Re: [tcpm] DoS attack from misbehaving receivers

In addition to David and Gavin's comments:

On Fri, Jan 12, 2007 at 05:05:20PM -0800, Caitlin Bestler wrote:
> Single flows of over 10 Mbits being sent to a stranger over
> the wide internet can be easily flagged at many different 
> layers.

There is no requirement in the attack that any one flow would be large
(10MB or what have you) or in any way anomalous.  As discussed in the
paper, the attacker can simply create many small streams instead of few
large streams such that no intrusion detection system or rate limiting
queue is affected.  Because the ACK stream is used to determine when to
timeout (ACK clocking, forged TCP timestamps), when to send (incoming ACK
frees new segments), and how much to send (the number of new segments
freed), the attacker is in complete control of the connection, and can
shape traffic nearly arbitrarily.  So an intelligent attacker can shape
each connection to appear to be a perfectly "normal" connection to any
other layer then layer4, for any definition of normal.  That is why the
fix to this problem must be at the transmission layer.

> Keep in mind that *any* form of rate shaping will severely
> impact this attack because the attacker will no longer be able
> to predict the timing of tcp sequences.

I do not believe this to be true.  The attack described by David and Gavin
("lazy optack" in my paper) defeats this.  Additionally, the standard
optack attack defeats this when the attack simply ACKs less often (e.g.,
1 ack/500ms) but to more streams for the same total aggregate traffic.
This behavior, as described in the paper, is actually required in practice
to prevent ACKing ahead of sent data, because non-randomized rate TCP
streams naturally have sufficient entropy in the segment generation rate
that this is already a concern.

- Rob
.

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm