RE: [tcpm] DoS attack from misbehaving receivers

-----Original Message-----
From: dwmalone@cnri.dit.ie on behalf of David Malone
Sent: Fri 1/12/2007 4:01 AM
To: Gavin McCullagh
Cc: Rob Sherwood; Caitlin Bestler; tcpm@ietf.org
Subject: Re: [tcpm] DoS attack from misbehaving receivers

> We implemented a basic attack of this recently before realising that others
> had been here first.  I've thrown up a few quick results here using a
> recent linux kernel on sender and receiver:

> 	http://www.hamilton.ie/gavinmc/drop_dupack_attack/

Note, while this was in the lab, we achieved similar results in the
wild. Using a clean Linux+Apache install over the Internet, we
convinced Apache to send a large file at 80Mbps to a host with a
1Mbps access link.  In light of some of the recent discussion on
Bugtraq, we probably don't really even need the large file.

We'd also arrived at basically the same fix as suggested by Rob.
Would it be interesting to see the fix written up as a draft, so
technical issues surrounding it can be identified? Certainly, some
care is required in the details of the fix to avoid introducing
other attacks on TCP. (It could fit naturally as an additional fix
section in draft-azcorra-tcpm-tcp-blind-ack-dos?)

	David.

------------------------

Documenting the attack is definitely a good idea, and I agree
that it is essentially a blind ack attack (even though it is a 
partial blindness, since *some* of the send segments reach
the attacker).

But I still don't see doing anything non-standard in the TCP
stack as a counter-measure.

Single flows of over 10 Mbits being sent to a stranger over
the wide internet can be easily flagged at many different 
layers.

Keep in mind that *any* form of rate shaping will severely
impact this attack because the attacker will no longer be able
to predict the timing of tcp sequences.

Slightly random rate shaping has no impact on TCP, and
could easily be just as effective.

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm