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <4645.1599064072@localhost>
User-Agent: Mutt/1.9.4 (2018-02-28)
X-VR-OUT-STATUS: OK
X-VR-OUT-SCORE: 0
X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduiedrudefledgudefkecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdfftffgtefojffquffvnecuuegrihhlohhuthemuceftddtnecunecujfgurhepfffhvffukfhfgggtuggjfgesthdtredttdervdenucfhrhhomheppfhitghoucghihhllhhirghmshcuoehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmqeenucggtffrrghtthgvrhhnpefftdektefhueetveeigfefgeejteejvdfhhefgvddtfeeujeehleeguefhgffhgfenucfkphepvdegrddvkedruddtkedrudekfeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhhouggvpehsmhhtphdphhgvlhhopehlohgtrghlhhhoshhtpdhinhgvthepvdegrddvkedruddtkedrudekfedprhgvthhurhhnqdhprghthheppfhitghoucghihhllhhirghmshcuoehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmqedpmhgrihhlfhhrohhmpehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhmpdhnrhgtphhtthhopehnihgtohestghrhihpthhonhgvtghtohhrrdgtohhm
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/w3czrsop4o-CnYsfLrGjq5igb_0>
Subject: Re: [saag] can an on-path attacker drop traffic?
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Sep 2020 19:33:08 -0000

On Wed, Sep 02, 2020 at 12:27:52PM -0400, Michael Richardson wrote:
> A firewall or router is a potential on-path attacker, but it can also drop packets.
> What do we call this?
> This was historically called a MITM, and it implied all the attributes of
> on-path.  But it is unclear to me if MITM > on-path, or MITM == on-path.

To me on-path means physically or logically (e.g., after DNS spoofing or
route take over) in the path.

MITM is about being in the middle at some higher layer than IP.  For
example, in TLS, which you can do if you can subvert a CA trusted by the
client.

You can have an on-path (physically) attacker who nonetheless cannot
successfully mount an MITM attack on TLS traffic it gets to see and even
alter.

Nico
--

v2.23.0 | Report a Bug | By Email